• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root root,s-off,simunlock,superCID htc merge

I got it working just fine just restarted fastboot, but I haves new problem with ROM I downloadedb for gingerbread usc Google play won't auto update from market.
 
tmaleshafske said:
I got it working just fine just restarted fastboot, but I haves new problem with ROM I downloadedb for gingerbread usc Google play won't auto update from market.
Click to expand...

i uploaded the play store .apk from my rezound. you can try deleting the normal vending.apk and installing it in system/app:
Phonesky.apk

or you might try running the official usc ruu. you can find it here:
http://www.htc.com/us/support/htc-merge-uscellular/software-updates

assuming you completed the process,youll stay s-off,and all youll have to do following running the ruu is re-install recovery,re-flash root files.
 
Apk isn't working say it can't parse the file.

What did work. Downloaded and re-installed the Stock ROM,
wait for play to update. Do a carrier update just to make sure for usc it *228
Finally re-flash the custom recovery and then install the zip for superuser
 
How were you trying to install it? :eek: .apks are simply transfered and installed with a root file manager like root explorer.

Glad reinstalling the stock Rom worked for ya :cool:
 
hey, i have been working on this for hours. First off when i try to 'push' something to my merge it all looks good besides

Code: 
C:\ANDROID\MINIADB>adb devices
List of devices attached
HT17VM801908    device


C:\ANDROID\MINIADB>adb push zergRush /data/local/
288 KB/s (0 bytes in 23060.000s)

C:\ANDROID\MINIADB>adb shell
$ chmod 755 /data/local/zergRush
chmod 755 /data/local/zergRush
$ /data/local/zergRush
/data/local/zergRush

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The A

[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[*] Sending 189 zerglings ...
[-] Hellions with BLUE flames !
$

I cannot push anything to it... it is on Charge Only with USB debugging enabled. I also tried fre3vo instead of Zerg rush.
 
im not sure what you mean you "cant push anything into it"

you are are apparently on a new enuff gingerbread build that zergrush is failing because the exploit has been patched(hellions with blue flames means zergrush didnt get temp root). what errors are you recieving with fre3vo?

you could try taco root for temp root,it will prolly work,but as exploits go,its slightly more of a PITA.

you could also htcdev unlock to get root access to downgrade. :)
 
heres how fre3vo should work:

download DHD Downgrade folder

-open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the miniadb_merge folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)

-in your command window: change to the miniadb_merge directory by typing:
cd c:\miniadb_merge (your promt should change to c:\miniadb_merge>)
*note that in the next few steps,anything in bold type is an adb command. you can directly copy from this window,and paste into your command window to eliminate typos.

-enable usb debugging,plug in your phone via usb. select "charge only" mode.

-make sure adb is seeing your phone:
adb devices (should return your serial number)

- enter the commands from your link,one at a time,hit enter after each:

adb push fre3vo /data/local/tmp

adb shell chmod 777 /data/local/tmp/fre3vo

adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF

-make sure it worked. when you see "exploiting device" then your command prompt again:
adb shell (if your prompt changes to a # youre good to go)

heres what the above will look like in your cmd window:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\tbolt2[/COLOR]

c:\tbolt2>[COLOR="Red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HTxxxxxx    device


c:\tbolt2>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR]
956 KB/s (9796 bytes in 0.010s)

c:\tbolt2>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR]

c:\tbolt2>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF[/COLOR]
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
  id: msmfb
  smem_start: 802160640
  smem_len: 3145728
  type: 0
  type_aux: 0
  visual: 2
  xpanstep: 0
  ypanstep: 1
  line_length: 1920
  mmio_start: 0
  accel: 0
fb_var_screeninfo:
  xres: 480
  yres: 800
  xres_virtual: 480
  yres_virtual: 1600
  xoffset: 0
  yoffset: 0
  bits_per_pixel: 32
  activate: 16
  height: 94
  width: 56
  rotate: 0
  grayscale: 0
  nonstd: 0
  accel_flags: 0
  pixclock: 0
  left_margin: 0
  right_margin: 0
  upper_margin: 0
  lower_margin: 0
  hsync_len: 0
  vsync_len: 0
  sync: 0
  vmode: 0
Buffer offset:      00000000
Buffer size:        8192
Scanning region f0000000...
Scanning region f00f0000...
Scanning region f01e0000...
Scanning region f02d0000...
Scanning region f03c0000...
Scanning region f04b0000...
Scanning region f05a0000...
Scanning region f0690000...
Scanning region f0780000...
Scanning region f0870000...
Scanning region f0960000...
Scanning region f0a50000...
Scanning region f0b40000...
Scanning region f0c30000...
Scanning region f0d20000...
Scanning region f0e10000...
Scanning region f0f00000...
Scanning region f0ff0000...
Scanning region f10e0000...
Scanning region f11d0000...
Scanning region f12c0000...
Scanning region f13b0000...
Scanning region f14a0000...
Scanning region f1590000...
Scanning region f1680000...
Scanning region f1770000...
Scanning region f1860000...
Scanning region f1950000...
Scanning region f1a40000...
Scanning region f1b30000...
Scanning region f1c20000...
Scanning region f1d10000...
Scanning region f1e00000...
Scanning region f1ef0000...
Scanning region f1fe0000...
Scanning region f20d0000...
Scanning region f21c0000...
Scanning region f22b0000...
Scanning region f23a0000...
Scanning region f2490000...
Scanning region f2580000...
Scanning region f2670000...
Scanning region f2760000...
Scanning region f2850000...
Scanning region f2940000...
Scanning region f2a30000...
Scanning region f2b20000...
Scanning region f2c10000...
Scanning region f2d00000...
Scanning region f2df0000...
Scanning region f2ee0000...
Scanning region f2fd0000...
Scanning region f30c0000...
Scanning region f31b0000...
Scanning region f32a0000...
Scanning region f3390000...
Scanning region f3480000...
Scanning region f3570000...
Scanning region f3660000...
Scanning region f3750000...
Scanning region f3840000...
Scanning region f3930000...
Scanning region f3a20000...
Scanning region f3b10000...
Scanning region f3c00000...
Scanning region f3cf0000...
Scanning region f3de0000...
Scanning region f3ed0000...
Scanning region f3fc0000...
Scanning region f40b0000...
Scanning region f41a0000...
Scanning region f4290000...
Scanning region f4380000...
Scanning region f4470000...
Scanning region f4560000...
Scanning region f4650000...
Scanning region f4740000...
Scanning region f4830000...
Scanning region f4920000...
Scanning region f4a10000...
Scanning region f4b00000...
Scanning region f4bf0000...
Scanning region f4ce0000...
Scanning region f4dd0000...
Scanning region f4ec0000...
Scanning region f4fb0000...
Scanning region f50a0000...
Scanning region f5190000...
Scanning region f5280000...
Scanning region f5370000...
Scanning region f5460000...
Scanning region f5550000...
Scanning region f5640000...
Scanning region f5730000...
Scanning region f5820000...
Scanning region f5910000...
Scanning region f5a00000...
Scanning region f5af0000...
Scanning region f5be0000...
Scanning region f5cd0000...
Scanning region f5dc0000...
Scanning region f5eb0000...
Scanning region f5fa0000...
Scanning region f6090000...
Scanning region f6180000...
Scanning region f6270000...
Scanning region f6360000...
Scanning region f6450000...
Scanning region f6540000...
Scanning region f6630000...
Scanning region f6720000...
Scanning region f6810000...
Scanning region f6900000...
Scanning region f69f0000...
Scanning region f6ae0000...
Scanning region f6bd0000...
Scanning region f6cc0000...
Scanning region f6db0000...
Scanning region f6ea0000...
Scanning region f6f90000...
Scanning region f7080000...
Scanning region f7170000...
Scanning region f7260000...
Scanning region f7350000...
Scanning region f7440000...
Scanning region f7530000...
Scanning region f7620000...
Scanning region f7710000...
Scanning region f7800000...
Scanning region f78f0000...
Scanning region f79e0000...
Scanning region f7ad0000...
Scanning region f7bc0000...
Scanning region f7cb0000...
Scanning region f7da0000...
Scanning region f7e90000...
Scanning region f7f80000...
Scanning region f8070000...
Scanning region f8160000...
Scanning region f8250000...
Scanning region f8340000...
Scanning region f8430000...
Scanning region f8520000...
Scanning region f8610000...
Scanning region f8700000...
Scanning region f87f0000...
Scanning region f88e0000...
Scanning region f89d0000...
Scanning region f8ac0000...
Scanning region f8bb0000...
Scanning region f8ca0000...
Scanning region f8d90000...
Scanning region f8e80000...
Scanning region f8f70000...
Scanning region f9060000...
Scanning region f9150000...
Scanning region f9240000...
Scanning region f9330000...
Scanning region f9420000...
Scanning region f9510000...
Scanning region f9600000...
Scanning region f96f0000...
Scanning region f97e0000...
Scanning region f98d0000...
Scanning region f99c0000...
Scanning region f9ab0000...
Scanning region f9ba0000...
Scanning region f9c90000...
Scanning region f9d80000...
Scanning region f9e70000...
Scanning region f9f60000...
Potential exploit area found at address f9fd6200:e00.
Exploiting device...

c:\tbolt2>[COLOR="red"]adb shell[/COLOR]
# [COLOR="Blue"]<-indicates that you have temp root access[/COLOR]

(ignore tbolt2,these are actually my thunderbolt directions ;))

if you get your "#" prompt,indicating temp root,type exit to get back to your miniadb_merge> prompt,and pickup the directions in the first post at:
adb push busybox /data/local

basically,youre just eliminating those first few lines that pertain to zergrush. once youve successfully downgraded,you can follow the directions exactly,as youre on older firmware where the exploits will work for sure.

hope that helps :)
 
I would like to join the droves of those thanking you Mr. Scotty. Your most excellent guide has gotten me introduced to the world of phone modding. I'm just getting started, i have a merge I'm attempting to get to work on my AT&T account. It was a USC branded phone, but with your help, i just got the downgrade up and should have s-off, root, superCID, and simunlock soon. Thank you again. :) :thumb:
 
Scotty, your one helpful dude. Thank you so much for all the help you've given in this thread. I wouldn't have gotten as far as I have with my merge if it had not been for your help here.

I think I'm pretty much there except that my t-mobile sim is not being recognized. My sim card works in my g1 just fine but my merge does not recognize it at all. I get "sim card not found, please insert sim" when I go into the GSM options. I guess my questions is: Is this what it will say if the phone is not sim unlocked or is it a problem with the sim/hardware? This sim works fine in my g1 so I'm a bit confused.

This was a usc phone when I started. Now it has the usc 2.04.573.2 on it. I followed your steps exactly and didn't encounter any issues but now I'm stuck on getting the sim to work. I flashed the radio to 1.06.00.0910 which, from my understanding is needed to allow a US sim card to work. Any suggestions on where to go from here?

Again, thank you so much for the huge drop of knowledge on this thread :-)
 
phishinphree said:
Scotty, your one helpful dude. Thank you so much for all the help you've given in this thread. I wouldn't have gotten as far as I have with my merge if it had not been for your help here.

I think I'm pretty much there except that my t-mobile sim is not being recognized. My sim card works in my g1 just fine but my merge does not recognize it at all. I get "sim card not found, please insert sim" when I go into the GSM options. I guess my questions is: Is this what it will say if the phone is not sim unlocked or is it a problem with the sim/hardware? This sim works fine in my g1 so I'm a bit confused.

This was a usc phone when I started. Now it has the usc 2.04.573.2 on it. I followed your steps exactly and didn't encounter any issues but now I'm stuck on getting the sim to work. I flashed the radio to 1.06.00.0910 which, from my understanding is needed to allow a US sim card to work. Any suggestions on where to go from here?

Again, thank you so much for the huge drop of knowledge on this thread :-)
Click to expand...
thanks for your nice words. unfortunately,i do not have any idea how you should procede. i had a usc merge that i could not get to work with a sim,either. another user on the thread had a vzw merge and had the same issues. in both cases,the sim card was recognized with the chinese test rom,but it bricked his device,so i wont recomend trying that.

my current merge takes a t mobile sim with no prollem,no matter what rom or radio its on. if you rread back a few pages youll see all the stuff we tried... we never did figure out exactly why it wasnt working.

out of curiosity,what is the top line of your hboot information? should be lexikion xx ship s-off what is xx on your phone?
 
I was worried that would be the case. Here's all the hboot info. I flashed it back to stock, not sure if that changed the XB part as I paid more attention to the version numbers. From what I've read here and elsewhere, its the radio that stops the sim from working. Some said a verizon radio would allow the sim to work but most of the links on another thread I found were dead so I couldn't get far.

LEXIKON XB SHIP S-OFF
HBOOT-0.99.0000
RADIO-1.08.00.0804
eMMC-boot
Dec 2 2010, 16:07:41
 
phishinphree said:
I was worried that would be the case. Here's all the hboot info. I flashed it back to stock, not sure if that changed the XB part as I paid more attention to the version numbers. From what I've read here and elsewhere, its the radio that stops the sim from working. Some said a verizon radio would allow the sim to work but most of the links on another thread I found were dead so I couldn't get far.

LEXIKON XB SHIP S-OFF
HBOOT-0.99.0000
RADIO-1.08.00.0804
eMMC-boot
Dec 2 2010, 16:07:41
Click to expand...

when i had the same issue,i tried every available radio and ruu. the test rom worked just fine,but as i mentioned the last user that tried that was left with a dead device,so there is obviuosly some thigns we do not understand about it.

it may be something do do with xb vs xc. mine with the working sim is an xc. we will have to do some more research on that.
 
Right on. It was free to me so I'm not too worried about bricking it. Its been since I rooted my g1 since I've been back into this stuff so forgive me if its a stupid question but can flash to xc or is that something that cannot be changed?

Also assuming I get the test rom on this device without bricking it, is it a viable rom to stick with or is it just a test that wouldn't connect to towers or whatever?
 
phishinphree said:
Right on. It was free to me so I'm not too worried about bricking it. Its been since I rooted my g1 since I've been back into this stuff so forgive me if its a stupid question but can flash to xc or is that something that cannot be changed?

Also assuming I get the test rom on this device without bricking it, is it a viable rom to stick with or is it just a test that wouldn't connect to towers or whatever?
Click to expand...

im not really sure what the xb/xc refer to :eek: it is indicative of some type of hardware,it does not change no matter what hboot you run.

the test rom is not something youd want to run for any length of time. it is chinese,and has assorted china-specific apps and such,and no market. it also has a huge "htc confidential" watermark that you cant get rid of.

i flashed it,then flashed a different ruu with no issue. the other user flashed it,flashed an ruu,and then when the phone went to reboot,it just turned off and wouldnt power back on. i believe i followed it with anotehr signed ruu,an actual .exe file,so maybe this was a factor. the other user flashed one of my unsigned "custom ruus".

i had cautioned him about it,after having bricked a second merge that i had. i wsa trying to install a recovery,so i could install superuser,so i could try and install the market. recovery for some reason would not take,so i tried to flash a different hboot. i typed "fastboot reboot-bootloader aFTER THE flash,and it made a short buzz,and turned off. :mad:

so i would strongly recomend agains messing with the chinese test rom,as there are too many unknown factors to predict wether it would end badly or not. if you choose to give it a shot,i would recomend following it with a signed .exe file,but that may not be enuff.
 
Dam thanks got it working on uscc 3 days on trying to make a gold card got after finding your post on to put the sdcard in the computer ;) lmao

Now iv been looking for an ics urr rom but every one that iv downloaded for other phones are not working any help on this your the htc merge god!!!! :D


Htc merge uscc runnin ICS Hell Yeah
 
scotty85, I got given a USC Merge that had software issues. Turns out the board was bad. Bought Merge cheap off ebay with clean ESN, cracked screen, owner claimed it was USC branded. Took the board out of that one, put it in the one with the bad board, voila! Everything worked. Until I tried to activate it. Turns out, it has Sprint OS installed and Sprint RUU's.
If I follow these steps, do you think after goldcard/downgrade/push USC ruu that I can change this phone from Sprint to USC? Not sure what steps to follow, tried to make a goldcard once but didn't seem to work. The carriers here are CDMA and do not use removable sim cards.
 
Build #:3.20.557.2 710RD

LEXIKON PVT SHIP S-ON
HBOOT-0.89.0000
RADIO -1.08.00.0524_3
eMMC-boot
Dec 21, 2011, 05:29:44

I'm guessing build # is what is showing up in Settings>About Phone>Software Information>Software number.
 
well,you are not on a sprint OS. your build number is from nTelos,bluegrass wireless,or possibly some other small carrier using sprint or vzw towers. your hboot screen displays the merge codename "lexikon" and the correct merge hboot version.

to answer your original question,rooting the phone via this guide or any method will not let you use it on a cdma network that it was not intended to. while the sim slot will be unlocked,there have been issues even using the merge on different gsm networks.

cdma carriers tend to be picky about the devices they allow on their network,so your question can really only be answered by USC. cdma flashing and cloning is potentially illegal and/or fradulent,and not something we are permited to discuss here.

using the guide will turn off the radio secure flag,unlock the sim slot,and give the phone superCID wich will allow you to flash other carriers RUUs,install a custom recovery,and give you the ability to modify system files that you normally will not have access to. if you wish to root,we will be happy to help you :)
 
Oh, ok. Thanks for the info. I think I'll just look for another phone, I have to use US cellular because that's what my job provides, and this phone is worthless to me right now.
 
jasonofx said:
Oh, ok. Thanks for the info. I think I'll just look for another phone, I have to use US cellular because that's what my job provides, and this phone is worthless to me right now.
Click to expand...

have you spoken to us cellular? if not it would be worth a 5 minute phone call to find a definate answer.

if you cannot use it,at least you have made yourself a working,useable,sellable phone :) hopefully you can sell it quickly and pick up one you can use.

i had the same prollem with vzw,and ended up doing the same thing(selling the all tell merge and picking up a vzw model)
 
scotty85 said:
have you spoken to us cellular? if not it would be worth a 5 minute phone call to find a definate answer.

if you cannot use it,at least you have made yourself a working,useable,sellable phone :) hopefully you can sell it quickly and pick up one you can use.

i had the same prollem with vzw,and ended up doing the same thing(selling the all tell merge and picking up a vzw model)
Click to expand...

Yes, actually, I took it in to try to activate it, and their techs are the ones who discovered that it could not be activated on their network because it was from another provider. I just googled the prl and thought because of that it was a Sprint phone. I got this phone for $40, so I really want to find another one, US Cellular, on the cheap with a clean ESN and just swap the board. But also, I am eligible for an upgrade, and the rep at the store told me that the GS3 is $199, and will probably drop to $149 over the holidays, so I'm keeping that in mind, too. The Electrify 2 may drop to $99.
 
scotty85 said:
well,you are not on a sprint OS. your build number is from nTelos,bluegrass wireless,or possibly some other small carrier using sprint or vzw towers. your hboot screen displays the merge codename "lexikon" and the correct merge hboot version.

to answer your original question,rooting the phone via this guide or any method will not let you use it on a cdma network that it was not intended to. while the sim slot will be unlocked,there have been issues even using the merge on different gsm networks.

cdma carriers tend to be picky about the devices they allow on their network,so your question can really only be answered by USC. cdma flashing and cloning is potentially illegal and/or fradulent,and not something we are permited to discuss here.

using the guide will turn off the radio secure flag,unlock the sim slot,and give the phone superCID wich will allow you to flash other carriers RUUs,install a custom recovery,and give you the ability to modify system files that you normally will not have access to. if you wish to root,we will be happy to help you :)
Click to expand...

Anyway I can find out exactly which carrier it is so I can sell it? I don't wanna go through any hub-bub on eBay with it, so I want to confidently advertise it correctly to avoid that.
On another note, I was able to pick up the Motorola Electrify M on the day it came out for only $99!!!!!!!! Pimp-ass phone, everbody check it out. I like that it has a large screen and smaller form factor than the GS3.
 
You must log in or register to reply here.
Back
Top Bottom