• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root root,s-off,simunlock,superCID htc merge

Hey there! First I wanted to say thank you for your excellent guide and resources. You're a beast Scotty. Now to the meat and potatoes of my problem.

I am helping somebody to get s-off and all that jazz on their HTC Merge.

Following your directions, we get to the point where we activate zergrush. It runs, but fails every time. I get an error I have gotten before with an Amazon Kindle, but never an HTC device.

Hellions with BLUE flames. Fail land...

This is where we are at in the process and cannot get past it because zergrush is not giving us our temp root.

We have attempted to restart this process from the beginning a few times. I even tried a different download of zergrush. We can push zergrush no problems, we can set chmod no problems, we can run zergrush no problems But everytime zergrush runs, the Hellions come in with their blasted blue flames :P

I have done a bit of research on this error, and it seems to mean just general fail.

Was coming here to see if anybody encountered this problem and got past it, or knows of a helpful pointer to get the zergs in the machine :D

Thanks for any time or help given!
 
unofrtunately,that means that the exploits have been patched,and zergRush is unable to obtain temporary root. im assuming that youre on usc GB,and that there has been some sort of OTA to it.

there are a couple different possibilities:
1)check your build number. you may be able to roll back to the latest official version if what youre on was a minor OTA,despite an s-on hboot. 3.10.573.1 was the first usc GB update,and i believe there was one after it that zergrush still worked on. not sure how many more could been between that and what youre on.

check Shipped ROMs and general google searching to try and track down an RUU if you want to try this route

2) use fre3vo for temp root

3) unlock using htcdev tools and gain permanent root to do the downgrade. i *think* that would work,but you would be on uncharted territory,and there is good possiblity youd be stuck for all eternity with htcdev unlocked/s-on with no chance to downgrade,so that would be my personal last choice.

4)maybe jcase's taco root


fre3vo worked on the latest thunderbolt update,so id say theres a good change it would here too,and this would be my first choice.
heres what you do:

download DHD Downgrade folder

-open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the miniadb_merge folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)

-in your command window: change to the miniadb_merge directory by typing:
cd c:\miniadb_merge (your promt should change to c:\miniadb_merge>)
*note that in the next few steps,anything in bold type is an adb command. you can directly copy from this window,and paste into your command window to eliminate typos.

-enable usb debugging,plug in your phone via usb. select "charge only" mode.

-make sure adb is seeing your phone:
adb devices (should return your serial number)

- enter the commands from your link,one at a time,hit enter after each:

adb push fre3vo /data/local/tmp

adb shell chmod 777 /data/local/tmp/fre3vo

adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF

-make sure it worked. when you see "exploiting device" then your command prompt again:
adb shell (if your prompt changes to a # youre good to go)

heres what the above will look like in your cmd window:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\tbolt2[/COLOR]

c:\tbolt2>[COLOR="Red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HTxxxxxx    device


c:\tbolt2>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR]
956 KB/s (9796 bytes in 0.010s)

c:\tbolt2>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR]

c:\tbolt2>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF[/COLOR]
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
  id: msmfb
  smem_start: 802160640
  smem_len: 3145728
  type: 0
  type_aux: 0
  visual: 2
  xpanstep: 0
  ypanstep: 1
  line_length: 1920
  mmio_start: 0
  accel: 0
fb_var_screeninfo:
  xres: 480
  yres: 800
  xres_virtual: 480
  yres_virtual: 1600
  xoffset: 0
  yoffset: 0
  bits_per_pixel: 32
  activate: 16
  height: 94
  width: 56
  rotate: 0
  grayscale: 0
  nonstd: 0
  accel_flags: 0
  pixclock: 0
  left_margin: 0
  right_margin: 0
  upper_margin: 0
  lower_margin: 0
  hsync_len: 0
  vsync_len: 0
  sync: 0
  vmode: 0
Buffer offset:      00000000
Buffer size:        8192
Scanning region f0000000...
Scanning region f00f0000...
Scanning region f01e0000...
Scanning region f02d0000...
Scanning region f03c0000...
Scanning region f04b0000...
Scanning region f05a0000...
Scanning region f0690000...
Scanning region f0780000...
Scanning region f0870000...
Scanning region f0960000...
Scanning region f0a50000...
Scanning region f0b40000...
Scanning region f0c30000...
Scanning region f0d20000...
Scanning region f0e10000...
Scanning region f0f00000...
Scanning region f0ff0000...
Scanning region f10e0000...
Scanning region f11d0000...
Scanning region f12c0000...
Scanning region f13b0000...
Scanning region f14a0000...
Scanning region f1590000...
Scanning region f1680000...
Scanning region f1770000...
Scanning region f1860000...
Scanning region f1950000...
Scanning region f1a40000...
Scanning region f1b30000...
Scanning region f1c20000...
Scanning region f1d10000...
Scanning region f1e00000...
Scanning region f1ef0000...
Scanning region f1fe0000...
Scanning region f20d0000...
Scanning region f21c0000...
Scanning region f22b0000...
Scanning region f23a0000...
Scanning region f2490000...
Scanning region f2580000...
Scanning region f2670000...
Scanning region f2760000...
Scanning region f2850000...
Scanning region f2940000...
Scanning region f2a30000...
Scanning region f2b20000...
Scanning region f2c10000...
Scanning region f2d00000...
Scanning region f2df0000...
Scanning region f2ee0000...
Scanning region f2fd0000...
Scanning region f30c0000...
Scanning region f31b0000...
Scanning region f32a0000...
Scanning region f3390000...
Scanning region f3480000...
Scanning region f3570000...
Scanning region f3660000...
Scanning region f3750000...
Scanning region f3840000...
Scanning region f3930000...
Scanning region f3a20000...
Scanning region f3b10000...
Scanning region f3c00000...
Scanning region f3cf0000...
Scanning region f3de0000...
Scanning region f3ed0000...
Scanning region f3fc0000...
Scanning region f40b0000...
Scanning region f41a0000...
Scanning region f4290000...
Scanning region f4380000...
Scanning region f4470000...
Scanning region f4560000...
Scanning region f4650000...
Scanning region f4740000...
Scanning region f4830000...
Scanning region f4920000...
Scanning region f4a10000...
Scanning region f4b00000...
Scanning region f4bf0000...
Scanning region f4ce0000...
Scanning region f4dd0000...
Scanning region f4ec0000...
Scanning region f4fb0000...
Scanning region f50a0000...
Scanning region f5190000...
Scanning region f5280000...
Scanning region f5370000...
Scanning region f5460000...
Scanning region f5550000...
Scanning region f5640000...
Scanning region f5730000...
Scanning region f5820000...
Scanning region f5910000...
Scanning region f5a00000...
Scanning region f5af0000...
Scanning region f5be0000...
Scanning region f5cd0000...
Scanning region f5dc0000...
Scanning region f5eb0000...
Scanning region f5fa0000...
Scanning region f6090000...
Scanning region f6180000...
Scanning region f6270000...
Scanning region f6360000...
Scanning region f6450000...
Scanning region f6540000...
Scanning region f6630000...
Scanning region f6720000...
Scanning region f6810000...
Scanning region f6900000...
Scanning region f69f0000...
Scanning region f6ae0000...
Scanning region f6bd0000...
Scanning region f6cc0000...
Scanning region f6db0000...
Scanning region f6ea0000...
Scanning region f6f90000...
Scanning region f7080000...
Scanning region f7170000...
Scanning region f7260000...
Scanning region f7350000...
Scanning region f7440000...
Scanning region f7530000...
Scanning region f7620000...
Scanning region f7710000...
Scanning region f7800000...
Scanning region f78f0000...
Scanning region f79e0000...
Scanning region f7ad0000...
Scanning region f7bc0000...
Scanning region f7cb0000...
Scanning region f7da0000...
Scanning region f7e90000...
Scanning region f7f80000...
Scanning region f8070000...
Scanning region f8160000...
Scanning region f8250000...
Scanning region f8340000...
Scanning region f8430000...
Scanning region f8520000...
Scanning region f8610000...
Scanning region f8700000...
Scanning region f87f0000...
Scanning region f88e0000...
Scanning region f89d0000...
Scanning region f8ac0000...
Scanning region f8bb0000...
Scanning region f8ca0000...
Scanning region f8d90000...
Scanning region f8e80000...
Scanning region f8f70000...
Scanning region f9060000...
Scanning region f9150000...
Scanning region f9240000...
Scanning region f9330000...
Scanning region f9420000...
Scanning region f9510000...
Scanning region f9600000...
Scanning region f96f0000...
Scanning region f97e0000...
Scanning region f98d0000...
Scanning region f99c0000...
Scanning region f9ab0000...
Scanning region f9ba0000...
Scanning region f9c90000...
Scanning region f9d80000...
Scanning region f9e70000...
Scanning region f9f60000...
Potential exploit area found at address f9fd6200:e00.
Exploiting device...

c:\tbolt2>[COLOR="red"]adb shell[/COLOR]
# [COLOR="Blue"]<-indicates that you have temp root access[/COLOR]

(ignore tbolt2,these are actually my thunderbolt directions ;))

if you get your "#" prompt,indicating temp root,type exit to get back to your miniadb_merge> prompt,and pickup the directions in the first post at:
adb push busybox /data/local

basically,youre just eliminating those first few lines that pertain to zergrush. once youve successfully downgraded,you can follow the directions exactly,as youre on older firmware where the exploits will work for sure.

hope that helps :)
 
Thanks, we will be trying this as soon as I get home from work :D

Yeah... with the GB version... a couple weeks before we started to attempt this, the user had taken it to a USC store to get the GB update. I assumed it was updated gingerbread breaking the zergrush... thank you for confirmation. Will be checking their GB version as soon as I get my hands on it.

Again... thank you so much for the ideas. We will be trying this later on ^_^

I assumed we would be uncharted here, but with the official GB updates coming for these phones it would be good to get a process down for hacking it. Can't wait test!

Do you have a paypal or anything? Even if this doesn't work... you are a great help man to me and many others I have seen here. Would love to at least give you enough for a couple beers or lunch once I get paid!
 
Awesome... Got it working! S-off, back to US cellular, and rooted ^_______^

Thanks man, so very much.

Used the fre3vo temp root and it worked like a charm. Funny thing is, when I was researching I had found that and figured it would only work on EVO and sensation hardware. Well it works fine on Merge/Lexikon as well!

After temp root with fre3v0, the whole process went smooth.

Thank again for help, and the highly detailed instructions :D
 
All, I have been reading these posts for a few days with my new merge, I have been rooting and roming ntelos phones for a few years and this one is giving me a fit. I have successfully got temp root and made backups of all the .img files and now in need of a custom RUU. I can gladly post the files up if Scotty85 could possibly build me a RUU or point me to some directions that would be awesome...
 
sure. i can describe to you how to place the images together,or you are welcome to upload your recovery/system/boot images,and provide radio and hboot info and ill put it together. you are on your own for testing,however,since i dont have a merge currently to test on before uploading it for you :(
 
that would be awesome, i will post aspap. Question during this process if I were to have used one of the other carrier ruus would it have updated the radio? And will the custom ruu you make flash the radio as well?
 
No prollem. As long as I have that radio,the custom ruu will flash it as.well. ill download and.take a look wen I get home :)

Also,what is your current build version number?
 
downloading now :) i didnt have your radio allready,but i found a cellsouth ruu containing it,so im downlaoding that,now,too.

ill have to extract the rom from it,so it may be a lil later this evening.
 
OK, All worked just fine now have root and s-off can make calls, texts etc... no 3g connection though so I am trying to get that fixed...Any Ideas...
 
Hey scotty could you please post a new lin.k to the us cellular south froyo please :). That's the only link that I need to start my rooting experience!
 
stevgunt said:
OK, All worked just fine now have root and s-off can make calls, texts etc... no 3g connection though so I am trying to get that fixed...Any Ideas...
Click to expand...

first check and make sure mobile data is enabled ;)

then:
try simple reboot

try toggling airplane mode on and off

try toggling data

if none of that works,you can try a factory data reset. you could also try running the cell south RUU i pulled your radio from(make sure to make a backup of what you have first,tho,in recovery)

if that fails,you may have to do a PRL update(for vzw you dial *228) however you do that with ntellos.

lexikon RUUs

shawnyahoocom said:
Hey scotty could you please post a new lin.k to the us cellular south froyo please :). That's the only link that I need to start my rooting experience!
Click to expand...

uploading now :) its slow,so ill have a link in a couple hours

edit:just got home and the upload had experienced a "technical error" :rolleyes: trying again :)
 
hey all, if i missed this info in the previous pages, my apologies.
first off thanks for the amazing guide, ran right through it on my vzw merge like a boss. everything worked great. rooted and running great. now to my question. i've got froyo still, and i want to upgrade it to gingerbread. do i just flash the USC gingerbread ruu? or do i need a special format for vzw?
 
well i tried to extract the mergeadb.zip file and it says access denied for all the files:confused: the other downloads worked just fine. help!
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create wpthis
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create zergRush
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create adb.exe
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create AdbWinApi.dll
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create AdbWinUsbApi.dll
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create busybox
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create fastboot.exe
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create flash_image.txt
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create gfree
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create md5sums.exe
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create misc-downgrade.img
Access is denied.
! C:\Users\Bouton Family\Desktop\miniadb_merge.zip: Cannot create psneuter
Access is denied.

*******************update!!!************
ok nm i got it to work after the tenth try? i dont get it but it extracted LOL
 
korrdite said:
hey all, if i missed this info in the previous pages, my apologies.
first off thanks for the amazing guide, ran right through it on my vzw merge like a boss. everything worked great. rooted and running great. now to my question. i've got froyo still, and i want to upgrade it to gingerbread. do i just flash the USC gingerbread ruu? or do i need a special format for vzw?
Click to expand...

i ran the usc gingerbread rom on my vzw merge with no issues whatsoever.

if you want to be crafty,you can go to settings/customize/resource and copy the vzw boot animation and and some of the wallpapers to your sd card to make the usc GB ruu look like a vzw rom ;)

i cant really build anything too custom until i get another merge to test on. i just dont like uploading or posting things that i havent tested on my own device :eek:

glad you found the guide to be useful :)
 
scotty85 said:
i ran the usc gingerbread rom on my vzw merge with no issues whatsoever.

if you want to be crafty,you can go to settings/customize/resource and copy the vzw boot animation and and some of the wallpapers to your sd card to make the usc GB ruu look like a vzw rom ;)

i cant really build anything too custom until i get another merge to test on. i just dont like uploading or posting things that i havent tested on my own device :eek:

glad you found the guide to be useful :)
Click to expand...

yeah i just finished loading the USC gingerbread. so far seems to work well. i would like it to show the VZW animations. do you think you can coach me on how to change those? or do you feel comfortable rebuilding for me with VZW feel? either way it's not a major issue and one i can easily learn to ignore if it proves too risky or difficult to work with
 
You must log in or register to reply here.
Back
Top Bottom