• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root How to downgrade and root 2.43.661.1 and up

giusdk said:
If you restart your phone and connects it to the pc, and choose to Sync, and then opens the HTC Sync program on your computer.. Does your phone show?

Mine doesn't.. I got the same problem as you.

But when i connect it as a external hard drive, it recognizes and i can work on the SD Card..
Click to expand...
HTC Sync working flawlessly for me.
 
Download The PD98IMG.zip here: v1.32.405.6 PD98IMG.zip

Make your gold card
Method Here: How To Make Gold Card for HTC Desire HD[/URL]

Now move the PD98IMG.zip to your goldcard.

Unplug your device, and plug it back in. Choose "Charge Only"
Make sure development is ticked on under Settings > Applications

download my HTC Ace Toolkit
(ie9 users will see it as unsafe, override and download the 'unsafe' file, its perfectly safe, ie9 says its unsafe becase of the .zip file extention. FU Microsoft!)

Extract it to your desktop.

Inside you'll find Shortcuts, Run Shortcut #1, and a command screen will appear.
Follow the Instructions
It will complete and reboot your device into bootloader where it will proceed in installing the 1.32 image.

now you can go to HOW TO: Root, Radio & Eng S-OFF a Desire HD/Inspire 4G and root, radio s-off and eng s-off. Since you already have my toolkit you can skip that step.
 
aswethinkweiz said:
How to downgrade and root 2.43.661.1 and up
​


After scouring the web for the possibilities of downgrading Gingerbread 2.43.661.1 it seemed I hit a wall. The only thing out there downgrade wise I could find was for the prior Gingerbread version 2.36. After days of searching I came across an Evo hack that I tried and voila it worked. Below you will find exactly what you need and how to execute the commands to gain the downgrade and move forward with temp/perm root. For all I know this may work on all devices but I have only tested it on the Telus HTC desire HD. Thanks go out to http://therootofallevo.com and the post from agrabren. Don
Click to expand...
 
JSLEnterprises said:
Ok, so

go to HOW TO: Root, Radio & Eng S-OFF a Desire HD/Inspire 4G in 9 Easy Steps
and download the 1.32 RUU.

Run the RUU without your phone connected, and once it starts up on the first screen, go to your temp folder
(Right click on My computer > Properties > Advanced System Settings > Environment Variables to see where they are on your PC)

Once in your temp folder there should be 2 folders with long numbered names within { }, in one of them there will be a few files and a subfolder, inside that subfolder will be a wackload of files and rom.zip

move that rom.zip to your desktop and rename it to PD98IMG.zip

Make your gold card
Method Here: How To Make Gold Card for HTC Desire HD

Now move the PD98IMG.zip to your goldcard.

Unplug your device, and plug it back in. Choose "Charge Only"
Make sure development is ticked on under Settings > Applications

download http://www.driphter.com/downloads/JSL/Droid/fre3vocmd.zip
(ie9 users will see it as unsafe, override and download the 'unsafe' file, its perfectly safe, ie9 says its unsafe becase of the .zip file extention. FU Microsoft!)

Extract it to your desktop.

Inside you'll find three batch commands.... Fre3vo Part I (A9191), Fre3vo Part I (A9192), and Fre3vo Part II (along with the actual files needed)

Rightclick on the first (if you're a Telus DHD, or AT&T Inspire 4G use A9192, otherwise use A9191) and run as administrator.
it'll do its thing and find the exploit.

once this is completed, unplug your device and then plug it back in, selecting charge only again (it says this in the batch)

now run part II

It will complete and reboot your device into bootloader where it will proceed in installing the 1.32 image.

now you can go back to my thread at the top and root, radio s-off and eng s-off.
Click to expand...
Same result: stuck at buffer offset and size.
 
SsZzliMm said:
Stucked at that point :(

Maybe I have to do a hard reset ???
Click to expand...


do a factory reset using the bootloader (pull out the sd card before you do this)

this essentially gives your device a clean slate.

make sure you have debugging enabled (so that adb is able to push to your device)

running the script should show the hex offsets its searching.
 
JSLEnterprises said:
do a factory reset using the bootloader (pull out the sd card before you do this)

this essentially gives your device a clean slate.

make sure you have debugging enabled (so that adb is able to push to your device)

running the script should show the hex offsets its searching.
Click to expand...
What if it will still not working after that ?

EDIT: I did it and I surprised that it displays a new line: Scanning region 2000000... How long is it take ?
 
SsZzliMm said:
What if it will still not working after that ?

EDIT: I did it and I surprised that it displays a new line: Scanning region 2000000... How long is it take ?
Click to expand...


a few minutes. if it hangs reboot the device, then run the 9192 version since the 9191 it scanned offsets that made the program fail.

im looking to clean up the code a bit more, so so much scanning doesnt have to take place.

When complete, post which offset the exploit was found at.
 
I've been looking everywhere on the forums for a gold card guide that doesn't require having an SD adapter, could someone help me out? Is it even possible to do that? Is having a gold card a necessary step?
 
reimur said:
I've been looking everywhere on the forums for a gold card guide that doesn't require having an SD adapter, could someone help me out? Is it even possible to do that? Is having a gold card a necessary step?
Click to expand...

you can use your phone as the adaptor. just switch to disk mode.
 
I'm getting a Model ID error when I'm in the bootloader. After it's done installing and checking the PD98IMG file on the root of the SD card, it tells me that I have an incorrect Model ID and asks me to reboot the phone. Is this a gold card issue? I followed the gold card tutorials very carefully and I didn't think that I messed up, but I might have. Could it be an incorrect PD98IMG file?

Code: 
C:\>cd\downgrade\

C:\Downgrade>adb push fre3vo /data/local/tmp
1594 KB/s (9796 bytes in 0.006s)

C:\Downgrade>adb push misc_version /data/local/tmp
2209 KB/s (15837 bytes in 0.007s)

C:\Downgrade>adb shell chmod 777 /data/local/tmp/fre3vo

C:\Downgrade>adb shell chmod 777 /data/local/tmp/misc_version

C:\Downgrade>adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFF
FF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
  id: msmfb
  smem_start: 802160640
  smem_len: 3145728
  type: 0
  type_aux: 0
  visual: 2
  xpanstep: 0
  ypanstep: 1
  line_length: 1920
  mmio_start: 0
  accel: 0
fb_var_screeninfo:
  xres: 480
  yres: 800
  xres_virtual: 480
  yres_virtual: 1600
  xoffset: 0
  yoffset: 0
  bits_per_pixel: 32
  activate: 16
  height: 106
  width: 62
  rotate: 0
  grayscale: 0
  nonstd: 0
  accel_flags: 0
  pixclock: 0
  left_margin: 0
  right_margin: 0
  upper_margin: 0
  lower_margin: 0
  hsync_len: 0
  vsync_len: 0
  sync: 0
  vmode: 0
Buffer offset:      00000000
Buffer size:        8192
Scanning region f0000000...
Scanning region f00f0000...
Scanning region f01e0000...
Scanning region f02d0000...
Scanning region f03c0000...
Scanning region f04b0000...
Scanning region f05a0000...
Scanning region f0690000...
Scanning region f0780000...
Scanning region f0870000...
Scanning region f0960000...
Scanning region f0a50000...
Scanning region f0b40000...
Scanning region f0c30000...
Scanning region f0d20000...
Scanning region f0e10000...
Scanning region f0f00000...
Scanning region f0ff0000...
Scanning region f10e0000...
Scanning region f11d0000...
Scanning region f12c0000...
Scanning region f13b0000...
Scanning region f14a0000...
Scanning region f1590000...
Scanning region f1680000...
Scanning region f1770000...
Scanning region f1860000...
Scanning region f1950000...
Scanning region f1a40000...
Scanning region f1b30000...
Scanning region f1c20000...
Scanning region f1d10000...
Scanning region f1e00000...
Scanning region f1ef0000...
Scanning region f1fe0000...
Scanning region f20d0000...
Scanning region f21c0000...
Scanning region f22b0000...
Scanning region f23a0000...
Scanning region f2490000...
Scanning region f2580000...
Scanning region f2670000...
Scanning region f2760000...
Scanning region f2850000...
Scanning region f2940000...
Scanning region f2a30000...
Scanning region f2b20000...
Scanning region f2c10000...
Scanning region f2d00000...
Scanning region f2df0000...
Scanning region f2ee0000...
Scanning region f2fd0000...
Scanning region f30c0000...
Scanning region f31b0000...
Scanning region f32a0000...
Scanning region f3390000...
Scanning region f3480000...
Scanning region f3570000...
Scanning region f3660000...
Scanning region f3750000...
Scanning region f3840000...
Scanning region f3930000...
Scanning region f3a20000...
Scanning region f3b10000...
Scanning region f3c00000...
Scanning region f3cf0000...
Scanning region f3de0000...
Scanning region f3ed0000...
Scanning region f3fc0000...
Scanning region f40b0000...
Scanning region f41a0000...
Scanning region f4290000...
Scanning region f4380000...
Scanning region f4470000...
Scanning region f4560000...
Scanning region f4650000...
Scanning region f4740000...
Scanning region f4830000...
Scanning region f4920000...
Scanning region f4a10000...
Scanning region f4b00000...
Scanning region f4bf0000...
Scanning region f4ce0000...
Scanning region f4dd0000...
Scanning region f4ec0000...
Scanning region f4fb0000...
Scanning region f50a0000...
Scanning region f5190000...
Scanning region f5280000...
Scanning region f5370000...
Scanning region f5460000...
Scanning region f5550000...
Scanning region f5640000...
Scanning region f5730000...
Scanning region f5820000...
Scanning region f5910000...
Scanning region f5a00000...
Scanning region f5af0000...
Scanning region f5be0000...
Scanning region f5cd0000...
Scanning region f5dc0000...
Scanning region f5eb0000...
Scanning region f5fa0000...
Scanning region f6090000...
Scanning region f6180000...
Scanning region f6270000...
Scanning region f6360000...
Scanning region f6450000...
Scanning region f6540000...
Scanning region f6630000...
Scanning region f6720000...
Scanning region f6810000...
Scanning region f6900000...
Scanning region f69f0000...
Scanning region f6ae0000...
Scanning region f6bd0000...
Scanning region f6cc0000...
Scanning region f6db0000...
Scanning region f6ea0000...
Scanning region f6f90000...
Scanning region f7080000...
Scanning region f7170000...
Scanning region f7260000...
Scanning region f7350000...
Scanning region f7440000...
Scanning region f7530000...
Scanning region f7620000...
Scanning region f7710000...
Scanning region f7800000...
Scanning region f78f0000...
Scanning region f79e0000...
Scanning region f7ad0000...
Scanning region f7bc0000...
Scanning region f7cb0000...
Scanning region f7da0000...
Scanning region f7e90000...
Scanning region f7f80000...
Scanning region f8070000...
Scanning region f8160000...
Scanning region f8250000...
Scanning region f8340000...
Scanning region f8430000...
Scanning region f8520000...
Scanning region f8610000...
Scanning region f8700000...
Scanning region f87f0000...
Scanning region f88e0000...
Scanning region f89d0000...
Scanning region f8ac0000...
Scanning region f8bb0000...
Scanning region f8ca0000...
Scanning region f8d90000...
Scanning region f8e80000...
Scanning region f8f70000...
Scanning region f9060000...
Scanning region f9150000...
Scanning region f9240000...
Scanning region f9330000...
Scanning region f9420000...
Scanning region f9510000...
Scanning region f9600000...
Scanning region f96f0000...
Scanning region f97e0000...
Scanning region f98d0000...
Scanning region f99c0000...
Scanning region f9ab0000...
Scanning region f9ba0000...
Scanning region f9c90000...
Scanning region f9d80000...
Scanning region f9e70000...
Scanning region f9f60000...
Scanning region fa050000...
Scanning region fa140000...
Scanning region fa230000...
Scanning region fa320000...
Scanning region fa410000...
Scanning region fa500000...
Scanning region fa5f0000...
Scanning region fa6e0000...
Scanning region fa7d0000...
Scanning region fa8c0000...
Scanning region fa9b0000...
Scanning region faaa0000...
Scanning region fab90000...
Scanning region fac80000...
Scanning region fad70000...
Scanning region fae60000...
Scanning region faf50000...
Scanning region fb040000...
Scanning region fb130000...
Scanning region fb220000...
Scanning region fb310000...
Scanning region fb400000...
Scanning region fb4f0000...
Scanning region fb5e0000...
Scanning region fb6d0000...
Scanning region fb7c0000...
Scanning region fb8b0000...
Scanning region fb9a0000...
Scanning region fba90000...
Scanning region fbb80000...
Potential exploit area found at address fbb80000:1000.
Exploiting device...

C:\Downgrade>adb shell /data/local/tmp/misc_version -s 1.32.405.8
--set_version set. VERSION will be changed to: 1.32.405.8
Patching and backing up partition 17...

C:\Downgrade>adb reboot bootloader
 
reimur said:
pd98140
Sorry that it took so long. Those covers are a pain in the ass to get off sometimes.
Click to expand...

your device id is the same as mine.
The gold card is finiky sometimes, remake it, and then move the pd98img to it.

download the htc ace toolkit from the dcom thread, and then run the first shortcut (essentially i've automated it with a script)

if the goldcard is made properly, rather than a device id error, you should get "would you like to update, press vol up"
 
reimur said:
I'm getting a Model ID error when I'm in the bootloader. After it's done installing and checking the PD98IMG file on the root of the SD card, it tells me that I have an incorrect Model ID and asks me to reboot the phone. Is this a gold card issue? I followed the gold card tutorials very carefully and I didn't think that I messed up, but I might have. Could it be an incorrect PD98IMG file?
Click to expand...

reimur said:
pd98140
Sorry that it took so long. Those covers are a pain in the ass to get off sometimes.
Click to expand...

Check your SDCard for a .bat file. If it isn't there, that may be your problem. It's a long shot but you'd be surprised how many people deleted the .bat file because they thought it was nothing lol
 
JSLEnterprises said:
your device id is the same as mine.
The gold card is finiky sometimes, remake it, and then move the pd98img to it.

download the htc ace toolkit from the dcom thread, and then run the first shortcut (essentially i've automated it with a script)

if the goldcard is made properly, rather than a device id error, you should get "would you like to update, press vol up"
Click to expand...
Ya, it was a gold card issue; that's what I had figured. I ended up reversing the number incorrectly. I used some reversing tool this time that made it look completely different than what I had, and continued from there. Thanks.
 
You must log in or register to reply here.
Back
Top Bottom