If you are the type who needs to get the bigger picture before following detailed instructions then you may need to go through this.
Background before rooting and flashing ROMs.
Just to state the obvious the HTC desire has got the linux operating system at its core and the android virtual machine called the Dalvik virtual machine sits on top of this core. These are some of the areas you may need to get a handle on.
ROM
The desire has 572 MB RAM and 512 MB ROM space. The ROM is called so but actually is not read only and resides on NAND Flash memory which can be both read and written to. The ROM is like the hard disk of a PC and the sdcard is like a removable disk. Just like a PC which divides the hard disk into C: , D: etc Android divides the ROM into partitions. Android calls these partitions by different names like boot, system, data etc.
- The first partition 'misc' is a very sensitive area which contains carrier data among other and is normally never touched even when you root, go soff or flash ROMs.
- The 'recovery' partition contains a linux kernel specially tailored for flashing updates. During rooting this is replaced by a custom recovery from clockworkmod etc. The original recovery does not permit flashing of unofficial ROMs, backups etc and is extremely limited.
- The next partition is 'boot' which houses the actual linux kernel used by android.
- The 'system' partition houses the system apps and data. The term flashing ROMs mostly means installing a different system and boot image.
- The 'data' partition houses the user apps and their dependencies.
- The 'cache' partition houses the system cache.
SDCARD
The sdcard can be also divided into partitions. The first partition is generally the FAT32 filesystem of Windows which can be accessed on the PC by connecting with USB cable. The second partition is generally the ext filesystem of linux. sdext is not available on original device and is basically a mod for shifting your apps to sdcard when you are running out of space which is a vexing issue for desire owners. This is because in Android all user apps are installed only on 'data' partition which is on ROM and is 147 MB only and soon you run out of space. Note that this sdext methodology is different from android supported method of shifting of apps to sdcard.
Bootloader
The bootloader or hboot is the first piece of code executed by the device. It is accessed by booting with vol dn + power pressed. The hboot is similar to the BIOS of PCs. It does some checks and hands control over to the linux kernel(boot partition) if normal booting is followed. If interactive booting is followed and recovery is selected then it hands over control to recovery kernel(recovery partition). The hboot being the first piece of code executed by the device is one of the most sensitive pieces of software and corruption bricks the device.
Radio
The radio software drives the radio of the device like 2g, 3g . The radio software is also upgradable but is equally sensitive like hboot. Problems during flashing like supply interruptions, problematic usb cables, PC problems can brick the device.
Rooting
The process of rooting is basically gaining root or priveleged access in the linux system and is the first step to any customization of the device. Typically during rooting the unofficial recovery from clockworkmod or amonra is flashed which is what unrevoked does. Once the unofficial recovery is flashed your device actually gets opened up. With this recovery you can flash custom ROMs. You can also take backups(nandroid). Nandroid takes a image of the recovery, boot, system, data, cache and sdext partitions. This can be used to restore the system exactly to that state if things do not go as planned when flashing a new ROM or some other system related operation. Note that nandroid will not touch the hboot, radio and misc and also will not restore recovery. Nandroid also gives capability to erase(wipe) partitions like /data(factory reset), /cache and dalvik cache and may be required prior to flashing a new ROM due to incompatibilities. Custom recovery can also be used to uninstall vexing system apps(bloatware) among many other things.
SON/SOFF
The hboot has a special safeguard for preventing unauthorised changes to /system partition (even with root access) called SON. This prevents you from touching the /system or system apps when android is booted up. What this means is that you cant get rid of bloatware when android is running. The process of unlocking this security feature is called soff and it is carried out with alpharev software. Alpharev flashes a modified hboot which bypasses the security feature and /system can thereafter be available for read write. Since hboot also contains partition information, the partition sizes can also be changed from original tables with alpharev hboot. The modified partition tables can give you increased space in /data partition from original 147 MB stock to more than 300 MB by rearranging space. The hboot also has a special mode called fastboot during which some extended commands for flashing hboots, radios, splash screens etc can be issued to bootloader.
Unrooting (RUU/PB99IMG.zip)
These terms which you will come across is basically for disaster recovery and you want to restore and unroot the phone back to original carrier/HTC version for all areas including radio, hboot, boot, system, data etc. RUU (ROM Upgrade utility) is a PC software and works through the USB cable. The PB99IMG.zip file can be extracted from the RUU is a special zip file which when you stick it on sdcard does the same job as RUU. One needs to know that RUU/PB99IMG software are region specific and only a few of them are available which have been leaked from OEM service centres. You also need to be aware that your phone carries region branding which is a special code inserted by manufacturer. This code called cidnum is checked by the RUU/PB99IMG before it restores the phone. So if the software is not available for your region then the only alternative is you need to make a goldcard as described in the guides hosted in the forum. The goldcard is nothing but a sdcard with a modified bootsector. With the goldcard in the phone the RUU/PB99IMG bypasses the region code checks.
There is more detailed information in my subsequent posts if you want to know more.
Last edited by handy5876; October 10th, 2011 at 11:33 AM.
Reason: Update
The Following 9 Users Say Thank You to handy5876 For This Useful Post:
Device(s): i7500@galax0-1.6.3.4
OC@710mhz
HTC Desire - never ending modding
Thanks: 111
Thanked 981 Times in 816 Posts
very good but its too long so i can imagine members will read that and be like WTF?
out of interest did you read any of the guides/faq's that SUroot had written with all the various advise and problems weve come across over last 18months?
very good but its too long so i can imagine members will read that and be like WTF?
out of interest did you read any of the guides/faq's that SUroot had written with all the various advise and problems weve come across over last 18months?
it would have answered a lot of questions
- Yeah maybe its slightly long. What can I leave out or reduce? Ill try.
- I pieced this from those guides and interaction with the members and some searching on xda also.
Device(s): i7500@galax0-1.6.3.4
OC@710mhz
HTC Desire - never ending modding
Thanks: 111
Thanked 981 Times in 816 Posts
well its good as a learning piece, im just not sure who its targeted at as alot of that stuff is things that you can learn over time as its not needed for the early stuff
never the less, a good write up
The Following User Says Thank You to Rastaman-FB For This Useful Post:
It's not a guide on what you need to do, in fact its nothing you 'really' need to know. But it does tell you why things are done the way they are and gives you more of an understanding of what's going on.
Most people just root and flash. Then perhaps S-Off to get more data partition space. How many actually know what's going on and how their phone operates behind all of the jargon.
Thanks for the boosters. I figured out how to make it smaller by formatting. Maybe now it is more readable.
My small writeup is hardly a patch on the guides here. It is just a rough map sketch.
Last edited by handy5876; June 30th, 2011 at 08:48 AM.
As great as the guides and faq's are (and they ARE!) my initial fear was not understanding what various things actually were when they were referred to in the guide - this helps a lot!!
Even now with a good 4 days rooting experience under my belt, its been handy to have a read through and understand things a little better!
I'd recommend any new rooters read this and then go on to the guides!!
Need to make a goldcard which you didnt make earlier and phone is having a problem. I heard somewhere that phone is not at all required for making a goldcard. The tricky part is you need to read the cid.
Didnt have any luck with Windows. Didnt find any utility to read the cid.
Turned my attention to linux. Was too lazy to install linux. But I realized that I had the gparted live cd. I think most rooters have this. Just booted with that and read the cid just as given in the rooting sticky except you need to substitute mmc0 for mmc1. All other steps are the same.
Course you need computer with cardreader and computer needs to be set to boot from cd.
Nandroid
Nandroid is the backup and restore facility offered by custom recovery. What is custom recovery now? It is the the recovery program which is used to replace the stock program in the phone. The custom recovery gives many more facilities than the stock one does like:-
- Flashing custom ROMs
- Backup and restore the phone
- Formating partitions
- Wipe partitions etc
Now recovery is really a linux kernel which is situated on mtd1 (the second partition of Flash memory). Once the bootloader hboot completes its checks it hands over control to the actual linux kernel located at mtd2. If the interactive booting is followed and recovery option is chosen in hboot then control is handed over to recovery in mtd1.
The nandroid backup facility of recovery creates .img files from the /recovery(mtd1), /boot(mtd2) , /system(mtd3), /cache(mtd4), /userdata(mtd5) and /sdext (mmcblk0p2) partitions. The idea is that on selecting restore these partitions are restored exactly as they were earlier. It is thus a great utility since if you try out a ROM and dont like it and want to go back all you need to do is reboot into recovery and restore the specific backup.
Nandroid does not restore the recovery.img since I guess it does not make sense trying to restore itself. But all these image files can be flashed from fastboot mode if you are SOFF.
Root Directory
Have you wondered about the ROMs you install. What is in them? It turned out that they only contained verbatim the /system partition you find on the device. It also contains a boot.img.
Now there is a mystery. Where did so many directories get populated on the root directory once android starts up. Where is the root mounted ? The answer to this lies in boot.img. The boot.img which is destined for the boot partition contains a kernel and gzipped ramdisk. If the ramdisk is extracted by searching for gzip signature then you find the ramdisk contents faithfully mirror some of the files & directories in the root directory like so:-
/data
/dev
/proc
/sbin
/sys
/system
default.prop
init
init.bash.rc
init.goldfish.rc
init.rc
ueventd.bravo.rc
ueventd.goldfish.rc
ueventd.rc
All these directories are mostly empty and are mount points for the actual partitions like mtd3, 4 etc. Thus the ramdisk itself is the root partition. Unlike desktop linux the ramdisk is not unloaded and continues. So after kernel gets control from bootloader one of the tasks it does after many OS related stuff is start init located in ramdisk. init in turn executes init.rc also on ramdisk.
init.rc is the one which actually brings the system up and it also mounts the partitions into the root. It also creates various other directories which you find in the root directory and not in the ramdisk.
Unrooting
RUU/PB99IMG
Some thoughts on RUU/PB99IMG
I have seen people finding the RUU business very trying. This is my attempt at understanding RUU issue. Not complete.
RUU Rom Upgrade Utility is a leaked software from OEM service centres which are utilised to quickly repair or flash a phone back to stock. In the process the phone also gets unrooted. The RUU is a windows software and works through the USB cable. The PB99IMG.zip is a rom.zip file hidden inside the RUU and can be easily extracted in Windows. The zip file needs to be renamed to PB99IMG.zip and planted on your sdcard and thereafter the same function as RUU can be achieved by booting device with vol dn + power button.
Each RUU is specific to a certain region and ordinarily you cannot flash the RUU not meant for you. The device supported by the RUU is captured in the rom.zip in the android-info.txt file. For example the android-info.txt file in the wwe RUU 2.29.405.5 RUU holds the following data:-
Before RUU flashes back to HTC stock it does some checks to enforce that you are flashing correct RUU:-
- Region code - The region code is embedded in the device and can be read by issuing 'fastboot getvar all'. The cidnum variable holds the region code. This code needs to be in the list of cid's in the android-info.txt file. Otherwise cid error will result. Apparently this variable is hardcoded somewhere in the device and cannot be changed.
- Software Version - The ccc in the mainver no a.bb.ccc.d is important. In some way it is unique and it looks like it has a one to one linkage to cidnum. If that is so if the cidnum matches then the ccc has to match. More clarity is needed here.
- Modelid and hbootpreupdate - modelid seems to be self explanatory(erase size ?). hbootpreupdate not sure about. Maybe it ensures version checking of existing hboot. Maybe hboots have a running serial no like 11, 12 etc.
However this cidnum checking can be bypassed if you put an sdcard which is a goldcard in the device before the RUU process. It beats me why they have gone to so much of trouble sewing up the RUU and then opening this simple door. Anycase once you put a goldcard then you maybe permitted to flash something which is not meant for you so be careful and dont just flash any RUU(which contains a wrong radio for instance). Spend a lot of time and ask questions before you flash the RUU.
HTC Gingerbread Update
A few thoughts on this RUU. I have not installed this and dont aim to. But I can see that the build no for this RUU is 3.14.405.1. The 405 is the wwe series. But this is supposed to be RUU for all regions. When the androidinfo.txt file is checked against the 2.29.405.5 file then you can see that a lot of magic is there:-
So you can see that though it is 405 series it is allowed on most region devices since a large no of cidnum with wildcard * placeholders have been included in the RUU. This would indicate that it is not the series no like "405" that is important for deciding whether to allow an RUU. It is the cidnum actually which you can read with fastboot getvar all.
HTC quote "Please note that the following regional variants are not compatible with this upgrade: Germany (Telekom Deutschland), North America, South Korea and Japan.". I am guessing their cids are not in this list.
The hboot with the RUU is 1.02.0001. I wonder if HTC has given a unlocked bootloader as they have been promising.
Dont know what radio they have included though. I guess you will come to know only if you install. Correction radio is 5.17.05.23.
What does SOFF actually mean
Alphrev quote
"HTC implemented security on their newer generation phones. This flag, called @secuflag, controls whether your phone has
it's NAND or flash unlocked. Most noticeably, S-ON (security on) will read-lock your /system and /recovery partition, to name a few. Also, secuflag controls whether zip files being flashed through recovery or fastboot, are signed by HTC.
The now notorious S-OFF (security off) will disable this NAND security.Since we are unable to access the Radio NVRAM itself (where secuflag is stored), we turned our attention to HBOOT."
What does it actually mean? The bootloader is locked when it is son and unlocked when it is soff? More details:-
Partition Locking. The /system and /recovery partitions are locked by the bootloader. What does it mean? Is it that it is mounted read only ? If so then as root you can just mount read write and get write access. Actually even if you mount as read write you will still not get access. So how does the partition locking get implemented? The answer is with a bit of hardware support. The NAND chips are having a special write lock feature called WP(Write Protection) pin which when activated can hardware lock portions of NAND memory. This is exactly how bootloader locks the partitions after checking secuflag.
Signed zip files. The zip files from HTC like PB99IMG.zip or update.zip are supposed to be signed with secret HTC keys. And the bootloader if it is son checks these signatures before using them. So thats why it does not allow unofficial zips to be flashed. These zips are not like update zips released by custom rom developers which contain metainf with hash signature. The hash signature(or digest) in htc roms are put in the beginning of the zip file as a special 256 byte area. This 256 byte area is not there in other zip files and comes before the zip file sequence "50 4B 03 04". The bootloader uses the secret keys stored in bootloader(?) to compute the hash of the zip and compare it with the hash stored in the zip.
How come you are allowed to flash ROMs without SOFF in recovery. My guess is that hboot when it hands over to recovery unlocks partitions thus permitting ROM flashing. Without SOFF you also have ADB access in recovery to finger around with system partition.
Last edited by handy5876; October 10th, 2011 at 11:35 AM.
The HTC Desire is one of the latest high end phone by HTC bringing a huge 3.7" inch high quality AMOLED screen for crystal clear viewing, powered by a 1 GHz Qualcomm Snapdragon processor and runs on, you guessed it, Android.
We first heard a... Read More
Backgrounder to rooting and Android errata
