[HOWTO] [root] Boost Mobile hTC One SV root *WITHOUT* overwriting recovery / kernel

Last Updated:

  1. ODGeek

    ODGeek Well-Known Member

    ...Your warranty is now void...I claim *NO* responsibility for bricked devices, etc. You have been warned!

    I wanted root on my new toy (Boost Mobile hTC One SV "K2_CL"). I also wanted to have an "untouched" backup of the stock ROM, kernel, recovery, etc. This is how I got it.

    This is my third hTC device, and I've rooted / installed custom ROMs on the other two devices (Virgin Mobile USA EVO V 4G & One V).

    Here are the basic steps. You'll need the following files:

    1) Unlock the hTC bootloader. This is standard for *ANY* hTC device. There are a number of other threads that cover this. It is no different for the Boost Mobile hTC One SV. Select the "Other Devices" on the htcdev.com web site when requesting the unlock token. See one of the following threads for a more detailed "HOW TO" for this step. At the end of this step, your phone will be restored to "factory stock". The unlocking process overwrites *ALL* data on the phone..

    At this point, I allowed the phone to boot until the unlock screen appeared. I waited 2-3 minutes then pulled the battery (Wanted to ensure I got an untouched Stock backup).

    While holding the volume-down button, press the power button. This will boot the phone into the bootloader/fastboot. Next, plug the phone into the computer. The phone should say "FASTBOOT USB" in red about 1/4 down.

    Finally, change to the directory where your adb/fastboot are located. Copy the recovery.img and Boost_kernel.img files from above into this directory.

    2) Boot the clockworkmod backup/recovery utility & create a backup of the original ROM (complete with stock recovery, kernel).

    With the phone in "FASTBOOT USB" mode, execute the following command:
    Code (Text):
    1. fastboot boot recoverytest.img
    This will boot the ClockworkMod recovery. (Seems like the I had to do this twice the first time. In spite of *NOT* changing boot nor recovery, my device says "TAMPERED" and "UNLOCKED".)

    This boots the ClockworkMod Recovery *WITHOUT* overwriting anything. Now, one can make a nandroid backup of the 'Stock' kernel / recovery / ROM.

    Note that this version of ClockworkMod has screen issues. It took 3-4 minutes to make the backup. I recommend copying the backup somewhere off the microSD card for safe keeping.

    3) Boot the kernel that allows one to write to /system (the Boost stock kernel has disabled write access to the /system partition). This kernel will allow su and Superuser.app to be installed, which makes the device "rooted". While this kernel is booted, one can also make any desired changes to /system, as well as install busybox, etc.

    Boot the device into the bootloader (power phone off, hold down Vol-down button & power button until screen comes up). Again, plug the phone into computer with USB cable. Execute the following command.

    Code (Text):
    1. fastboot boot Boost_kernel.img
    This will boot the phone with a modified kernel that allows /system to be remounted.

    You will need to unzip the Superuser-3.1.3-arm-signed.zip and get the su and Superuser.apk files. Copy them into the directory where you run adb or fastboot.

    The device will boot as normal, only with a message on the white hTC screen. You may need to go into developer settings and enable USB debugging.

    The following commands (you will type what appears in blue text below) will root the device (assuming su and Superuser.apk are in the directory you run fastboot & adb from). Note the $ and # characters are the prompt--do not type anything *BEFORE* those characters. The output is shown as it should appear on your screen...

    Code (Text):
    1. $ [COLOR=Blue]adb remount[/COLOR]
    2. remount succeeded
    3. $ [COLOR=Blue]adb push su /system/xbin/su[/COLOR]
    4. 2305 KB/s (380532 bytes in 0.161s)
    5. $ [COLOR=Blue]adb push Superuser.apk /system/app[/COLOR]
    6. 2596 KB/s (1468798 bytes in 0.552s)
    7. $ [COLOR=Blue]adb shell[/COLOR]
    8. root@android:/ # [COLOR=Blue]cd /system/bin[/COLOR]
    9. root@android:/system/bin # [COLOR=Blue]ln -s /system/xbin/su su[/COLOR]
    10. root@android:/system/bin # [COLOR=Blue]cd /system/xbin[/COLOR]
    11. root@android:/system/xbin # [COLOR=Blue]chmod 04755 su[/COLOR]
    12. root@android:/system/xbin # [COLOR=Blue]cd /system/app[/COLOR]
    13. root@android:/system/app # [COLOR=Blue]chmod 644 Superuser.apk
    14. [/COLOR]root@android:/system/app # [COLOR=Blue]exit[/COLOR]
    15. $
    At this point, you may do other 'root' things like install busybox, etc. All changes made to /system will 'stay' through a reboot. Rebooting the phone will allow the 'stock' kernel to be loaded--as such, you will not be able to make further changes to /system. The modified kernel may be booted (boot to fastboot, plug into computer & do a 'fastboot boot Boost_kernel.img' from the command line).

    At this point, you have a rooted device with stock kernel & recovery. Root apps such as Titanium backup, Power Toggles (if you copied the apk to /system/app), etc. should work. However, you have not changed the stock kernel & recovery partitions. You will need to boot the custom kernel (from your PC & fastboot) any time you want to change anything in /system.

    This is all I wanted to do with my 'rooting'. However, wanted to share how to root the device & leave it (mostly) stock...

    I have attempted to give credit where credit is due...If I forgot anyone, please let me know & I'll update the thread.

    irishobo, mgs376710, ladlr23 and 12 others like this.
  2. smith058

    smith058 Well-Known Member

    Great job!

    Maybe you can also give us a copy of stock boot and recovery for those of us that already missed the opportunity to make our own copy of stock :)
    That would be quite nice

    But once again.... GREAT JOB!!!
  3. shinru2004

    shinru2004 Well-Known Member Developer

    Very nice job, was unaware you could boot an external recovery/kernel without overwriting anything. Learn something new everyday lol.
    LilBit likes this.
  4. LilBit

    LilBit Well-Known Member Contributor

    I say that a lot here on the forums!!:D
  5. ODGeek

    ODGeek Well-Known Member

    Ask and ye shall receive:

    Boost Mobile Stock boot & recovery hTC one SV here... md5sums given below:

    • f0fd69458d686f97fd935cc821782181 boot.img (16777216 bytes)
    • aed45ae9bc7b00288796e7bb3a2334e5 recovery.img (16776704 bytes)
    Would recommend you test them with "fastboot boot <name>.img & make sure they are as intended (this is just what clockworkmod backed up)...You have been warned!

    These aren't the files you're looking for...Or perhaps they are...These are copied from the clockworkmod backup as-is..
    smith058 and Guspeed like this.
  6. Guspeed

    Guspeed Well-Known Member

    Thanks so much for this guide, I guess lots of us learned something new with your thread, THANK YOU!!!

    Any chance of sharing your stock backup of the original ROM (stock recovery, kernel) with us???

    I'm not sure if these img files are going to work, cuz you've pulled them out of a cwm backup, they're seem to be too big, again, not sure!!!
  7. ODGeek

    ODGeek Well-Known Member

    Just tried to fastboot boot them...Does not work...

    *RATS*!!! The nandroid must have backed up the wrong partitions & named them boot.img & recovery.img...

    Back to the drawing board...Anyone know which partitions the boot & recovery are on this device???

    Looked into this. According to "cat /proc/emmc", the partitions are as follows:

    boot : /dev/block/mmcblk0p20
    recovery: /dev/block/mmcblk0p21

    I've made copies of those partitions using dd, and the resulting files are the same size / md5sum as those copied from the nandroid backup. Something must be done to them to make them bootable/flashable from fastboot.

    This is beyond my knowledge set...I'm more a Linux/FreeBSD/MacOS expert...android is all new to me...Any ideas???
  8. Piratexi

    Piratexi Active Member

    So this isn't the stock kernel? Really need one lol
  9. shinru2004

    shinru2004 Well-Known Member Developer

    Stock Kernel should be 16mb i have it somewhere will post later.
  10. Mako 230

    Mako 230 Well-Known Member

    Ditto and thank you.
  11. ODGeek

    ODGeek Well-Known Member

    Would one restore it using dd from the phone command line? (i.e. the following):
    Code (Text):
    1. # cd /sdcard2
    2. # dd if=backup_boot.img of=/dev/block/mmcblk0p20 bs=4086
    I tried to "fastboot boot <backup_boot>.img" and the phone rejected it. I'm assuming that "fastboot flash boot <backup_boot>.img" would do the same thing?

    Just curious...
  12. Mikessv

    Mikessv Well-Known Member

    It didn't work for me either. Neither the Recovery or the Boot image.
  13. dbertles

    dbertles Member

    I was trying this process and messed things up. I'm looking for the stock ROM, kernel, recovery, etc.. Do you still have those files that I could get copies of or know where I can get them?

    My phone is working but giving me errors:
    Boost K2_CL S-ON
    HTC One SV LTE
    Model C535c
    CDMA - eHRPD

  14. Mikessv

    Mikessv Well-Known Member

    I have both on dropbox if you want them.
    dbertles likes this.
  15. dbertles

    dbertles Member

    Try as I might, this does not allow my phone to be remounted. My phone says it is TAMPERED and UNLOCKED.

    I've tried other ADB commands as well to mount my system r/w and I keep getting "now allowed" or "Permission denied"

    Any other ideas?

  16. dbertles

    dbertles Member

    I would love them. Do you have a link or do you need my email address?
  17. Mikessv

    Mikessv Well-Known Member

    Kreatur3 and irishobo like this.
  18. dbertles

    dbertles Member

  19. svz235

    svz235 Well-Known Member

    Does the poot method work too in rooting this phone?
  20. i2f

    i2f Well-Known Member

    wyelkins, wetbiker7 and irishobo like this.
  21. wetbiker7

    wetbiker7 Well-Known Member Contributor

    Looks good. I went ahead and installed HTC Sync and fastboot and ADB are working fine. The only problem I'm having with HTC Sync is a java error. It will start when I plug the phone in but then the error pops up and the app closes. Oh well, the drivers are working so that's cool. I really don't use the sync anyway.

    UPDATE: removed HTC Sync but kept the drivers for the phone. Fastboot is working fine. BEGONE HTC SYNC!
  22. bluebellmaniac

    bluebellmaniac New Member

    I had my SV rooted thanks to this thread and all was running just fine. I received a system update from Boost this morning. Afterwards I appeared to have lost root. I then started with these instructions again, starting at #2. #2 ran fine, but when I run #4: fastboot boot Boost_kernel.img the phone turns off and doesn't come back on.

    Is anyone else seeing this?

    Anyone else get the Boost system update on 7/15/13?

  23. irishobo

    irishobo Well-Known Member

    Do you still have custom recovery? Are you s off? Does the phone boot or where does it hang up at?
  24. ODGeek

    ODGeek Well-Known Member

    The original post has a link for an ice cream sandwich (ICS) kernel. You need a jelly bean (JB) kernel. I used the one from shinru2004's " Boost Mobile Android 4.1 update (Download Up)" posting. I suppose the " [K2_CL JB] Official OTA - Modded Zip for your flashing pleasure " one will work, too...Just extract boot.img & use that kernel instead.

    I used Moonshine s-off for k2_cl [BOOST] to S-OFF my phone *BEFORE* I allowed it to apply the "stock" OTA upgrade. The upgrade re-locked my phone. I see they have an S-Off for the Boost JB rom version...I haven't heard if/whether anyone has had success with that...The ICS version worked flawlessly on our 2 hTC One SV's *BEFORE* the OTA applied.

    After the upgrade (and re-rooting), it seems the "stock" kernel allows me to remount /system rw, and for changes to the system to persist across reboots. Is this because the JB upgrade kernel doesn't disable rw on /system, or is this because my handset is now S-OFF?

    Anyway, the steps in #4 (i.e. booting the non-stock kernel) were only necessary to get /system mounted rw so that it could be changed (and root, busybox, etc installed).

    Oh yeah, I used [TWRP 2.6] All variants TWRP recovery 2.6 to backup/restore/re-root my phone after the OTA upgrade installed. I did not "fastboot flash recovery TWRP_file_here" that, but rather "fastboot boot TWRP_file_here" to boot & use TWRP without overwriting stock...
    bluebellmaniac likes this.
  25. o_splatterhand

    o_splatterhand Well-Known Member

    Because you are S-Off.
    ODGeek likes this.

Share This Page