• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root [HOWTO] [root] Boost Mobile hTC One SV root *WITHOUT* overwriting recovery / kernel

ODGeek

Well-Known Member
Sep 25, 2011
155
52
...Your warranty is now void...I claim *NO* responsibility for bricked devices, etc. You have been warned!

I wanted root on my new toy (Boost Mobile hTC One SV "K2_CL"). I also wanted to have an "untouched" backup of the stock ROM, kernel, recovery, etc. This is how I got it.

This is my third hTC device, and I've rooted / installed custom ROMs on the other two devices (Virgin Mobile USA EVO V 4G & One V).

Here are the basic steps. You'll need the following files:


1) Unlock the hTC bootloader. This is standard for *ANY* hTC device. There are a number of other threads that cover this. It is no different for the Boost Mobile hTC One SV. Select the "Other Devices" on the htcdev.com web site when requesting the unlock token. See one of the following threads for a more detailed "HOW TO" for this step. At the end of this step, your phone will be restored to "factory stock". The unlocking process overwrites *ALL* data on the phone..

At this point, I allowed the phone to boot until the unlock screen appeared. I waited 2-3 minutes then pulled the battery (Wanted to ensure I got an untouched Stock backup).


While holding the volume-down button, press the power button. This will boot the phone into the bootloader/fastboot. Next, plug the phone into the computer. The phone should say "FASTBOOT USB" in red about 1/4 down.


Finally, change to the directory where your adb/fastboot are located. Copy the recovery.img and Boost_kernel.img files from above into this directory.


2) Boot the clockworkmod backup/recovery utility & create a backup of the original ROM (complete with stock recovery, kernel).

With the phone in "FASTBOOT USB" mode, execute the following command:
Code:
fastboot boot recoverytest.img
This will boot the ClockworkMod recovery. (Seems like the I had to do this twice the first time. In spite of *NOT* changing boot nor recovery, my device says "TAMPERED" and "UNLOCKED".)

This boots the ClockworkMod Recovery *WITHOUT* overwriting anything. Now, one can make a nandroid backup of the 'Stock' kernel / recovery / ROM.

Note that this version of ClockworkMod has screen issues. It took 3-4 minutes to make the backup. I recommend copying the backup somewhere off the microSD card for safe keeping.

3) Boot the kernel that allows one to write to /system (the Boost stock kernel has disabled write access to the /system partition). This kernel will allow su and Superuser.app to be installed, which makes the device "rooted". While this kernel is booted, one can also make any desired changes to /system, as well as install busybox, etc.

Boot the device into the bootloader (power phone off, hold down Vol-down button & power button until screen comes up). Again, plug the phone into computer with USB cable. Execute the following command.

Code:
fastboot boot Boost_kernel.img
This will boot the phone with a modified kernel that allows /system to be remounted.

You will need to unzip the Superuser-3.1.3-arm-signed.zip and get the su and Superuser.apk files. Copy them into the directory where you run adb or fastboot.

The device will boot as normal, only with a message on the white hTC screen. You may need to go into developer settings and enable USB debugging.

The following commands (you will type what appears in blue text below) will root the device (assuming su and Superuser.apk are in the directory you run fastboot & adb from). Note the $ and # characters are the prompt--do not type anything *BEFORE* those characters. The output is shown as it should appear on your screen...

Code:
$ [COLOR=Blue]adb remount[/COLOR]
remount succeeded
$ [COLOR=Blue]adb push su /system/xbin/su[/COLOR]
2305 KB/s (380532 bytes in 0.161s)
$ [COLOR=Blue]adb push Superuser.apk /system/app[/COLOR]
2596 KB/s (1468798 bytes in 0.552s)
$ [COLOR=Blue]adb shell[/COLOR]
root@android:/ # [COLOR=Blue]cd /system/bin[/COLOR]
root@android:/system/bin # [COLOR=Blue]ln -s /system/xbin/su su[/COLOR]
root@android:/system/bin # [COLOR=Blue]cd /system/xbin[/COLOR]
root@android:/system/xbin # [COLOR=Blue]chmod 04755 su[/COLOR]
root@android:/system/xbin # [COLOR=Blue]cd /system/app[/COLOR]
root@android:/system/app # [COLOR=Blue]chmod 644 Superuser.apk
[/COLOR]root@android:/system/app # [COLOR=Blue]exit[/COLOR]
$
At this point, you may do other 'root' things like install busybox, etc. All changes made to /system will 'stay' through a reboot. Rebooting the phone will allow the 'stock' kernel to be loaded--as such, you will not be able to make further changes to /system. The modified kernel may be booted (boot to fastboot, plug into computer & do a 'fastboot boot Boost_kernel.img' from the command line).

At this point, you have a rooted device with stock kernel & recovery. Root apps such as Titanium backup, Power Toggles (if you copied the apk to /system/app), etc. should work. However, you have not changed the stock kernel & recovery partitions. You will need to boot the custom kernel (from your PC & fastboot) any time you want to change anything in /system.

This is all I wanted to do with my 'rooting'. However, wanted to share how to root the device & leave it (mostly) stock...

I have attempted to give credit where credit is due...If I forgot anyone, please let me know & I'll update the thread.
 
Great job!

Maybe you can also give us a copy of stock boot and recovery for those of us that already missed the opportunity to make our own copy of stock :)
That would be quite nice

But once again.... GREAT JOB!!!

Ask and ye shall receive:

Boost Mobile Stock boot & recovery hTC one SV here... md5sums given below:

  • f0fd69458d686f97fd935cc821782181 boot.img (16777216 bytes)
  • aed45ae9bc7b00288796e7bb3a2334e5 recovery.img (16776704 bytes)
Would recommend you test them with "fastboot boot <name>.img & make sure they are as intended (this is just what clockworkmod backed up)...You have been warned!

Edit:
These aren't the files you're looking for...Or perhaps they are...These are copied from the clockworkmod backup as-is..
 
Upvote 0
Thanks so much for this guide, I guess lots of us learned something new with your thread, THANK YOU!!!

Any chance of sharing your stock backup of the original ROM (stock recovery, kernel) with us???

Edit:
I'm not sure if these img files are going to work, cuz you've pulled them out of a cwm backup, they're seem to be too big, again, not sure!!!
 
Upvote 0
Edit:
I'm not sure if these img files are going to work, cuz you've pulled them out of a cwm backup, they're seem to be too big, again, not sure!!!

Just tried to fastboot boot them...Does not work...

*RATS*!!! The nandroid must have backed up the wrong partitions & named them boot.img & recovery.img...

Back to the drawing board...Anyone know which partitions the boot & recovery are on this device???

Edit:
Looked into this. According to "cat /proc/emmc", the partitions are as follows:

boot : /dev/block/mmcblk0p20
recovery: /dev/block/mmcblk0p21

I've made copies of those partitions using dd, and the resulting files are the same size / md5sum as those copied from the nandroid backup. Something must be done to them to make them bootable/flashable from fastboot.

This is beyond my knowledge set...I'm more a Linux/FreeBSD/MacOS expert...android is all new to me...Any ideas???
 
Upvote 0
Ask and ye shall receive:

Boost Mobile Stock boot & recovery hTC one SV here... md5sums given below:

  • f0fd69458d686f97fd935cc821782181 boot.img (16777216 bytes)
  • aed45ae9bc7b00288796e7bb3a2334e5 recovery.img (16776704 bytes)
Would recommend you test them with "fastboot boot <name>.img & make sure they are as intended (this is just what clockworkmod backed up)...You have been warned!

Edit:
These aren't the files you're looking for...Or perhaps they are...These are copied from the clockworkmod backup as-is..

So this isn't the stock kernel? Really need one lol
 
Upvote 0
Just tried to fastboot boot them...Does not work...

*RATS*!!! The nandroid must have backed up the wrong partitions & named them boot.img & recovery.img...

Back to the drawing board...Anyone know which partitions the boot & recovery are on this device???

Edit:
Looked into this. According to "cat /proc/emmc", the partitions are as follows:

boot : /dev/block/mmcblk0p20
recovery: /dev/block/mmcblk0p21

I've made copies of those partitions using dd, and the resulting files are the same size / md5sum as those copied from the nandroid backup. Something must be done to them to make them bootable/flashable from fastboot.

This is beyond my knowledge set...I'm more a Linux/FreeBSD/MacOS expert...android is all new to me...Any ideas???

Stock Kernel should be 16mb i have it somewhere will post later.
 
Upvote 0
Stock Kernel should be 16mb i have it somewhere will post later.

Would one restore it using dd from the phone command line? (i.e. the following):
Code:
# cd /sdcard2
# dd if=backup_boot.img of=/dev/block/mmcblk0p20 bs=4086
I tried to "fastboot boot <backup_boot>.img" and the phone rejected it. I'm assuming that "fastboot flash boot <backup_boot>.img" would do the same thing?

Just curious...
 
Upvote 0
...I wanted root on my new toy (Boost Mobile hTC One SV "K2_CL"). I also wanted to have an "untouched" backup of the stock ROM, kernel, recovery, etc. ...

I was trying this process and messed things up. I'm looking for the stock ROM, kernel, recovery, etc.. Do you still have those files that I could get copies of or know where I can get them?

My phone is working but giving me errors:
Boost K2_CL S-ON
HTC One SV LTE
Model C535c
CDMA - eHRPD

Thanks!
 
Upvote 0
I was trying this process and messed things up. I'm looking for the stock ROM, kernel, recovery, etc.. Do you still have those files that I could get copies of or know where I can get them?

My phone is working but giving me errors:
Boost K2_CL S-ON
HTC One SV LTE
Model C535c
CDMA - eHRPD

Thanks!

I have both on dropbox if you want them.
 
  • Like
Reactions: dbertles
Upvote 0
Code:
fastboot boot Boost_kernel.img
This will boot the phone with a modified kernel that allows /system to be remounted.

Try as I might, this does not allow my phone to be remounted. My phone says it is TAMPERED and UNLOCKED.

I've tried other ADB commands as well to mount my system r/w and I keep getting "now allowed" or "Permission denied"

Any other ideas?

Dan
 
Upvote 0
Upvote 0
Looks good. I went ahead and installed HTC Sync and fastboot and ADB are working fine. The only problem I'm having with HTC Sync is a java error. It will start when I plug the phone in but then the error pops up and the app closes. Oh well, the drivers are working so that's cool. I really don't use the sync anyway.

UPDATE: removed HTC Sync but kept the drivers for the phone. Fastboot is working fine. BEGONE HTC SYNC!
 
Upvote 0
I had my SV rooted thanks to this thread and all was running just fine. I received a system update from Boost this morning. Afterwards I appeared to have lost root. I then started with these instructions again, starting at #2. #2 ran fine, but when I run #4: fastboot boot Boost_kernel.img the phone turns off and doesn't come back on.

Is anyone else seeing this?

Anyone else get the Boost system update on 7/15/13?

Thanks!
 
Upvote 0
I had my SV rooted thanks to this thread and all was running just fine. I received a system update from Boost this morning. Afterwards I appeared to have lost root. I then started with these instructions again, starting at #2. #2 ran fine, but when I run #4: fastboot boot Boost_kernel.img the phone turns off and doesn't come back on.

Is anyone else seeing this?

Anyone else get the Boost system update on 7/15/13?

Thanks!

Do you still have custom recovery? Are you s off? Does the phone boot or where does it hang up at?
 
Upvote 0
I had my SV rooted thanks to this thread and all was running just fine. I received a system update from Boost this morning. Afterwards I appeared to have lost root. I then started with these instructions again, starting at #2. #2 ran fine, but when I run #4: fastboot boot Boost_kernel.img the phone turns off and doesn't come back on.

Is anyone else seeing this?

Anyone else get the Boost system update on 7/15/13?

Thanks!

The original post has a link for an ice cream sandwich (ICS) kernel. You need a jelly bean (JB) kernel. I used the one from shinru2004's " Boost Mobile Android 4.1 update (Download Up)" posting. I suppose the " [K2_CL JB] Official OTA - Modded Zip for your flashing pleasure " one will work, too...Just extract boot.img & use that kernel instead.

I used Moonshine s-off for k2_cl [BOOST] to S-OFF my phone *BEFORE* I allowed it to apply the "stock" OTA upgrade. The upgrade re-locked my phone. I see they have an S-Off for the Boost JB rom version...I haven't heard if/whether anyone has had success with that...The ICS version worked flawlessly on our 2 hTC One SV's *BEFORE* the OTA applied.

After the upgrade (and re-rooting), it seems the "stock" kernel allows me to remount /system rw, and for changes to the system to persist across reboots. Is this because the JB upgrade kernel doesn't disable rw on /system, or is this because my handset is now S-OFF?

Anyway, the steps in #4 (i.e. booting the non-stock kernel) were only necessary to get /system mounted rw so that it could be changed (and root, busybox, etc installed).

Oh yeah, I used [TWRP 2.6] All variants TWRP recovery 2.6 to backup/restore/re-root my phone after the OTA upgrade installed. I did not "fastboot flash recovery TWRP_file_here" that, but rather "fastboot boot TWRP_file_here" to boot & use TWRP without overwriting stock...
 
  • Like
Reactions: bluebellmaniac
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones