Root root,s-off,simunlock,superCID htc merge

[scotty85]

wow that is wierd ive never used it on the merge without s-off,nor have i used it with anything other than amon recovery(wich i wouldnt think would matter,but maybe it does?) so ive never experienced that.

might try switching to amon and see if that issue still persists

there are some "quirks" with the eris htcdev hboot as well,they released alot of bootloaders for alot of devices in a relatively short time,so unfortunately its not surprising to find some quirks in some.

 

[stevgunt]

I finally have success and am now making a nandroid backup Steps I took

1. unlock bootloader again
2. reboot into bootloader via fastboot
3. bot into CWM recovery via fastboot
3. INstalled fiizion rom etc...
4. Reboot and BINGO kernel changed and wifi working
5. Bootloader is locked again but can relock now that I am a pro at it

 

[eigokyoukan]

Congrats man! Welcome to the land of the root

 

[stevgunt]

Thanks, All this with S-ON as well

 

[stevgunt]

Now If I could just get the 2fast OC Kernel to flash right I would have something but no luck so far, each time I try and flash it using any recovery it just locks the bootloader back and does not flash and all I have is the .zip of the kernel not the actual boot.img of the kernel. Any Ideas?

 

[scotty85]

Now If I could just get the 2fast OC Kernel to flash right I would have something but no luck so far, each time I try and flash it using any recovery it just locks the bootloader back and does not flash and all I have is the .zip of the kernel not the actual boot.img of the kernel. Any Ideas?

welcoms to htcdev

my best idea would be s-off

failing that,you can just flash it in fastboot as i described above. rumage thru your 2 fast kernel zip file and find the boot.img put it into your adb/fastboot folder,put your phone in fastboot mode,and:

fastboot flash boot <bootimagename>.img

before you do it,id prolly hook your phone to your PC,and move a stock nandroid from phone to PC,so you can rumage thru it,and find a stock boot image(kernel) to flash just in case your phone doesnt care for the new kernel.

might want to set up folders for various roms and backups,and their associated kernels,and possibly rename the boot.img to something a little more specific(boot-stock.img,boot-2fast.img,etc)

while i can manipulate it to flash roms,backups,etc., i hate htcdev on my rezound. id give my left you-know-what for a true s-off exploit

 

[korrdite]

K for anyone with mms issues after flashing, here is what worked for me. Flash a copy of the stock ruu, go under messages, settings, look at the connection information, as long as your mms works with the stock image, you know these settings are correct. Download an apn back up app. Back up your apn info to sd. Now flash the image you wish to use, download the apn backup app again, tell it to delete the settings, THEN restore the settings from your sd. If you try to restore before deleting, it will not overwrite for whatever reason. Hope this is understandable and helpful for others!

 

[scotty85]

Yea NP Scotty thanks for you help to begin with. When i was at the store they ran the stock GB RUU.exe file as I watched them do it. It flashed everything back to stock supposedly but the 3g still did not work. I do however have a flashable .zip file i used on my Hero and Desire that changed all the carrier settings and I think APN stuff too I never did try that but anyways....I will try the super tool, All I want is root so I can use free Tether

for what its worth,i just flashed your upgrade nTelos RUU on my new-to-me vzw merge,and data is working fine,cell south radios and all.

this is a nice rom,for those that want GB. we now have a couple choices with this and usc

hmm what else was i gonna check into when i got a working phone?

 

[korrdite]

hmm what else was i gonna check into when i got a working phone?

getting the rom to look like a VZW phone instead of USCC Phone? i kid i kid, i'm actually running the fuzion ruu, posted by 2fast, runs great, seems battery life is slightly improved versus this one at least for me. i need to learn some development techniques so i can start contributing though.

 

[scotty85]

did you get the vzw boot animation figured out?

 

[korrdite]

Naw, fuzion doesn't use the USC boot animation so I didn't bother, I however would prefer for the phone to be recognized as a proper VZW device. But it's not a huge concern

 

[Androopy]

HI. Could you possibly re-upload the leaked VZW ruu? The only two links I've been able to find to it anywhere have been to megaupload(and we know what happened there) and WUploads, which won't let anyone that doesn't have the uploader's username and password get anything. Thanks in advance.Thanks so much for posting this guide. I've been trying to find a decent guide that is "beginner friendly".

 

[scotty85]

sorry about the wupload thing,if id known they were gonna decide they "werent a file sharing service" i never would have uploaded anything there

uploading now to rapidshare. says 49 minutes remaining

 

[scotty85]

https://rapidshare.com/files/1023634892/PD42IMG-vzw-leak.zip

OP updated as well. do you need a custom RUU or do you have a factory RUU?

 

[Androopy]

Thank you so much
I've been able to get everything else you listed in the tutorial on the first page, it was just the vzw leaked ruu that I was unable to acquire. But just to be sure I have it right, the zip file containing the factory ruu (for a Us Cellular HTC Merge running 2.3.4) is UsCellular 3.10.573.1.zip, right?

 

[scotty85]

looks like there is a slightly newer RUU:
Android Downloads | Android-Powered Phones | U.S. Cellular

prolly want to use that for your upgrade. if you use the older one,the phone may try and OTA,wich can be bad when running a custom recovery

im downloading it now,as well

 

[janiawas]

im still Confused

 

[scotty85]

im still Confused

about?

 

[Dehumanized]

hi Scotty. i have sat here basically for 8 hours with this us cellular htc merge. ive tried flashing the vzw leaked exploit ruu after renaming it to the name specified. i followed all the steps. when it came down to flashing the exploit it keeps telling me.. CID Incorrect flash failed. is there any way to fix this? please help

 

[scotty85]

the cid check is what you want to eliminate with the gold card,so sounds like you need to remake the gold card

 

[Dehumanized]

so how do i make it effectively... for some odd reason, if i do the adb way of doing it the commends dont work but if i do the gold card helper it does work. so im thinking somehow im doing it wrong? is it possible you can hit me up on gtalk? night.fury.wolf@gmail.com

 

[scotty85]

so how do i make it effectively... for some odd reason, if i do the adb way of doing it the commends dont work but if i do the gold card helper it does work. so im thinking somehow im doing it wrong? is it possible you can hit me up on gtalk? night.fury.wolf@gmail.com

sorry for the delayed reply.did you get your gold card working?

also,the OP has been updated with links hosted by www.androidfilehost.com

if this guide,or any of the files hosted by the site have helped you,consider donating to their server cost

 

[Dehumanized]

yes thank you scotty i got my gold card working. i figured out it was just the sd card failing.

 

[Viper32]

Scooty,

Please read the below post...

Viper

 

[Viper32]

Scotty,

Ihad to use the below method because the other way would not give me temp root. Guess my version is to high. I get through all of this with temp root # as you described. I then finish as you described to pick up on the page 1 topic. I have tried 4 sdcards making four different gold cards and I still get the wrong cid or whatever it is. I am at a loss on what to do. I even tried the HTC Unlock method but it says I do not have the right firmware or updated enough but it is... Please tell me what to do. If you can contact me i will be more than happy to hook up on teamviewer so you can watch or try it yourself. Please help I need to unlock it so I can use it with T-Mobile or I am out of some money ....

Thanks,
Viper

unofrtunately,that means that the exploits have been patched,and zergRush is unable to obtain temporary root. im assuming that youre on usc GB,and that there has been some sort of OTA to it.

there are a couple different possibilities:
1)check your build number. you may be able to roll back to the latest official version if what youre on was a minor OTA,despite an s-on hboot. 3.10.573.1 was the first usc GB update,and i believe there was one after it that zergrush still worked on. not sure how many more could been between that and what youre on.

check Shipped ROMs and general google searching to try and track down an RUU if you want to try this route

2) use fre3vo for temp root

3) unlock using htcdev tools and gain permanent root to do the downgrade. i *think* that would work,but you would be on uncharted territory,and there is good possiblity youd be stuck for all eternity with htcdev unlocked/s-on with no chance to downgrade,so that would be my personal last choice.

4)maybe jcase's taco root


fre3vo worked on the latest thunderbolt update,so id say theres a good change it would here too,and this would be my first choice.
heres what you do:

download DHD Downgrade folder

-open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the miniadb_merge folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)

-in your command window: change to the miniadb_merge directory by typing:
cd c:\miniadb_merge (your promt should change to c:\miniadb_merge>)
*note that in the next few steps,anything in bold type is an adb command. you can directly copy from this window,and paste into your command window to eliminate typos.

-enable usb debugging,plug in your phone via usb. select "charge only" mode.

-make sure adb is seeing your phone:
adb devices (should return your serial number)

- enter the commands from your link,one at a time,hit enter after each:

adb push fre3vo /data/local/tmp

adb shell chmod 777 /data/local/tmp/fre3vo

adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF

-make sure it worked. when you see "exploiting device" then your command prompt again:
adb shell (if your prompt changes to a # youre good to go)

heres what the above will look like in your cmd window:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\tbolt2[/COLOR]

c:\tbolt2>[COLOR="Red"]adb devices[/COLOR]
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HTxxxxxx    device


c:\tbolt2>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR]
956 KB/s (9796 bytes in 0.010s)

c:\tbolt2>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR]

c:\tbolt2>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF[/COLOR]
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
  id: msmfb
  smem_start: 802160640
  smem_len: 3145728
  type: 0
  type_aux: 0
  visual: 2
  xpanstep: 0
  ypanstep: 1
  line_length: 1920
  mmio_start: 0
  accel: 0
fb_var_screeninfo:
  xres: 480
  yres: 800
  xres_virtual: 480
  yres_virtual: 1600
  xoffset: 0
  yoffset: 0
  bits_per_pixel: 32
  activate: 16
  height: 94
  width: 56
  rotate: 0
  grayscale: 0
  nonstd: 0
  accel_flags: 0
  pixclock: 0
  left_margin: 0
  right_margin: 0
  upper_margin: 0
  lower_margin: 0
  hsync_len: 0
  vsync_len: 0
  sync: 0
  vmode: 0
Buffer offset:      00000000
Buffer size:        8192
Scanning region f0000000...
Scanning region f00f0000...
Scanning region f01e0000...
Scanning region f02d0000...
Scanning region f03c0000...
Scanning region f04b0000...
Scanning region f05a0000...
Scanning region f0690000...
Scanning region f0780000...
Scanning region f0870000...
Scanning region f0960000...
Scanning region f0a50000...
Scanning region f0b40000...
Scanning region f0c30000...
Scanning region f0d20000...
Scanning region f0e10000...
Scanning region f0f00000...
Scanning region f0ff0000...
Scanning region f10e0000...
Scanning region f11d0000...
Scanning region f12c0000...
Scanning region f13b0000...
Scanning region f14a0000...
Scanning region f1590000...
Scanning region f1680000...
Scanning region f1770000...
Scanning region f1860000...
Scanning region f1950000...
Scanning region f1a40000...
Scanning region f1b30000...
Scanning region f1c20000...
Scanning region f1d10000...
Scanning region f1e00000...
Scanning region f1ef0000...
Scanning region f1fe0000...
Scanning region f20d0000...
Scanning region f21c0000...
Scanning region f22b0000...
Scanning region f23a0000...
Scanning region f2490000...
Scanning region f2580000...
Scanning region f2670000...
Scanning region f2760000...
Scanning region f2850000...
Scanning region f2940000...
Scanning region f2a30000...
Scanning region f2b20000...
Scanning region f2c10000...
Scanning region f2d00000...
Scanning region f2df0000...
Scanning region f2ee0000...
Scanning region f2fd0000...
Scanning region f30c0000...
Scanning region f31b0000...
Scanning region f32a0000...
Scanning region f3390000...
Scanning region f3480000...
Scanning region f3570000...
Scanning region f3660000...
Scanning region f3750000...
Scanning region f3840000...
Scanning region f3930000...
Scanning region f3a20000...
Scanning region f3b10000...
Scanning region f3c00000...
Scanning region f3cf0000...
Scanning region f3de0000...
Scanning region f3ed0000...
Scanning region f3fc0000...
Scanning region f40b0000...
Scanning region f41a0000...
Scanning region f4290000...
Scanning region f4380000...
Scanning region f4470000...
Scanning region f4560000...
Scanning region f4650000...
Scanning region f4740000...
Scanning region f4830000...
Scanning region f4920000...
Scanning region f4a10000...
Scanning region f4b00000...
Scanning region f4bf0000...
Scanning region f4ce0000...
Scanning region f4dd0000...
Scanning region f4ec0000...
Scanning region f4fb0000...
Scanning region f50a0000...
Scanning region f5190000...
Scanning region f5280000...
Scanning region f5370000...
Scanning region f5460000...
Scanning region f5550000...
Scanning region f5640000...
Scanning region f5730000...
Scanning region f5820000...
Scanning region f5910000...
Scanning region f5a00000...
Scanning region f5af0000...
Scanning region f5be0000...
Scanning region f5cd0000...
Scanning region f5dc0000...
Scanning region f5eb0000...
Scanning region f5fa0000...
Scanning region f6090000...
Scanning region f6180000...
Scanning region f6270000...
Scanning region f6360000...
Scanning region f6450000...
Scanning region f6540000...
Scanning region f6630000...
Scanning region f6720000...
Scanning region f6810000...
Scanning region f6900000...
Scanning region f69f0000...
Scanning region f6ae0000...
Scanning region f6bd0000...
Scanning region f6cc0000...
Scanning region f6db0000...
Scanning region f6ea0000...
Scanning region f6f90000...
Scanning region f7080000...
Scanning region f7170000...
Scanning region f7260000...
Scanning region f7350000...
Scanning region f7440000...
Scanning region f7530000...
Scanning region f7620000...
Scanning region f7710000...
Scanning region f7800000...
Scanning region f78f0000...
Scanning region f79e0000...
Scanning region f7ad0000...
Scanning region f7bc0000...
Scanning region f7cb0000...
Scanning region f7da0000...
Scanning region f7e90000...
Scanning region f7f80000...
Scanning region f8070000...
Scanning region f8160000...
Scanning region f8250000...
Scanning region f8340000...
Scanning region f8430000...
Scanning region f8520000...
Scanning region f8610000...
Scanning region f8700000...
Scanning region f87f0000...
Scanning region f88e0000...
Scanning region f89d0000...
Scanning region f8ac0000...
Scanning region f8bb0000...
Scanning region f8ca0000...
Scanning region f8d90000...
Scanning region f8e80000...
Scanning region f8f70000...
Scanning region f9060000...
Scanning region f9150000...
Scanning region f9240000...
Scanning region f9330000...
Scanning region f9420000...
Scanning region f9510000...
Scanning region f9600000...
Scanning region f96f0000...
Scanning region f97e0000...
Scanning region f98d0000...
Scanning region f99c0000...
Scanning region f9ab0000...
Scanning region f9ba0000...
Scanning region f9c90000...
Scanning region f9d80000...
Scanning region f9e70000...
Scanning region f9f60000...
Potential exploit area found at address f9fd6200:e00.
Exploiting device...

c:\tbolt2>[COLOR="red"]adb shell[/COLOR]
# [COLOR="Blue"]<-indicates that you have temp root access[/COLOR]

(ignore tbolt2,these are actually my thunderbolt directions )

if you get your "#" prompt,indicating temp root,type exit to get back to your miniadb_merge> prompt,and pickup the directions in the first post at:
adb push busybox /data/local

basically,youre just eliminating those first few lines that pertain to zergrush. once youve successfully downgraded,you can follow the directions exactly,as youre on older firmware where the exploits will work for sure.

hope that helps