yashsingh1/xdaforums huggingface dataset:
[G2 and Desire Z Android Development] guhl99:
Some clarification on how gfree works and why it can fail

Reading some messages here that gfree failed and the theories why it failed leads me to writing this to bring some clarification.

There are 2 security systems that HTC put in place that gfree has to take down before it can change the security settings that are stored in partition 7 of the emmc chip.

1. The emmc - chip is write protected by it's controller using a write protection that is setup once on boot and sticks until power down. scotty2 worked around this security system using a kernel module called "wpthis.ko" that actually takes down the power of the emmc chip and powers it back on without the write protection.

wpthis.ko is now embedded in gfree but still used.

People who already perma-rooted the old way by either using wpthis.ko directly or using a visionary version that did perma-rooting and then flashed the engineering hboot might believe that their emmc-chip is not write protected anymore but this is not true. The eng-hboot only turns of the write protection for the system partitions not for the radio partitions.

This is why gfree has to use wpthis.ko also on phones that are already perma-rooted.

2. In the kernel driver of the emmc card (file drivers/mmc/card/block.c) HTC added code that checks for writes below address 131072 and if true fires a BUG() - this will make the kernel crash and the phone reboot.

gfree uses a rather complicated method to find this in the running kernel and to patch it in memory. This is maybe the most complicated part of gfree.

After these to security systems have been brought down the last step of gfree is to first create a backup of partition 7 to the sdcard and then patch partition 7 in different places to achieve radio s-off, super-cid or remove the sim-lock (or do whatever you told it to do using the command line options in version 0.02).

So as the first two things are kernel dependent there is a huge possibility that one or both of them fail with a non stock kernel. scotty2 did his best to develop a program that will work on most kernels but as the kernel developers bring out more and more new enhanced kernels the probability that it will fail increases.

So to summarize:

- If your phone rebooted while using gfree:

gfree could not remove the kernel BUG in step 2 and therefore the kernel crashes as gfree writes to partition 7

- If everything looked fine and gfree said "Done" but after you reboot gfree_verify still shows that all security locks are one (secu_flag=1 and CID is not 11111111) then probably step 1 in gfree failed and could not drop the write protection of the emmc chip.

In any case:

- If you are using a non stock kernel and it fails:

Make a nandroid backup of your phone -> flash a stock kernel -> run gfree -> run gfree_verify -> restore your nandroid backup

Then come here and report the exact kernel version that you where using when it failed.

And please don't come here saying that something did not work if you did not try it with a stock kernel first.

have fun - Guhl
[G2 and Desire Z Android Development] AnyDone:
So lets say that I have engineering hboot and root in my phone. (To be exact running CM6.1).

But what I have heard these is some risk in flashing a new rom because it MAY overwrite my hboot and in the middle of flashing cause some serious problems.

Now I would like to acquire radio S-OFF if it is risk free.

To do this I only run gfree?
[G2 and Desire Z Android Development] guhl99:
Yes exactly, flashing a new complete ROM that is not fake S-OFF can cause serious problems because then the new hboot will not flash the rest of the ROM because the signature check fails.

The best thing you can do is follow the guide at http://xdaforums.com/wiki/index.php?title=HTC_Vision#Unlock_the_Phone.2C_Set_SuperCID.2C_and_Turn_Radio_S-OFF.

This section of the wiki is meant for people that already have hboot with the fake S-OFF.

It should work as described there without risk. And the cyanogenmod kernel should also work but if you run into problems then read the posting above (http://xdaforums.com/showpost.php?p=9804172&postcount=279)

have fun - guhl
[G2 and Desire Z Android Development] Novek:
Hi all

I've used the "fake" S-OFF for some time now, and tried to get the radio s-off etc. yesterday. I tried the method listed above, but got some errors (can't remember correctly just now) which I believe was related to kernel. I then flashed a cm-based kernel which got me further, but with a warning when running the ./gfree -f command. After the reboot I tried to verify, but nothing sticked.

Any tips on what I'm doing wrong? Currently running virtous Sense with Evils latest kernel for sense (flashed back after the failed attempt).

Thanks!

/edit--- Damn.. should've read the part that said "should use stock kernel to be sure", though I read somewhere that the CM-kernel should work... Will try with stock later on today!
[G2 and Desire Z Android Development] jclem65:
yes i mounted my phone and put the gfree binary on the root of my sd card.

i see some people have to do it a few times before it sticks. thanks for your help

i will keep at it untill it works.....
[G2 and Desire Z Android Development] steviewevie:
Thanks for a very useful post. I didn't know about that bit. Good to have some more debugging info for if folks run into gfree problems.
[G2 and Desire Z Android Development] Perduabo23:
Scotty, and everybody else, THANKS! THANKS! THANKS! THANKS!

Finally was able to perm root -s off and super CID and verified with Gfree_verify by following the guide you devs put here!

now i have to figure out a good rom to use. tried VIRTUOUS but apps kept force closing; tried CYANOGEN (MOD) but it hung on boot screen. Im prolly doing or overlooking something noobish. As soon as I get a REAL job I'll toss beer money your way!
[G2 and Desire Z Android Development] Snap Jackel Pop:
Ugh. I've been trying to do this all night. I had done the previous rooting method and I'm trying to make it perm perm as well as unlock. However it seems that any rom I try ends up failing. I've tried CM RC3, CM stable, the latest pershoot, as well as my backup of my stock OTA update. The gfree script seems to complete with no visible errors, however when I run the verification script, Secu flag and Simunlock both display 1.

GFree log:

GFree_Verify results

I'm downloading the stock OTA deodex rom now to give that a try. edit: Failed too

I did recently update the radio, could that be causing the issue?

Thanks for any help.
[G2 and Desire Z Android Development] fenestrator:
Works! But I wish I had it 3 weeks ago.... : (

I was in South Africa and actually got a SIM unlock code from T-Mobile in advance. So with my unlocked and rooted G2 I loaded up an MTN (cell phone carrier) SIM and was able to only do so much, their system needed to load firmware onto my phone so that I could get 3G access so I didn't get as much use out of my G2 as I expected. All said, my phone super-rocks now!
[G2 and Desire Z Android Development] guhl99:
post your firmware versions

which radio firmeware is this?
[G2 and Desire Z Android Development] Snap Jackel Pop:
Radio: 12.28e.60.140fU_26.04.02.17_M2

Kernel: 2.6.32.17-g9ab3677

htc-kernel@and18-2 #1

HBoot: 0.76.2000

Is this what you need?
[G2 and Desire Z Android Development] guhl99:
Where did you get this radio from? Is this G2 or DZ?
[G2 and Desire Z Android Development] steviewevie:
That's the radio from the DZ Egypt ROM.
[G2 and Desire Z Android Development] sino8r:
Nope, i actually downgraded the kernel to the recommend one. It's the rom for sure.
[G2 and Desire Z Android Development] Snap Jackel Pop:
This radio from this thread: http://xdaforums.com/showthread.php?t=799208 (Vision_RADIO_12.28e.60.140f_26.04.02.17)

Installed it on my G2 after a bunch of users tried it and had no problems.

Thanks for your help.

Could it be that I need to upgrade to a newer version of Hboot ?
[G2 and Desire Z Android Development] guhl99:
No, but it could be that you have to downgrade to an older version of the radio.

You are the second one where the changes done by gfree did not stick using the egypt-radio.

I am at work now, if you don't sort this out try to meet me at #G2ROOT at about 7pm (UTC +1).

And for now I would strongly advise against using the egypt-radio before radio S-OFF.
[G2 and Desire Z Android Development] Snap Jackel Pop:
Is it safe to downgrade the radio? Just to confirm 2000 UTC right ?
[G2 and Desire Z Android Development] guhl99:
I never downgraded the radio but it has been done from OTA to pre-OTA by others without problems (as far as I know)

7pm (UTC +1) = 6pm UTC = 18:00 UTC
[G2 and Desire Z Android Development] Snap Jackel Pop:
Sounds good. I'm downgrading the radio now so I'll give it a try and get back to you. If this fixes it i'll send a pm to the OP of the radio thread and let him know that there is a possibility that updating the radio can conflict with using gfree.

EDIT: Worked. Thanks for helping me figure out the problem.
[G2 and Desire Z Android Development] Radioactive Death:
This process worked flawlessly for me.

I was running CM 6.1 Stable with pershoot's kernel. Here are the steps I took:

1. Made a Nandroid

2. Flashed CM 6.1 Stable after clearing cache.

3. Verified I was running the CM kernel not pershoot's.

4. Ran gfree

5. Rebooted and ran gfree_verify. @CID=11111111,@secu_flag=0,@SIMLOCK=00.

6. Restored my nandroid

@CID,@secu_flag,@SIMLOCK still as should be.

Thanks scotty2,guhl99, and everyone else!
[G2 and Desire Z Android Development] Duffm4n:
Pardon me for my noobishness, but when I try executing the commands from temp root it tells me adb: permission denied. I'm a willing learner so any help is appreciated..thanks.
[G2 and Desire Z Android Development] steviewevie:
Are you running these commands on your PC ? Just checking, because they should be at the PC command prompt, not on the phone (so don't do "adb shell" from the PC then type in "adb push" etc).

Normally "adb: permission denied" means you're trying to run adb on your phone.
[G2 and Desire Z Android Development] Duffm4n:
yes, i'm on my pc.
[G2 and Desire Z Android Development] steviewevie:
What command is it that you're typing exactly which gives you "adb: permission denied" ? And do you have a $ prompt or a C:> prompt when you're typing it ?
[G2 and Desire Z Android Development] Duffm4n:
Ok, I noticed that you said not to write adb shell, and then adb push.

When I write adb push without writing adb shell beforehand, I am able to execute the first two commands (i.e 1165 kb/s..), but when I get to the third command below it tells me cannot stat 'rage' : no such file or directory

adb push rage /data/local/tmp/rage

edit: I deleted the g2temp file and downloaded again. I am now past temproot stage. yay :)

edit 2: when I get to the /data/loca/tmp/root i get : mkdir failed for /system/xbin, file exists. is this a problem?
[G2 and Desire Z Android Development] steviewevie:
ok, well done.

No, that "mkdir" error isn't a problem, just ignore that. But look out for any other error messages. When you do the "insmod" bit make sure you get the "right" error message as per the guide, if you get any other error message it hasn't worked. And you can skip over the "dd" command, you don't need that at this stage (but do all the rest).
[G2 and Desire Z Android Development] Duffm4n:
What is "insmod"? I didn't see that in the guide.
[G2 and Desire Z Android Development] steviewevie:
Which guide are you following ? The rage guide at http://xdaforums.com/showthread.php?t=834228 has a step in the permanent root bit which does an "insmod" command then a "dd".
[G2 and Desire Z Android Development] Duffm4n:
the gfree guide. i used the rage command to get temp root.
[G2 and Desire Z Android Development] steviewevie:
ok, you asked a question about running the "root" script just earlier, which is part of the rage procedure (the permanent root bit). So that's why I was asking about that, since that also has the "insmod" and "dd" in it.

Ah, ok, I see, I just realised you are following the wiki rather than this thread's first posting, so you're running "root" after the gfree.

You should be ok now, and can go through the verification steps to make sure it worked.
[G2 and Desire Z Android Development] arts711:
Thanks a lot but question

Thanks to everyone here esp the developers, this guide def got me through rooting relatively easily, esp when combined with the adb guide.

One small question though.. Is there some sort of performance hit caused by this or does this affect the radio. I can't say for sure, but it seemed like my quadrant and linpack scores were a bit lower than usual and reception seems a bit flaky (had a hard time keeping a data connection).

Thanks in advance
[G2 and Desire Z Android Development] steviewevie:
No, none of those things should be affected by this procedure. Maybe try running the test again, you can get different results if you run at different times etc. Also maybe you just had local problems with your mobile cell masts/towers ?
[G2 and Desire Z Android Development] sino8r:
Quick question... why in the world has this thread become un-stickied! That's crazy! I also think the radio reference thread should be pinned too...
[G2 and Desire Z Android Development] steviewevie:
I was wondering that too ...
[G2 and Desire Z Android Development] mejorguille:
Well I finally got around to getting radio s-off. Process was extremely simple and took no more than 3 minutes. Thanks for the easy guide! I also upgrade to the new egypt radio without any issues.
[G2 and Desire Z Android Development] verkion:
Hrm...I can't seem to S-OFF on a G2 that I have already perm-rooted using rage method, (i.e. use gfree v.2 to SuperCID & S-OFF). Could it be because I'm using the new egypt Radio? It's already been SIM Unlocked so its not a huge deal.

Thanks!

verkion
[G2 and Desire Z Android Development] guhl99:
Yes! The egypt-radio is HTCs answer to wpthis.ko and gfree.

It prevents us from power-cycling the emmc chip and therefore all radio-partitions are write-protected.

You have to downgrade the radio if you want to use gfree.

As soon as HTC will start to deliver phones with the new radio-firmware pre-installed we will not be able to perm-root the G2/DZ/DHD anymore because then not only the radio-partitions will be write protected.

(If we don't find a way to remove the write protection again)

so have fun - Guhl
[G2 and Desire Z Android Development] xyrcncp:
Is gfree working with CM6.1.1? I believe it's a new kernel. I'm asking because I've done the gfree (v02) and ran gfree_verify and the return info looks like I'm still locked.

I get

gfree verify_cid returned:

@CID: TMOB01

OK

gfree verify_secu_flag returned:

@secu_flag: 1

OK

gfree verify_simlock returned:

@SIMLOCK= 01

edit: 5 tries...nothing. I deleted both gfree and gfree_verify from /data/local and started the process all over again each time. Oh well. :)

And now I've noticed that after doing all this, my market is not downloading anything at all. I've cleared market cache and data, fixed permissions and rebooted and no dice...
[G2 and Desire Z Android Development] popokrew:
I'm in the same boat except now my sim isn't recognized. Running cm6.1.1 also...
[G2 and Desire Z Android Development] popokrew:
Ok well got the sim message because I had stopped ril-daemon. I went back to cm6.1 stable and was able to use gfree and verify. Going back to 6.1.1 now.
[G2 and Desire Z Android Development] deliberate187:
Yes. I love it. I just successfully did mine and can now flash any rom I want without fear of brickage! Thank you so much.

And being able to switch SIMs is always nice too :D

I used the manual instructions because I like to see how it's done inside of the programs, but I love it nonetheless. :D
[G2 and Desire Z Android Development] xyrcncp:
Maybe 6.1.1's kernel is not supported and it needs the 6.1.0 kernel...hmmmm :)

It's too late and I have to be at work early so I'll try it again sometime over the weekend.
[G2 and Desire Z Android Development] popokrew:
Yep it doesn't seem like the kernel with cm6.1.1 works. I'm all good now.
[G2 and Desire Z Android Development] verkion:
I should have probably mentioned I was using CM6.1.1 as well as Egypt. Hrm...I guess I should try 6.1.0 kernel. Is anyone else certain of the "un-gfree-ability" of Egypt radio?

Thanks!

verkion
[G2 and Desire Z Android Development] steviewevie:
It's worth a try. It can't hurt and will be interesting to see.

My own personal guess is that it will work, as long as you don't have the hboot from the Egypt RUU/ROM.
[G2 and Desire Z Android Development] verkion:
Yeah...gonna do so now. I really should have noticed that I had downloaded 6.1.1 versus 6.1 Oh well. DOH! I'll report back in a few.

verkion
[G2 and Desire Z Android Development] verkion:
Ok...so gfree does work with Egypt Radio and cyanogen 6.1. I couldn't get gfree_verify to work though but just ran through the verification manually.

Thanks!

verkion
[G2 and Desire Z Android Development] steviewevie:
Did you stop the ril-daemon before running gfree_verify ? That's in the Wiki. Just thought I'd check.

Good to know it does work with the Egypt radio. I think the big security issue is probably with the new stock hboot in that RUU/ROM.
[G2 and Desire Z Android Development] EclipseX:
all work like a charm :D

I already have my t-mobile g2 into vodafone portugal and build desire z in portuguese :D

best regards for u má men
[G2 and Desire Z Android Development] guhl99:
I am very sorry to say this, but I do not believe this. I think we have tested this very thoroughly and could not remove the write protection from the radio configuration on partition 7 when the egypt radio firmware (Vision_RADIO_12.28e.60.140f_26.04.02.17) is installed on the phone.

So if you are really absolutely sure that you had this radio firmware installed while you where able to change radio S-OFF, CID and/or SIM-LOCK by using gfree I would like you to show up on IRC #G2ROOT and look for me.

It is interesting to hear that CM 6.1.1 kernel does not work with gfree but this should be easier to address.
[G2 and Desire Z Android Development] O W Y N:
I have just bought my desire z and unlocked it using this method. But ever since i have started using it on my carrier the messaging app has not been threading the messages properly. All my searches have turned up empty and its frustrating to have my recived messages be 5 hours behind the actual time. Thank you in advance.
[G2 and Desire Z Android Development] verkion:
You are ABSOLUTELY correct...sorry for the mis-information guys. I THOUGHT I had flashed the newer Egypt baseband, (forgive me since I tend to do this very late at night/early in the morning), but I did NOT have the radio that guhl has listed. Again, my apologies!

Thanks for point this out guhl!

verkion
[G2 and Desire Z Android Development] eyoung1978:
Hoping someone can help me out with this.

I have a G2 that I temp rooted at first with visonary, then when the permaroot came out I used the Hboot process. I then deleted and uninstalled visionary.

I know want to unlock my phone using the gfree method. I get all the way through pushing gfree to /data/local then go on to terminal on my phone and code int the gfree -f , after that it would say it is partitioned and the phone would automatically reboot. I don't get to the # sync part.

I use gfree verify and it still shows my sim is locked. I tried gfree -S as well and the same thing. Can anyone help me out with this?

Thanks in advance.
[G2 and Desire Z Android Development] Jrbourque:
anyone know if you have only permrooted with wpthis and need to go back to stock to replace phone, would I have to do this guide first and then flash stock img?
[G2 and Desire Z Android Development] steviewevie:
I'm afraid that's nothing to do with this procedure though. All this procedure does is change the configuration of your phone via setting a few flags. That can't have anything to do with how you receive your messages. It must be a coincidence perhaps to do with rebooting your phone and something going on with your network.
[G2 and Desire Z Android Development] steviewevie:
Depends how you did the permanent root, for example if you have S-OFF too and/or put on the engineering hboot. To know how to go back to stock safely, we need to know exactly what you've done (wpthis is just a kernel module to turn off write protection, there may be several other steps you did after that).
[G2 and Desire Z Android Development] steviewevie:
Can you post up the exact output you get from the gfree -f please ?

Also, what ROM and what kernel are you running ? It doesn't work on every single different kernel combination.
[G2 and Desire Z Android Development] Jrbourque:
I followed rage to perm root instructions....I will go back and see if I did anything extra
[G2 and Desire Z Android Development] da_enlightener:
This has to do with the Rogers network. The timestamp doesn't work on phones that are not locked to them.

Download 'sms time fix' from marketplace.
[G2 and Desire Z Android Development] eyoung1978:
Hey thanks for getting back to me, this is exactly what comes up after when i type in the gfree -f

"-secu_flag off set

--cid set. CID will be changed to: 11111111

--sim_unlock. SIMLOCK will be removed

Section header entry size: 40

Number of section headers: 44

Total section header table size: 1760

Section header file offset: 0x000138b4 (80052)

Section index for section name string table: 41

String table offset: 0x000136fb (79611)

Searching for .modinfo section...

- Section[16]: .modinfo

-- offset: 0x00000a14 (2580)

-- size: 0x000000cc (204)

Kernel release: 2.6.32.26-TheOfficial-vision

New .modinfo section size: 212

Attempting to power cycle eMMC... OK.

Searching for mmc_blk_issue_rq symbol...

- Address: c02b67d4, type: t, name: mmc_blk_issue_rq, module: N/A

Kernel map base: 0xc02b6000

Kernel memory mapped to 0x40009000

Searching for brq filter...

- ***WARNING***: Did not find brq filter.

Patching and backing up partition 7...

patching secu_flag: 0

Erick-Youngs-iMac:tools adb crumbs$"

The phone then reboots and I don't get a chance to type sync on adb shell

I'm using the Enomther's rom

Kernel 2.6.32.26-TheOfficial-visionroot@abomblaptop #1

I even switched over to Cyanogen and I was having the same problem
[G2 and Desire Z Android Development] dadewy:
Yeah definitely a problem with it not liking the kernel. Strange though.... I thought CM was the go-to ROM/Kernel to get this to work. I remember distinctly that when I had this very same problem, I switched to CMRC4 briefly in order to run gfree and it worked fine. Weird.
[G2 and Desire Z Android Development] O W Y N:
Thank you so much. I figured the fix would be a lot more complicated than it was! This was the only complaint i had about my phone, and now i have none. Thanks for making my day!
[G2 and Desire Z Android Development] steviewevie:
I don't think gfree works with the new CM 6.1.1. But it worked with 6.1.0, I believe.

Yes, it's a kernel incompatibility problem.
[G2 and Desire Z Android Development] eyoung1978:
GOT IT TO WORK!

Flashed a Stock ROM and kernel and redid the gfree -f process. Verified it and my simlock is now 00

Thanks for the help
[G2 and Desire Z Android Development] rstonex:
Wife just got a G2 last night, and within minutes, she was asking for me to root it so she could try another ROM. Easiest root ever, and she was able to use her ATT sim as well. T-mobile won't give me any more unlock codes for a couple months, since I've been through so many phones recently, and have them unlock everything as I go, so this is a perfect solution.

I did my G2 using visionary earlier, but it looks like I can just run this on top of it to get the sim unlock as well. I'll do this tonight.

Thanks for all the work and excellent write-up.
[G2 and Desire Z Android Development] jojo_16:
What if I'm rooted and had used the gfree do I need to downgrade to egypt radio??

And I just want to ask a question so you mean if T-MO or HTC send an OTA update then I didn't downgrade to the egypt radio will my phone gonna be root proof??