Taylorbyte.com

Documentation Wiki

Home Docs/Wiki Forum Services Account Terms and Conditions Support Contact
Edit
Rename
History

dhd-root

WARNING!! if you follow this wiki takes you take full responsibility for any damage done to your phone.

ADB (Android Development Bridge)

Download ADB

To download ADB the Android SDK needs to be downloaded first, It can be downloaded from this page: http://developer.android.com/sdk/index.html

wget http://dl.google.com/android/android-sdk_r12-linux_x86.tgz
tar -xf android-sdk_r12-linux_x86.tgz

ADB is part of the Android SDK Platform-tools. To download run Android SDK and AVD Manager GUI

cd android-sdk-linux_x86/platforms
sh tools/android
  • Click Available packages
  • Expand Android Repository
  • Tick Android SDK Platform-tools
  • Click Install Selected
  • Select Accept All
  • Click Install
  • A message will be displayed: ADB Restart: A package that depends on ADB has been updated. Do you want to restart ADB now?
  • Click Yes
  • Close all Android SDK and AVD Manager Windows

You now have ADB

Prepare phone for ADB

For ADB to work the phone must have "USB debugging" turned on

  • Settings
  • Applications
  • Development
  • USB Debugging

Downgrade firmware

In this wiki we will use a branded Desire HD with Build number 2.37.xxx.

If the phones firmware is version 1.32.405.6 then you can skip to the Root section. You can check the firmware version by going into Settings > About phone > Software information > Build number

If the phones firmware has been upgraded then you need to downgrade back to 1.32.405.6.

Because Android only likes to upgrade firmware we need to temporarily root the phone and lower the phones software version to a fake value lower than the version number we want to flash.

Download Temporary rooting programs for 2.37

from http://wiki.cyanogenmod.com/wiki/HTC_Desire_HD:_Firmware_Downgrade_%28Gingerbread%29

wget http://cmw.22aaf3.com/common/fre3vo.zip
wget http://cmw.22aaf3.com/common/misc_version_02.zip
wget http://cmw.22aaf3.com/ace/stock/1.32.405.6/PD98IMG.zip

md5sum fre3vo.zip
md5sum misc_version_02.zip
md5sum PD98IMG.zip
  • fre3vo: 010e076a4a93be876579711bf8934c70
  • misc_version 0.2: 1f40aaf88d1bf15775631a58c4361218
  • 1.32.405.6 firmware: c3d244a9f056e48ee3851a14ff52204c

Unzip files

unzip fre3vo.zip
unzip misc_version_02.zip -d misc_version_02
mv misc_version_02/misc_version .
rm -r misc_version_02

Copy files to phone

sudo ./adb push fre3vo /data/local/tmp
sudo ./adb push misc_version /data/local/tmp
sudo ./adb push PD98IMG.zip /sdcard/
sudo ./adb shell chmod 755 /data/local/tmp/fre3vo
sudo ./adb shell chmod 755 /data/local/tmp/misc_version

Get temp root

sudo ./adb shell /data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
sudo ./adb shell

You should have a hash symbol now

Lower the Build number

/data/local/tmp/misc_version -s 1.00.000.0
exit

Flash 1.32.405.6 (first attempt)

sudo ./adb reboot bootloader

Select(press power button) BOOTLOADER

wait a few seconds...

If it says "Do you want to start update? <VOL UP> Yes" skip the "Creating a GoldCard" section continue on with "Flash 1.32.405.6".

If CID Failed you need a "Gold Card"

Creating a GoldCard

get forward CID through ADB

sudo ./adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid

Reverse CID with this website: http://hexrev.soaa.me/

OR Install "GoldCard Helper"

Install "GoldCard Helper" from Market. Open GoldCard Helper and look for mmc2 Reverse CID.

goto: http://psas.revskills.de/?q=goldcard type CID into website

Click "Download Goldcard !"

Copy GoldCard img to phone and temp root phone.

sudo ./adb push goldcard.img /data/local/tmp
sudo ./adb shell /data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
sudo ./adb shell

Check which device SD card is using.

cd /data/local/tmp
mount

Look for device that /mnt/sdcard is on

Create GoldCard with SD card

dd if=/data/local/tmp/goldcard.img of=[your SD device here mine was /dev/block/vold/179:65]
exit

Check that SD card mounts

  • Menu > Settings > SD & phone storage > Unmount SD card
  • Menu > Settings > SD & phone storage > Mount SD card

If it says "Damaged SD card" you need to try a different SD card for the GoldCard process.

Flash 1.32.405.6

sudo ./adb reboot bootloader

Select(press power button) BOOTLOADER

wait a few seconds...

It should say "Do you want to start update? <VOL UP> Yes"

Do the update, wait for all the stuff it may take a few minutes.

S-OFF

Prepare phone for ADB

For ADB to work the phone must have "USB debugging" turned on

  • Settings
  • Applications
  • Development
  • USB Debugging

Download Temporary rooting programs for 1.32.405.6

from http://wiki.cyanogenmod.com/wiki/HTC_Ace:_Rooting_%26_CyanogenMod

wget http://cmw.22aaf3.com/common/busybox.zip
wget http://download.clockworkmod.com/recoveries/recovery-clockwork-5.0.2.3-ace.img
wget http://cmw.22aaf3.com/common/gfree_07.zip
wget http://cmw.22aaf3.com/common/psneuter.zip
wget http://cmw.22aaf3.com/common/root_psn.zip
wget http://cmw.22aaf3.com/common/su-2.3.6.2-efgh.zip

md5sum busybox.zip
md5sum recovery-clockwork-5.0.2.3-ace.img
md5sum gfree_07.zip
md5sum psneuter.zip
md5sum root_psn.zip
md5sum su-2.3.6.2-efgh.zip
  • busybox: 25c5db694c987995909cc3166d4f01b0
  • ClockworkMod Recovery: 072a643b0aba983a4b9994db0e113c5e
  • gfree 0.7: 6916cf05b0805aeac9effdc1725aaa12
  • psneuter: 89c2dec8d72d87b4c669f44dd31c8d17
  • root_psn: c8fe38ef55eb8951def9ff17b2eb99c1
  • Superuser package: 43d9a40b63e916635d5ad7ca32433fab

Unzip files

unzip busybox.zip
unzip gfree_07.zip -d gfree_07
mv gfree_07/gfree .
rm -r gfree_07
unzip psneuter.zip -d psneuter-tmp
mv psneuter-tmp/psneuter .
rm -r psneuter-tmp
unzip root_psn.zip
unzip su-2.3.6.2-efgh.zip

Copy files to phone

sudo ./adb push busybox /data/local/tmp/
sudo ./adb push recovery-clockwork-5.0.2.3-ace.img /data/local/tmp/recovery.img
sudo ./adb push gfree /data/local/tmp/
sudo ./adb push psneuter /data/local/tmp/
sudo ./adb push root_psn /data/local/tmp/
sudo ./adb push su /sdcard/
sudo ./adb push Superuser.apk /sdcard/

sudo ./adb shell chmod 755 /data/local/tmp/*

Get temp root

sudo ./adb shell

ADB

cd /data/local/tmp
./psneuter

sudo ./adb shell

You should have a hash symbol now

S-OFF, sim unlock, Carrier ROM unlock

cd /data/local/tmp
./gfree -f -y recovery.img

./root_psn
sync

ROOT COMPLETE YaY!!

Install engineering hboot

Installing hboot is the only thing that can brick the phone and isn't needed for root. Is only installed for regular flashers, as it lets you use the FASTBOOT command.

wget http://cmw.22aaf3.com/ace/hboot/ace_glacier.hboot-0.85.2007.zip

md5sum ace_glacier.hboot-0.85.2007.zip

Engineering HBoot: b2c8834905bfa2349f5223077493140a

Unzip files

unzip ace_glacier.hboot-0.85.2007.zip

Copy files to phone

md5sum hboot-eng.img
sudo ./adb push hboot-eng.img /data/local/tmp/

sudo ./adb shell

Check md5sums of img file and old bootloader to ensure everything is correct.

cd /data/local/tmp
./busybox md5sum hboot-eng.img

df4fd77f44993eb05a4732210d2eddc6 hboot-eng.img

./busybox md5sum /dev/block/mmcblk0p18

954ee123699488613c5e0afd2d703c43 /dev/block/mmcblk0p18

./gfree -b hboot-eng.img

gfree backs up original bootloader to a file on the SD card similar to "/sdcard/part18backup-1320151896.bin"

./busybox md5sum /dev/block/mmcblk0p18

df4fd77f44993eb05a4732210d2eddc6 /dev/block/mmcblk0p18

md5sum of /dev/block/mmcblk0p18 should now match hboot-eng.img.

If the md5sum hasn't changed for /dev/block/mmcblk0p18 nothing has happend, but your phone is still safe with the original hboot. If the md5sum doesn't match either one rebooting now will brick your phone, try again.

Install LeeDrOiD firmware

Download LeeDrOiD and full wipe

wget http://leedroid.ftp.rshost.eu/DHD-Roms/LeeDrOiD_EXT4_FULL_WIPE.zip

Upload LeeDrOiD files Note: Unity kernel fixes DiskDrive mode on LeeDrOiD 4 Beta.

sudo ./adb push LeeDrOiD_EXT4_FULL_WIPE.zip /sdcard/
sudo ./adb push LeeDrOiD_HD_V4.0.0-SE-3.0-BETA.zip /sdcard/
sudo ./adb push UNITY_V9_2.6.35.14_OC2016_UV900_SLQB_CIFS_TUN_NOOP_EXT4_2WCR_VDD.zip /sdcard/

Reboot into recovery again

sudo ./adb reboot recovery

ClockworkMod Recovery

  • Install zip from sdcard > choose zip from sdcard > LeeDrOiD_EXT4_FULL_WIPE.zip > Yes - Install
  • choose zip from sdcard > LeeDrOiD_HD_V4.0.0-SE-3.0-BETA.zip > Yes - Install
  • choose zip from sdcard > UNITY_V9_2.6.35.14_OC2016_UV900_SLQB_CIFS_TUN_NOOP_EXT4_2WCR_VDD.zip > Yes - Install
  • +++++Go Back+++++
  • reboot system now

DONE YaY!!

After root flash engineering bootloader

After the phone has been rooted flashing it with the engineering hboot makes it easier to flash different firmwares onto the phone.

sudo ./adb shell

Backup current bootloader

Check bootloader md5sum

md5sum /dev/block/mmcblk0p18

954ee123699488613c5e0afd2d703c43 /dev/block/mmcblk0p18

backup

dd if=/dev/block/mmcblk0p18 of=/sdcard/ship-hboot.img

2048+0 records in 2048+0 records out 1048576 bytes transferred in 0.094 secs (11155063 bytes/sec)

Double check md5sum of backed up bootloader

md5sum /sdcard/ship-hboot.img

954ee123699488613c5e0afd2d703c43 /sdcard/ship-hboot.img

Exit adb shell ready to pull backup bootloader

exit

Pull backup bootloader from sd card

sudo ./adb pull /sdcard/ship-hboot.img ~/ship-hboot.img
sudo chown user:user ~/ship-hboot.img
chmod 644 ~/ship-hboot.img

Download engineering hboot

wget http://cmw.22aaf3.com/ace/hboot/ace_glacier.hboot-0.85.2007.zip -O ~/ace_glacier.hboot-0.85.2007.zip
unzip ~/ace_glacier.hboot-0.85.2007.zip
sudo ./adb push ~/hboot-eng.img /sdcard/eng-hboot.img

Go back in to adb shell

sudo ./adb shell

Check new bootloader md5sum

md5sum /sdcard/eng-hboot.img

df4fd77f44993eb05a4732210d2eddc6 /sdcard/eng-hboot.img

Install engineering hboot

dd if=/sdcard/eng-hboot.img of=/dev/block/mmcblk0p18

1048576 bytes transferred in 0.443 secs (2366988 bytes/sec)

Check hboot copied ok

md5sum /dev/block/mmcblk0p18

df4fd77f44993eb05a4732210d2eddc6 /dev/block/mmcblk0p18

Exit adb ready for reboot

exit

Reboot into bootloader

sudo ./adb reboot-bootloader

Bootloader should now have at top of screen ACE PVT ENG S-OFF

The phone should be now in FASTBOOT USB mode, used for flashing clockworkmod recovery or radio.

  • BOOTLOADER goes into normal boot loader menu
  • REBOOT boots OS
  • REBOOT BOOTLOADER reboot then go into normal boot loader menu

Download fastboot

wget http://attachments.xda-developers.com/attachment.php?attachmentid=378700&d=1281632551
mv attachment.php* ~/fastboot.zip
unzip ~/fastboot.zip

Download clockwork recovery

Main website: http://www.clockworkmod.com/recovery_images.html

wget http://download.clockworkmod.com/recoveries/recovery-clockwork-5.0.2.0-ace.img -O ~/recovery-clockwork-5.0.2.0-ace.img

Flash clockwork recovery

  • Reboot phone and hold volume down
  • Select FASTBOOT

FASTBOOT USB

sudo ./fastboot flash recovery ~/recovery-clockwork-5.0.2.0-ace.img

sending 'recovery' (3624 KB)... OKAY [ 0.607s] writing 'recovery'... OKAY [ 0.655s] finished. total time: 1.262s

select BOOTLOADER select RECOVERY

Creative Commons License

This guide is licensed under a Creative Commons Attribution-NoDerivs 3.0 Australia License.

Last edited by Brenton Taylor on Wednesday, November 2nd, 2011 (r2085).

Last modified: Fri, 16 Dec 11 01:05:18 +1000
2011 Taylorbyte
W3C