Root root,s-off,simunlock,superCID htc merge

[scotty85]

I have tried to do this following the guide and have realized that no matter what I do I can't get my phone to go into s-off. Would this be bacause I am running 2.3.4 already? I can't find a way to root this phone either. I have tried to follow the guide that was posted but haven't had any luck at all. Does anyone know who to get the phone into s-off by any other way? I would love to be able to use this phone on AT&T.


I can get the program to run and it says that I am now s-off but when I check I am still showing s-on. Any help with this would be greatly appreciated. This really has me pulling out my hair.

Thanks

if you are wanting to use tofast's tool,id ask him questions about the prollems you are having,as its his tool and he knows how it works and what scripts he is using.

i do know the guide here works just fine,as b rich and several others who have posted here have utilized it. its not a 1 click,but if you want to try it i will be happy to help you.

as for getting the phone working on GSM,from what i gather from the forum you linked,you just need to use a particular verizon radio(what he is calling a "modem"),as the other radios are interefering with GSM useage,somehow. once you are s-off,you will flash the reccomended radio(vzw 1.06.00.0910) in hboot like you do the the downgrade/upgrade RUUs in the guide here by renaming PD42IMG and booting into hboot.

 

[ElectricSquid]

OK Scotty, I'm s-off/SIM unlocked/rooted. So now what do I have to do to rid this HTC Merge of it's annoying Verizon stock apps? In fact, I'd be more than happy to rid it of ALL things Verizon as long as it'll still able to make/receive calls and texts through their network, and connect through their 3G.

Basically, how do I unbrand it?

 

[KcLive]

The problem I am having is no matter what I can't get the s-off. I think it might be my gold card. I have followed a few guides on how to do this and I still am not sure I am doing it right. I guess once I get that figured out I should be headed in the right direction.

 

[KcLive]

I have tried using this guide as well. If you would be as kind to offer any help with getting the phone s-off and rooted it would be very much appreciated. The only thing I can think of is maybe I am making the gold card wrong or something.

thank you

 

[scotty85]

OK Scotty, I'm s-off/SIM unlocked/rooted. So now what do I have to do to rid this HTC Merge of it's annoying Verizon stock apps? In fact, I'd be more than happy to rid it of ALL things Verizon as long as it'll still able to make/receive calls and texts through their network, and connect through their 3G.

Basically, how do I unbrand it?

there are a couple different ways. you can delete/freeze apps with titanium backup that you dont want,or you can just use one of the other RUUs. the usc GB RUU doent have much usc specific stuff on it,its what i use on my VZW merge. you could also use the bluegrass rom,there wasnt much branded stuff there,either. you could also flash 2fast's rom(linked in the next post in the forum),its based on the usc GB.

The problem I am having is no matter what I can't get the s-off. I think it might be my gold card. I have followed a few guides on how to do this and I still am not sure I am doing it right. I guess once I get that figured out I should be headed in the right direction.

have you tried the guide here? if,not,lets start with that. if you have,be more specific about what you did,and what the results were. there are ALOT of different things in the process that could have prevented you from getting s-off

what carrier are you using? if its not vzw,then the gold card IS and important part of the process,as you need to downgrade to exploitable vzw firmware,and you cant do it without using the gold card.

if you happen to have vzw,then the gold card isnt needed.

just make sure that you have a carrier RUU for whomever you have. if not,you will need to backup your stock system,recovery and boot images before flashing the downgrade firmware

 

[scotty85]

I got as far as the /data/local/zergRush and got this error:

[-] Cannot copy boomsh. : Permission denied.

adb push zergRush /data/local/
adb shell this will change your promt to a $
chmod 755 /data/local/zergRush
/data/local/zergRush


Any ideas?

Thanks

that error comes from running zergrush twice.

also,keep in mind that it will be much more difficult for me to help you if you keep jumping around to different forums.

id suggest you take some time,and very carefully read thru the first post directions and thru the rest of the thread,as your xda question was answered here on the first page. http://androidforums.com/merge-all-...simunlock-supercid-htc-merge.html#post3522248

 

[KcLive]

Here is a copy from the merge one click tool that I was using:

Make sure usb debugging is enabled and your goldcard is created...
Before going forward...
If it is there please continue...
Press any key to continue . . .
--- WAITING FOR DEVICE ---
adb server is out of date. killing...
* daemon started successfully *
--- Device Connected ---
Checking for previous attempts...
adb server is out of date. killing...
* daemon started successfully *
rm failed for *, No such file or directory
adb server is out of date. killing...
* daemon started successfully *
rm failed for /sdcard/PD42IMG.zip, No such file or directory
Pushing Downgrade Image to Sdcard...
Allow 3-5mins to do it's thing...
adb server is out of date. killing...
* daemon started successfully *
protocol failure
Pushing Misc Image to Sdcard...
* daemon not running. starting it now *
* daemon started successfully *
1260 KB/s (262144 bytes in 0.203s)
Pushing Zergrush...
480 KB/s (23060 bytes in 0.046s)
Setting Permissions...
Gaining Perm Root (Aka running zergrush)...

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000161e0
[*] Sending 149 zerglings ...
--- WAITING FOR DEVICE ---
* daemon not running. starting it now *
* daemon started successfully *
--- Device Connected ---
Pushing Busybox
adb server is out of date. killing...
* daemon started successfully *
Setting Permissions...
* daemon not running. starting it now *
* daemon started successfully *
error: device offline
Remounting System...
error: device offline
Coping Busybox to /system/xbin/...
error: device offline
Installing Busybox...
error: device offline
error: device offline
error: device offline
error: device offline
Backing up system...
Allow 3-5mins to do it's thing...
error: device offline
Backing up misc partition...
error: device offline
Flashing misc partition...
error: device offline
error: device offline
*********************REBOOTING TO HBOOT**************************
error: device offline
Press Volume up to start the update.
It may reboot but start loading again, this is fine.
When at the prompt press power to reboot.
After pressing power, the phone will boot.
Skip through the setup screen, then when at homescreen.
Press any key to continue . . .
--- WAITING FOR DEVICE ---
adb server is out of date. killing...
* daemon started successfully *
--- Device Connected ---
Checking for previous attempts...
adb server is out of date. killing...
* daemon started successfully *
Pushing Zergrush...
1441 KB/s (23060 bytes in 0.015s)
Pushing Gfree...
1200 KB/s (134401 bytes in 0.109s)
Pushing Psneuter...
1464 KB/s (679475 bytes in 0.453s)
Setting Permissions...
Gaining Perm Root (Aka running zergrush)...

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000161e0
[*] Sending 149 zerglings ...
--- WAITING FOR DEVICE ---
* daemon not running. starting it now *
* daemon started successfully *
--- Device Connected ---
Gaining S-off...
adb server is out of date. killing...
* daemon started successfully *
Build: 25
Section header entry size: 40
Number of section headers: 45
Total section header table size: 1800
Section header file offset: 0x00014e90 (85648)
Section index for section name string table: 42
String table offset: 0x00014cc7 (85191)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000f80 (3968)
-- size: 0x000000c4 (196)
Kernel release: 2.6.35.10-gd699855
New .modinfo section size: 204
Loading module... Failed.
Module returned an unknown code (Operation not permitted).
adb server is out of date. killing...
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.35.10-gd699855
New .modinfo section size: 204
Attempting to power cycle eMMC... Failed.
Module failed to load: Operation not permitted
Removing Downgrade Image...
adb server is out of date. killing...
* daemon started successfully *
rm failed for /sdcard/PD42IMG.zip, No such file or directory
Press any key to continue . . .

I don't know if that will be of any help or not, I do have a feeling it is my gold card that is causing the issue though. I am using US Cellular for a carrier, and have pretty much gotten the same results from following this guide as I did the merge one click tool.

 

[scotty85]

Here is a copy from the merge one click tool that I was using:

Make sure usb debugging is enabled and your goldcard is created...
Before going forward...
If it is there please continue...
Press any key to continue . . .
--- WAITING FOR DEVICE ---
adb server is out of date. killing...
* daemon started successfully *
--- Device Connected ---
Checking for previous attempts...
adb server is out of date. killing...
* daemon started successfully *
rm failed for *, No such file or directory
adb server is out of date. killing...
* daemon started successfully *
rm failed for /sdcard/PD42IMG.zip, No such file or directory
Pushing Downgrade Image to Sdcard...
Allow 3-5mins to do it's thing...
adb server is out of date. killing...
* daemon started successfully *
protocol failure
Pushing Misc Image to Sdcard...
* daemon not running. starting it now *
* daemon started successfully *
1260 KB/s (262144 bytes in 0.203s)
Pushing Zergrush...
480 KB/s (23060 bytes in 0.046s)
Setting Permissions...
Gaining Perm Root (Aka running zergrush)...

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000161e0
[*] Sending 149 zerglings ... did zergrush finish and tell you it had worked?
--- WAITING FOR DEVICE ---
* daemon not running. starting it now *
* daemon started successfully *
--- Device Connected ---
Pushing Busybox
adb server is out of date. killing...
* daemon started successfully *
Setting Permissions...
* daemon not running. starting it now *
* daemon started successfully *
error: device offline <- nothing from here down worked
Remounting System...
error: device offline<-
Coping Busybox to /system/xbin/...
error: device offline
Installing Busybox...
error: device offline<-
error: device offline<-
error: device offline<-
error: device offline<-
Backing up system...
Allow 3-5mins to do it's thing...
error: device offline<-
Backing up misc partition...
error: device offline<-
Flashing misc partition...
error: device offline<-
error: device offline<-
*********************REBOOTING TO HBOOT**************************
error: device offline
Press Volume up to start the update.
It may reboot but start loading again, this is fine.
When at the prompt press power to reboot.
After pressing power, the phone will boot.
Skip through the setup screen, then when at homescreen.
Press any key to continue . . .
--- WAITING FOR DEVICE ---
adb server is out of date. killing...
* daemon started successfully *
--- Device Connected ---
Checking for previous attempts...
adb server is out of date. killing...
* daemon started successfully *
Pushing Zergrush...
1441 KB/s (23060 bytes in 0.015s)
Pushing Gfree...
1200 KB/s (134401 bytes in 0.109s)
Pushing Psneuter...
1464 KB/s (679475 bytes in 0.453s)
Setting Permissions...
Gaining Perm Root (Aka running zergrush)...

[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00000118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[+] Overseer found a path ! 0x000161e0
[*] Sending 149 zerglings ...
--- WAITING FOR DEVICE ---
* daemon not running. starting it now *
* daemon started successfully *
--- Device Connected ---
Gaining S-off...
adb server is out of date. killing...
* daemon started successfully *
Build: 25
Section header entry size: 40
Number of section headers: 45
Total section header table size: 1800
Section header file offset: 0x00014e90 (85648)
Section index for section name string table: 42
String table offset: 0x00014cc7 (85191)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000f80 (3968)
-- size: 0x000000c4 (196)
Kernel release: 2.6.35.10-gd699855
New .modinfo section size: 204
Loading module... Failed.
Module returned an unknown code (Operation not permitted).
adb server is out of date. killing...
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.35.10-gd699855
New .modinfo section size: 204
Attempting to power cycle eMMC... Failed.
Module failed to load: Operation not permitted
Removing Downgrade Image...
adb server is out of date. killing...
* daemon started successfully *
rm failed for /sdcard/PD42IMG.zip, No such file or directory
Press any key to continue . . .

I don't know if that will be of any help or not, I do have a feeling it is my gold card that is causing the issue though. I am using US Cellular for a carrier, and have pretty much gotten the same results from following this guide as I did the merge one click tool.

your problem started early on. thats not to say that your gold card isnt made incorrectly on top of it,but i can tell from this output that your misc image was never re-written,so we dont know for sure if it was or not since your current firmware wont allow the downgrade without the misc image being rewritten successfully.

everything after that failed because you were not on the downgrade firmware.

i would suggest you carefully read the first post. download everything and organize it so you can find it. read thru the rest of the thread so that have an idea what issues might arise.

then carefully try the guide. make sure each adb command you copy/paste gets the same output as the code boxes i posted in the first page.

again,i am not sure why 2fasts tool is failing,but i have no doubt that you can root and s-off your merge with this guide.

 

[jtowndawg]

HTC has now made it possible to unlock the bootloader through them. I am new to this and have been trying to get the nerve to go through with your guide. Thank you for the work you have done. My question is would it be easier now to use the HTC unlocker then start at some point in your guide? Or would it be best to just skip their method all together?

 

[scotty85]

you could prolly use the HTCdev unlock to root,then flash a recovery,then root and downgrade, or simply root and stay s-on.

there are,IMO,some very worthwhile reasons to become s-off,and the procedure is well worth doing,especially since being superCIDed and simunlocked is also a result.

if you intend to downgrade and s-off,there is no benefit to using htcdev,especially if you have a phone with warranty on it. htcdev unlock does "void all or parts of your warranty",so id pretty strongly avoid that if i still had manufacture warranty.

if you have a used phone,there are a couple advantages for advanced users to upgrade to the htcdev hboot and unlock it after achieving s-off.i i did the htc unlock on my merge for S&Gs,but my phone is used so i had nothing to lose

hope that answers your question

the important thing about the guide is that if you dont see an ruu listed for your carrier,you will need to back up your system,boot,and recovery as described above and upload them for me,as well as letting me know your baseband and hboot numbers. not all carrier RUUs are availble to us,so failing to back up one thats not listed will make it impossible for you to return to stock

 

[jtowndawg]

you could prolly use the HTCdev unlock to root,then flash a recovery,then root and downgrade, or simply root and stay s-on.

there are,IMO,some very worthwhile reasons to become s-off,and the procedure is well worth doing,especially since being superCIDed and simunlocked is also a result.

if you intend to downgrade and s-off,there is no benefit to using htcdev,especially if you have a phone with warranty on it. htcdev unlock does "void all or parts of your warranty",so id pretty strongly avoid that if i still had manufacture warranty.

if you have a used phone,there are a couple advantages for advanced users to upgrade to the htcdev hboot and unlock it after achieving s-off.i i did the htc unlock on my merge for S&Gs,but my phone is used so i had nothing to lose

hope that answers your question




the important thing about the guide is that if you dont see an ruu listed for your carrier,you will need to back up your system,boot,and recovery as described above and upload them for me,as well as letting me know your baseband and hboot numbers. not all carrier RUUs are availble to us,so failing to back up one thats not listed will make it impossible for you to return to stock

Thank you for the quick response. One more question. My friend that is a district manager at Alltel (that is my carrier) tells me that they are about to push ginger bread ota or i could got the Alltel store and they could install it now. Should I wait for this first?

 

[scotty85]

I personally would not wait. You never know when updates are going to break exploits,so I would downgrade,s-off,then run the ruu for your current alltel firmware.

You can then accept the ota,or have the store install gingerbread without fear of not being able to root.

Once you've used this guide,you are radio s-offed,which will remain after the update. You can flash a recovery in hboot, then flash super user in recovery to root the update

 

[richardawood]

it should work just fine. after backing up your misc image in step 5(before exit and adb reboot bootloader make sure you perform the steps in post 52 to also back up your system,boot,and recovery images.

i can describe how to make up an ruu for yourself,or you can upload the images,tell me the links,and i can make it for you. if you read some of the posts above,youll see its fairly important to do this,since likely there is not a current RUU for that carrier.

you will also need to let me know what your hboot version is(in your hboot screen) as well as your baseband(in settings/about phone)

but this process will not change ESNs,MEIDs,or MINs,or anything else that identified your phone to a particular carrier.

if you want to wait a couple days,ill try and get a guide for folks with no RUUs put up in the 2nd post.

Hey Scotty thx again for helping us all with this. Did you ever create the ruu for ntelos network? I have an ntelos merge as well and I am ready to start the process, however I wanna be sure I have everything ready for root.

 

[scotty85]

Hey Scotty thx again for helping us all with this. Did you ever create the ruu for ntelos network? I have an ntelos merge as well and I am ready to start the process, however I wanna be sure I have everything ready for root.

no,sorry,i have not done one for that. you will have to back up all your images before downgrading so you can get back to a correct carrier RUU(if thats what you want)

you can do the first part of the guide,and then upload the images and wait for me to fix one up,or you can go ahead and use one of the other upgrade RUUs if you anxious to get started. the important thing is to back up your system,boot,recovery,and misc images and take note of your hboot and baseband before you downgrade.

 

[richardawood]

Thanks, I will be giving it shot as soon as I get some free time. I'll keep you posted!

 

[krosenqu]

Thanks scotty for this guide!
I recently obtained a USC branded merge. I followed this guide under the impression that I could use the phone on Verizon's network (after unlocking). I successfully completed the guide and obtained root using the Verizon ruu and I have s-off (I will probably go back to the usc gingerbread if I can get the Verizon boot animation).
My question is, when I open the notification bar, it still says us cellular and when I dial *228 it goes to the USC activation line.

How do I go about getting this activated on Verizon? Do I need to bring it in or call Verizon customer service with my esn/meid?

Thanks for the help.
-Kevin
Sent from Motorola Droid 1

 

[scotty85]

i was told by a vzw rep that if i unlocked the phone they could activate it,so i bought an alltel merge and unlocked it. however when i called to activate it,the meid/esn was not in their data base so they did not want to. i argued that a rep had told me i could activate it,and that the phone was running vzw firmware ()

they filled out something to add the meid/esn to their data base,but it never did happen. i checked weekly 3 or 4 times,and every time the rep would say "i cant see whats going on,ill get back to you" and then they never would

finally i gave up and traded it for nook color,and went out and bought myself an actual vzw merge.

if you want to try and get it activated,id go the same route. put the 1.49.605.1 firmware on it,call vzw and explain that it was on usc,but is running vzw firmware,and is unlocked.

good luck,let me know if you are able to get anywhere

 

[krosenqu]

I called Verizon this morning. The rep was EXTREMELY knowledgeable and helpful with me. He understood exactly what I was trying to do and what seemed to be the problem.

My MEID was clear and the phone was actually able to be activated. He went so far as to actually activate it.
HOWEVER, the USC Merge wasn't able to connect to the Verizon network to handshake. After installing the VZW rom, the phone still says "US Cellular" in the notification bar and tries calling US Cellular when *228 is dialed.

Turns out I need to manually program the phone but the rep could not find a way to do it; so thats where I'm stuck.

The rep said there is flashing the ruu, but there is also the carrier UI that needs to be flashed and I can't do that without a programming menu.

My phone is activated, but its not looking for the Verizon network, its still looking for the US Cellular network. How do I change that? The regular programming menu that the Verizon version Merge has is still not there.

This looks similar to what I need to do but I'm not sure. The rep told me I could take it to Verizon and they could help me program it but they may not have the correct hardware/software to oblige.
Programming & Troubleshooting - HoudiniSoft.com - HTC - HTC Merge

 

[kot222]

Good news - HTC Merge can get S-off, Super CID, unlock Sim with XTC clip! YESS!

 

[scotty85]

Good news - HTC Merge can get S-off, Super CID, unlock Sim with XTC clip! YESS!

I tried with both a manole clip and a raskal clip on an alltell and my vzw merge,and it dint work on either,despite lexikon being a supported device.

It always gave a "failed to find string" error like it wasn't finding the clip "sim card". If you want to try it,adding pieces of paper to make the fit tighter may help.

I may turn my s back on and try it again as I recently had the same trouble with a wildfre s and was able to make it work.

 

[krosenqu]

Well I narrowed it down.
For future reference, the programming menu can be found by dialing ##778#.
##3282# also works but seems to be for other things like viewing the MEID.

Now it needs a password. Oui!

I'm pretty sure I need to go to USC to get a MSL unlocking code (also may be called SPC or Service Programming Code or pay to have a service do it. Then maybe I can FINALLY get this thing going on Verizon Perhaps I will try this method next before I call.


(Keywords; US Cellular HTC Merge ADR6325 Unlocking Code Programming Menu EPST View Mode Edit Mode)

 

[scotty85]

I think the password is 000000.

Usc wont have an unlock code,as they are also cdma.

Your sim is unlocked,no need for unlock codes its a simple matter of getting the esn /meid into vzws system

 

[krosenqu]

I think the password is 000000.

Usc wont have an unlock code,as they are also cdma.

Your sim is unlocked,no need for unlock codes its a simple matter of getting the esn /meid into vzws system

It wont let me in to edit anything. I give it that password and it says "incorrect password."

I called USC and they wont give me a code because they think I stole the phone and am trying to sell it as unlocked on ebay or something. So I dont know what to do now. My only option would be to go in with my GF's dad and his photo ID to get it unlocked. Not exactly a thrilling proposition.

 

[scotty85]

options to me seem to be:

1)keep bugging vzw,maybe they can tell you the programming password
2) keep bugging usc,maybe they can tell you the programming password
3)activate on boost or cricket
4)activate on t mobile or some other gsm network
5)activate it on usc
6)sell it to someone as simunlocked so they can do 3,4,or 5,and find yourself a vzw merge. they dont seem to be that hard to find,i see them from $75 to $150 fairly often on craiglist

i opted for option 6,cause i found someone who wanted to trade it for a nook color with cm7 running from an sd card,wich was a more interesting proposition at the time

i had alot of fun with the merge,so i waited patiently till i found a vzw branded one,wich elimiated alot of the hassle.

if you keep persuing this,please keep me updated,ive found your progress to be quite interesting. from what you said a couple posts up,id say #1 is your best chance of actually getting it activated. i have had vzw reps guide me they manual programming a couple of times,so it seems this should be feasible,im not sure why the guy you talked to couldnt help you figure it out.

 

[krosenqu]

Woo! I got it!

It was easy as downloading a simple app from the market called "MSL Reader."

Because I had rooted my phone, superuser gave the app permission to look into the file system at the security file holding the MSL Code hostage. I'm in!

Now to get the information I need so it sees Verizon. I just called to try and activate it but
the rep I talked to gave me the "this is illegal and you should be arrested" speach so I'll have to call back to get somebody at tech support that actually knows what they are doing

I dont mean to be derogatory but she had a very thick southern accent and demonstrated her un-intelligence on multiple occasions.