root,s-off,simunlock,superCID htc merge


  1. scotty85

    scotty85 Guides Guide

    *read this as many have noticed,multiupload has effed it up for us. :mad: im in the process of mirroring all files,starting with the basics and downgrade RUU,then the upgrade RUUs. since free time is limited and uploads are slow,please bear with me. if youd like a specific upgrade ruu,please PM me,or post at the end of the thread and ill move it up to the top of the priority list.

    sorry for the inconvenience. :(
    _________________________________________________________________
    this is a guide to root the htc merge. there are a couple out there allready,all ive done is try and simply the process,i take no credit for any of this. this is geared toward folks who are somewhat overwhelmed at the thot of setting up the android SDK and adb.

    it should work on froyo or gingerbread,on any carrier,with the creation of a gold card.

    *DISCLAIMER im not responsible if your phone melts,explodes,or becomes otherwise unuseable :eek: ;)

    *WARNING this will wipe your data

    *DISCLAIMER(READ THIS!) flashing a different carriers stock software and firmware can potentially destroy APN and other settings that make multi-media messages and mobile data work. it can be difficult to restore these settings to make the device function normally on that service. i have not had any trouble whatsoever using any of the ruus on verizon,and usc users do not seem to have trouble either. smaller carriers such as bluegrass wireless and nTelos are more likely to encounter these issues. we are working on resolving these issues,but please proceede with caution.

    first and foremost to give credit where credit is due:
    -drellisdee on xda for figuring out how to downgrade to s-offable vzw firmware. check out his original thread here where 95% of the links,code,and files came from. please donate to him so he can continue developing for the merge.
    -alpharev/unrevoked for their zergRush temp root tool and everything they do for the root community
    -Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2 without these s-off for lexikon wouldn't have been possible. special thanks to them.
    -sele and the crew in the "rescue squad" on the thunderbolt forum for what i like to call the "mini-adb" concept.
    -B Rich for being the first tester
    -chill0398 for providing images for the bluegrass wireless firmware
    -prolly more,that ill add as i think of them.


    1)make a goldcard. this is neccessary in order to flash a different carriers RUU. you can skip this step if your merge happens to be a verizon model.
    directions can be found here
    use the app goldcard helper from market. if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.


    2)download these files
    -miniadb_merge_updated contains neccessary root files and some adb tools
    Multiupload.com - upload your files to multiple file hosting sites!
    md5:04020226dcba83470e0f0bb527983130
    mirror: http://www.mediafire.com/?f6pxu06p1vfccby
    mirror md5: 8450a229737f6e467dc4cf3260129b00 (mirror updated)
    -VZW leak 1.23.605.1 ruu.zip leaked,exploitable RUU. named rom.zip
    xda-developers - View Single Post - [RUU] HTC Lexikon 1.23.605.1 from Verizon [Leak]
    mirror:/PD42IMG-vzw-leak
    md5: 6d37a0f3526295ebb779f4465a328c96
    -merge_eng_su_toolkit
    signed_merge_su_eng_toolkit.zip
    mirror: http://www.mediafire.com/?wrkpcx3hn6fc56c
    md5: accc46ee4260a4853ecafc97b512f623
    modified HTC drivers from http://unrevoked.com/rootwiki/doku.php/public/revolutionary

    3)choose and download a custom upgrade RUU
    *special note: if your current firmware and carrier is not one of these, you will need to substitute step 5 in this post,for the one in the second post,so you have backups of the important images to make an upgrade and stock RUU.

    *us cellular:
    froyo(2.04.573.2)
    USC-FROYO-2.04.573.2
    md5: eded6cd618b167494d2d0356f844b780

    gingerbread(3.10.573.1)
    USC-GB-3.10.573.1
    mirror: md5: [COLOR="red"]51cc65a61d6cd19b...2IMGcustomAlltel.zip"]alltel-FROYO-2.04.671.1
    md5: 0d4ba05cf110e7b56a03dcea9e90b479

    *us south cellular:
    froyo(2.04.573.3)
    USSC-FROYO-2.04.573.3
    mirror:
    md5: 1fa5d85bd39f8cdff1cf9fc0b71a24c1

    *verizon:
    froyo(1.49.605.1)
    VZW-FROYO-1.49.605.1
    mirror:
    md5: 85ea6fa8c8204b5c27f1e017c3e04f7e

    *bluegrass wireless
    froyo(2.05.557.03)
    BLUEGRASS-FROYO-2.05.557.03
    md5: a903e463f71fef87843cb5a9523de33d

    *nTelos wireless
    gingerbread(3.08.557.1)
    nTelos-GB-3.08.557.1
    md5: 86eb8204e0db9f812ff1e65c94c4941e


    *additional merge files
    engineering bootloader http://www.mediafire.com/?ojnnh6w7ap6xmog
    md5: 957c34ce63f386099f90a2b5c60d8c7d

    Amon recovery (in case you need to flash recovery after running a stock RUU)
    PD42IMG_lexikon_ra_3.04.zip
    mirror: http://www.mediafire.com/?4ihomf1b6dd49d6
    md5: e7ae3aefc7f1235043fff8c4692e6704

    superuser 3.0.7
    Superuser-3.0.7-efgh-signed
    md5: a5d14dc42323a61caf71549a885af8c3
    *flash this updated superuser if for some reason you have trouble with the merge toolkit superuser

    stock 1.49.605.1 (in case you need it for "back to stock" purposes,its not officially available)
    stock-1.49.605.1
    md5: 6af0bcb7f90c10b718f2c80484e355d3

    stock 2.05.557.03 (in case you need it for "back to stock" purposes,its not officially available)
    stock-bluegrass-2.05.557.3
    md5: 3aa77a14b989d6bdacf8ce3b11b0bae0

    stock nTelos 3.08.557.1
    to be added later
    md5: 5b63e00a0de1c676c6909b48631d949c


    team win recovery v2.0 for merge: http://teamw.in/project/twrp2/84

    **make sure to check the md5 sums match those listed!**
    if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer check it on your phone with scary aliens AFV


    4)prepare to downgrade
    -extract the miniadb_merge.zip place the extracted folder on the root of your c\ drive. it contains the exploits,the misc downgrade image,and some adb tools.
    -install the drivers linked above by running the .exe file. alternatively,htc sync drivers may work also.
    -place the downgrade leak ruu on the root of your gold card and rename PD42IMG. now is a good time to verify that your gold card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PD42IMG unless your card is formatted to FAT 32,and the file is correctly named.
    -if you were using a card reader to do the above step,power off and insert the gold card into your phone.


    5)downgrade with adb. make sure your phone is charged to 100% before starting.
    -on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

    -make sure phone is plugged in and usb debugging checked on in charge only mode

    -at the promt in your command window:


    cd c:\miniadb_merge this should change your command promt to "miniadb_merge>",indicating youre using that directory.
    adb devices this should output your phones serial number,indicating its recognized

    adb push zergRush /data/local/
    adb shell this will change your promt to a $
    chmod 755 /data/local/zergRush
    /data/local/zergRush

    this will cause zergRush to start,and it shoudl say "found a gingerbread!" or "found a froyo!" followed by a bunch of other funny stuff.

    last thing it says will be: Killing ADB and restarting as root... enjoy!

    you should then be returned to your "miniadb_merge>" prompt


    adb push busybox /data/local

    adb shell this should change your promt to a #

    chmod 0755 /data/local/busybox

    Next we backup our existing misc partition:
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /dev/block/mmcblk0p17


    Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17

    exit to get back to miniadb_merge> prompt

    reflash the misc image to allow donwgrading to older firmware:
    adb push misc-downgrade.img /sdcard/
    adb shell
    dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
    sync


    now you can flash the exploitable vzw firmware

    exit to get back to the miniadb_merge> promt

    adb reboot bootloader this will boot your phone into fastboot. press "power" to select bootloader

    assuming you have made your gold card and preformed the above steps correctly,you should see a status bar as the phone checks the downgrade RUU,then asks to update. choose yes and allow the update. if this is the first time youve ever flashed an RUU in hboot,dont panic,it will take a few minutes.


    6)gain s-off,simunlock,and superCID: once the 1.23.605.1 firmware is up and running,skip past the set up stuff,re-enable usb debugging.place your phone in disk drive mode,and replace the PD42IMG with your custom upgrade ruu. rename the custom RUU to "PD42IMG".

    place your phone back in charge only mode,then in the command window:

    adb push psneuter /data/local/
    adb push busybox /data/local/
    adb push wpthis /data/local/
    adb push gfree /data/local/
    adb shell
    chmod 0755 /data/local/psneuter
    chmod 0755 /data/local/wpthis
    chmod 0755 /data/local/gfree
    /data/local/psneuter
    (to get temp root again)

    adb shell

    /data/local/wpthis
    (to disable emmc write protect)
    /data/local/gfree -f (this will supercid, simunlock, and s-off phone)

    exit to get back to your miniadb_merge> prompt


    7)upgrade and root:

    adb reboot bootloader to boot to fastboot. select bootloader with the power button

    assuming you have preformed the above steps correctly,your hboot should now say s-off,and hboot will find your custom upgrade ruu and allow it to flash. when it finishes,reboot. if this is the rom you plan to stay on,feel free to go ahead and set it up. immediately plug your phone in and remove PD42IMG from your sd card,and replace it with the merge_su_eng_toolkit.

    if you used the vzw custom ruu,you are finished,as this one is pre-rooted. youll find superuser is allready working and in your app drawer :) for the rest of you,when youre ready to root,power off,then into hboot by holding volume down/power. select recovery with the volume rocker and power button. after a couple minutes this should take you to Amon_Ra recovery. using the volume rocker and power buttons,make a backup of your unrooted firmware(just in case ;)). now flash the merge_su_eng_toolkit in recovery. when it finishes,reboot.

    congratulations,you are now S-off,sim unlocked,superCIDed,and rooted. :)


    8)restore your stock misc image: after booting to your current carrier firmware,and flashing merge_eng_su_toolkit:

    open your command window,and cd c:\miniadb_merge
    then:
    adb devices
    adb shell this will change your promt to a $
    su the superuser app should pop up on your phone. make sure "always" is checked,and touch "allow".
    dd if=/sdcard/misc-stock.img of=/dev/block/mmcblk0p17
    sync


    *note- you technically are now done needing a gold card,as your phone is "superCIDed" and will happily flash other carriers RUUs if you wish. so you can replace the gold card with your normal sd card if you want to.
    __________________________________________________________________________________
    here are copies of my ADB sessions. hopefully its a little less scary to know what the outputs look like for the commands you enter.
    the red are my inputs,the blue are additional comments
    step 5 session(downgrading to exploitable vzw firmware)
    Code (Text):
    1. Microsoft Windows [Version 6.1.7601]
    2. Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    3.  
    4. C:\Users\Scott>[COLOR="Red"]cd c:\miniadb_merge[/COLOR]
    5.  
    6. c:\miniadb_merge>[COLOR="red"]adb devices[/COLOR]
    7. List of devices attached
    8. HT18YM800022    device
    9.  
    10.  
    11. c:\miniadb_merge>[COLOR="red"]adb push zergRush /data/local/[/COLOR]
    12. 1324 KB/s (23060 bytes in 0.017s)
    13.  
    14. c:\miniadb_merge>[COLOR="red"]adb shell[/COLOR]
    15. $ [COLOR="red"]chmod 755 /data/local/zergRush[/COLOR]
    16. chmod 755 /data/local/zergRush
    17. $[COLOR="red"] /data/local/zergRush[/COLOR]
    18. /data/local/zergRush
    19.  
    20. [**] Zerg rush - Android 2.2/2.3 local root
    21. [**] (C) 2011 Revolutionary. All rights reserved.
    22.  
    23. [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
    24.  
    25. [+] Found a GingerBread ! 0x00000118
    26. [*] Scooting ...
    27. [*] Sending 149 zerglings ...
    28. [+] Zerglings found a way to enter ! 0x10
    29. [+] Overseer found a path ! 0x000161e0
    30. [*] Sending 149 zerglings ...
    31. [+] Zerglings caused crash (good news): 0x401219c4 0x0054
    32. [*] Researching Metabolic Boost ...
    33. [+] Speedlings on the go ! 0xafd1997b 0xafd39a97
    34. [*] Popping 24 more zerglings
    35. [*] Sending 173 zerglings ...
    36.  
    37. [+] Rush did it ! It's a GG, man !
    38. [+] Killing ADB and restarting as root... enjoy!
    39.  
    40. c:\miniadb_merge>[COLOR="red"]adb push busybox /data/local[/COLOR]
    41. 1272 KB/s (1062992 bytes in 0.816s)
    42.  
    43. c:\miniadb_merge>[COLOR="red"]adb shell[/COLOR]
    44. # [COLOR="red"]chmod 0755 /data/local/busybox[/COLOR]
    45. chmod 0755 /data/local/busybox
    46. # [COLOR="red"]dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096[/COLOR]
    47. dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    48. 64+0 records in
    49. 64+0 records out
    50. 262144 bytes transferred in 0.024 secs (10922666 bytes/sec)
    51. #[COLOR="red"] /data/local/busybox md5sum /sdcard/misc-stock.img[/COLOR]
    52. /data/local/busybox md5sum /sdcard/misc-stock.img
    53. 16321e08ca123985657d70d152131f6a  /sdcard/misc-stock.img
    54. # [COLOR="red"]/data/local/busybox md5sum /dev/block/mmcblk0p17[/COLOR]
    55. /data/local/busybox md5sum /dev/block/mmcblk0p17
    56. 16321e08ca123985657d70d152131f6a  /dev/block/mmcblk0p17
    57. # [COLOR="red"]exit[/COLOR]
    58. exit
    59.  
    60. c:\miniadb_merge>[COLOR="red"]adb push misc-downgrade.img /sdcard/[/COLOR]
    61. 1153 KB/s (262144 bytes in 0.222s)
    62.  
    63. c:\miniadb_merge>[COLOR="red"]adb shell[/COLOR]
    64. # [COLOR="Red"]dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17[/COLOR]
    65. dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
    66. 512+0 records in
    67. 512+0 records out
    68. 262144 bytes transferred in 0.130 secs (2016492 bytes/sec)
    69. # [COLOR="red"]sync[/COLOR]
    70. sync
    71. # [COLOR="red"]exit[/COLOR]
    72. exit
    73.  
    74. c:\miniadb_merge>adb reboot bootloader
    75. [COLOR="Blue"]*at this point your phone should boot to "fastboot". select bootloader with power button. you should not see a status bar as the phone checks the downgrade file. assuming the above steps were performed correctly,and gold card was made correctly,next thing youll see is an update prompt. allow the update.[/COLOR]
    76. c:\miniadb_merge>
    77.  
    step 6 session(gain s-off,superCID,and sim unlock in exploitable firmware):
    Code (Text):
    1. c:\miniadb_merge>[COLOR="Red"]adb devices[/COLOR]
    2. List of devices attached
    3. HT18YM800022    device
    4.  
    5.  
    6. c:\miniadb_merge>[COLOR="red"]adb push psneuter /data/local/[/COLOR]
    7. 1147 KB/s (585731 bytes in 0.498s)
    8.  
    9. c:\miniadb_merge>[COLOR="red"]adb push busybox /data/local/[/COLOR]
    10. 1614 KB/s (1062992 bytes in 0.643s)
    11.  
    12. c:\miniadb_merge>[COLOR="red"]adb push wpthis /data/local/[/COLOR]
    13. 1556 KB/s (679475 bytes in 0.426s)
    14.  
    15. c:\miniadb_merge>[COLOR="red"]adb push gfree /data/local/[/COLOR]
    16. 972 KB/s (134401 bytes in 0.135s)
    17.  
    18. c:\miniadb_merge>[COLOR="red"]adb shell[/COLOR]
    19. $ [COLOR="red"]chmod 0755 /data/local/psneuter[/COLOR]
    20. chmod 0755 /data/local/psneuter
    21. $ [COLOR="red"]chmod 0755 /data/local/wpthis[/COLOR]
    22. chmod 0755 /data/local/wpthis
    23. $ [COLOR="red"]chmod 0755 /data/local/gfree[/COLOR]
    24. chmod 0755 /data/local/gfree
    25. $[COLOR="red"] /data/local/psneuter[/COLOR]
    26.  
    27. c:\miniadb_merge>[COLOR="red"]adb shell[/COLOR]
    28. # [COLOR="red"]/data/local/wpthis[/COLOR]
    29. /data/local/wpthis
    30. Build: 25
    31. Section header entry size: 40
    32. Number of section headers: 45
    33. Total section header table size: 1800
    34. Section header file offset: 0x00014e90 (85648)
    35. Section index for section name string table: 42
    36. String table offset: 0x00014cc7 (85191)
    37. Searching for .modinfo section...
    38.  - Section[16]: .modinfo
    39.  -- offset: 0x00000f80 (3968)
    40.  -- size: 0x000000c4 (196)
    41. Kernel release: 2.6.32.17-g788be6b3
    42. New .modinfo section size: 204
    43. Loading module... OK.
    44. Write protect disabled.
    45. Searching for mmc_blk_issue_rq symbol...
    46.  - Address: c02a2884, type: t, name: mmc_blk_issue_rq, module: N/A
    47. Kernel map base: 0xc02a2000
    48. Kernel memory mapped to 0x40001000
    49. Searching for brq filter...
    50.  - Address: 0xc02a2884 + 0x34c
    51.  - 0x2a000012 -> 0xea000012
    52. Done.
    53. # [COLOR="red"]/data/local/gfree -f[/COLOR]
    54. /data/local/gfree -f
    55. --secu_flag off set
    56. --cid set. CID will be changed to: 11111111
    57. --sim_unlock. SIMLOCK will be removed
    58. Section header entry size: 40
    59. Number of section headers: 44
    60. Total section header table size: 1760
    61. Section header file offset: 0x000138b4 (80052)
    62. Section index for section name string table: 41
    63. String table offset: 0x000136fb (79611)
    64. Searching for .modinfo section...
    65.  - Section[16]: .modinfo
    66.  -- offset: 0x00000a14 (2580)
    67.  -- size: 0x000000cc (204)
    68. Kernel release: 2.6.32.17-g788be6b3
    69. New .modinfo section size: 204
    70. Attempting to power cycle eMMC... OK.
    71. Searching for mmc_blk_issue_rq symbol...
    72.  - Address: c02a2884, type: t, name: mmc_blk_issue_rq, module: N/A
    73. Kernel map base: 0xc02a2000
    74. Kernel memory mapped to 0x40000000
    75. Searching for brq filter...
    76.  - Address: 0xc02a2884 + 0x34c
    77.  - ***WARNING***: Found fuzzy match for brq filter, but conditional branch isn't
    78. . (0xea000012)
    79. Patching and backing up partition 7...
    80. patching secu_flag: 0
    81. Done.
    82. # [COLOR="Red"]exit[/COLOR]
    83. exit
    84.  
    85. c:\miniadb_merge>[COLOR="red"]adb reboot bootloader[/COLOR]
    86. [COLOR="Blue"]as before,you should now boot to fastboot. select bootloader with the power button. allow your upgrade to flash[/COLOR]
    87. c:\miniadb_merge>
    88.  
    donate to my device fund :)
    [​IMG]

    Advertisement
  2. scotty85

    scotty85 Guides Guide

    alternate step 5) if you need to back up partitions becasue your build number does not exist as an RUU

    5)downgrade with adb. make sure your phone is charged to 100% before starting.
    -on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

    -make sure phone is plugged in and usb debugging checked on in charge only mode

    -at the promt in your command window:


    cd c:\miniadb_merge this should change your command promt to "miniadb_merge>",indicating youre using that directory.
    adb devices this should output your phones serial number,indicating its recognized

    adb push zergRush /data/local/
    adb shell this will change your promt to a $
    chmod 755 /data/local/zergRush
    /data/local/zergRush

    this will cause zergRush to start,and it shoudl say "found a gingerbread!" or "found a froyo!" followed by a bunch of other funny stuff.

    last thing it says will be: Killing ADB and restarting as root... enjoy!

    you should then be returned to your "miniadb_merge>" prompt


    adb push busybox /data/local

    adb shell this should change your promt to a #

    chmod 0755 /data/local/busybox

    back up the system image:
    dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096

    /data/local/busybox md5sum /sdcard/system.img
    /data/local/busybox md5sum /dev/block/mmcblk0p25

    *make sure numbers match

    back up the boot image:
    dd if=/dev/block/mmcblk0p22 of=/sdcard/boot.img bs=4096

    /data/local/busybox md5sum /sdcard/boot.img
    /data/local/busybox md5sum /dev/block/mmcblk0p22

    *make sure numbers match

    back up recovery:
    dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096

    /data/local/busybox md5sum /sdcard/recovery.img
    /data/local/busybox md5sum /dev/block/mmcblk0p21

    *make sure numbers match

    backup existing misc partition:
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096

    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /dev/block/mmcblk0p17

    Make sure the numbers match
    Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17

    exit to get back to miniadb_merge> prompt

    reflash the misc image to allow donwgrading to older firmware:
    adb push misc-downgrade.img /sdcard/
    adb shell
    dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
    sync



    now you can flash the exploitable vzw firmware. you will need to make up your own "upgrade RUU" or upload the images and provide me the upload links,and your hboot/baseband numbers so i can make one up for you.

    simply unplug your phone if you want to wait for an upgrade RUU before continuing. alternatively,you could try a different upgrade RUU. i run usc GB on my vzw merge without issue.

    if you want to go ahead and downgrade and continue,then:

    exit to get back to the miniadb_merge> promt

    adb reboot bootloader this will boot your phone into fastboot. press "power" to select bootloader
    _________________________________________________________________


    alternate means of temp root

    fre3vo
    download DHD Downgrade folder

    -open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the miniadb_merge folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)

    -in your command window: change to the miniadb_merge directory by typing:
    cd c:\miniadb_merge (your promt should change to c:\miniadb_merge>)
    *note that in the next few steps,anything in bold type is an adb command. you can directly copy from this window,and paste into your command window to eliminate typos.

    -enable usb debugging,plug in your phone via usb. select "charge only" mode.

    -make sure adb is seeing your phone:
    adb devices (should return your serial number)

    - enter the commands from your link,one at a time,hit enter after each:

    adb push fre3vo /data/local/tmp

    adb shell chmod 777 /data/local/tmp/fre3vo

    adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF


    -make sure it worked. when you see "exploiting device" then your command prompt again:
    adb shell (if your prompt changes to a # youre good to go)

    heres what the above will look like in your cmd window:

    Code (Text):
    1. Microsoft Windows [Version 6.1.7601]
    2. Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    3.  
    4. C:\Users\Scott>[COLOR="Red"]cd c:\tbolt2[/COLOR]
    5.  
    6. c:\tbolt2>[COLOR="Red"]adb devices[/COLOR]
    7. * daemon not running. starting it now *
    8. * daemon started successfully *
    9. List of devices attached
    10. HTxxxxxx    device
    11.  
    12.  
    13. c:\tbolt2>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR]
    14. 956 KB/s (9796 bytes in 0.010s)
    15.  
    16. c:\tbolt2>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR]
    17.  
    18. c:\tbolt2>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF[/COLOR]
    19. fre3vo by #teamwin
    20. Please wait...
    21. Attempting to modify ro.secure property...
    22. fb_fix_screeninfo:
    23.   id: msmfb
    24.   smem_start: 802160640
    25.   smem_len: 3145728
    26.   type: 0
    27.   type_aux: 0
    28.   visual: 2
    29.   xpanstep: 0
    30.   ypanstep: 1
    31.   line_length: 1920
    32.   mmio_start: 0
    33.   accel: 0
    34. fb_var_screeninfo:
    35.   xres: 480
    36.   yres: 800
    37.   xres_virtual: 480
    38.   yres_virtual: 1600
    39.   xoffset: 0
    40.   yoffset: 0
    41.   bits_per_pixel: 32
    42.   activate: 16
    43.   height: 94
    44.   width: 56
    45.   rotate: 0
    46.   grayscale: 0
    47.   nonstd: 0
    48.   accel_flags: 0
    49.   pixclock: 0
    50.   left_margin: 0
    51.   right_margin: 0
    52.   upper_margin: 0
    53.   lower_margin: 0
    54.   hsync_len: 0
    55.   vsync_len: 0
    56.   sync: 0
    57.   vmode: 0
    58. Buffer offset:      00000000
    59. Buffer size:        8192
    60. Scanning region f0000000...
    61. Scanning region f00f0000...
    62. Scanning region f01e0000...
    63. Scanning region f02d0000...
    64. Scanning region f03c0000...
    65. Scanning region f04b0000...
    66. Scanning region f05a0000...
    67. Scanning region f0690000...
    68. Scanning region f0780000...
    69. Scanning region f0870000...
    70. Scanning region f0960000...
    71. Scanning region f0a50000...
    72. Scanning region f0b40000...
    73. Scanning region f0c30000...
    74. Scanning region f0d20000...
    75. Scanning region f0e10000...
    76. Scanning region f0f00000...
    77. Scanning region f0ff0000...
    78. Scanning region f10e0000...
    79. Scanning region f11d0000...
    80. Scanning region f12c0000...
    81. Scanning region f13b0000...
    82. Scanning region f14a0000...
    83. Scanning region f1590000...
    84. Scanning region f1680000...
    85. Scanning region f1770000...
    86. Scanning region f1860000...
    87. Scanning region f1950000...
    88. Scanning region f1a40000...
    89. Scanning region f1b30000...
    90. Scanning region f1c20000...
    91. Scanning region f1d10000...
    92. Scanning region f1e00000...
    93. Scanning region f1ef0000...
    94. Scanning region f1fe0000...
    95. Scanning region f20d0000...
    96. Scanning region f21c0000...
    97. Scanning region f22b0000...
    98. Scanning region f23a0000...
    99. Scanning region f2490000...
    100. Scanning region f2580000...
    101. Scanning region f2670000...
    102. Scanning region f2760000...
    103. Scanning region f2850000...
    104. Scanning region f2940000...
    105. Scanning region f2a30000...
    106. Scanning region f2b20000...
    107. Scanning region f2c10000...
    108. Scanning region f2d00000...
    109. Scanning region f2df0000...
    110. Scanning region f2ee0000...
    111. Scanning region f2fd0000...
    112. Scanning region f30c0000...
    113. Scanning region f31b0000...
    114. Scanning region f32a0000...
    115. Scanning region f3390000...
    116. Scanning region f3480000...
    117. Scanning region f3570000...
    118. Scanning region f3660000...
    119. Scanning region f3750000...
    120. Scanning region f3840000...
    121. Scanning region f3930000...
    122. Scanning region f3a20000...
    123. Scanning region f3b10000...
    124. Scanning region f3c00000...
    125. Scanning region f3cf0000...
    126. Scanning region f3de0000...
    127. Scanning region f3ed0000...
    128. Scanning region f3fc0000...
    129. Scanning region f40b0000...
    130. Scanning region f41a0000...
    131. Scanning region f4290000...
    132. Scanning region f4380000...
    133. Scanning region f4470000...
    134. Scanning region f4560000...
    135. Scanning region f4650000...
    136. Scanning region f4740000...
    137. Scanning region f4830000...
    138. Scanning region f4920000...
    139. Scanning region f4a10000...
    140. Scanning region f4b00000...
    141. Scanning region f4bf0000...
    142. Scanning region f4ce0000...
    143. Scanning region f4dd0000...
    144. Scanning region f4ec0000...
    145. Scanning region f4fb0000...
    146. Scanning region f50a0000...
    147. Scanning region f5190000...
    148. Scanning region f5280000...
    149. Scanning region f5370000...
    150. Scanning region f5460000...
    151. Scanning region f5550000...
    152. Scanning region f5640000...
    153. Scanning region f5730000...
    154. Scanning region f5820000...
    155. Scanning region f5910000...
    156. Scanning region f5a00000...
    157. Scanning region f5af0000...
    158. Scanning region f5be0000...
    159. Scanning region f5cd0000...
    160. Scanning region f5dc0000...
    161. Scanning region f5eb0000...
    162. Scanning region f5fa0000...
    163. Scanning region f6090000...
    164. Scanning region f6180000...
    165. Scanning region f6270000...
    166. Scanning region f6360000...
    167. Scanning region f6450000...
    168. Scanning region f6540000...
    169. Scanning region f6630000...
    170. Scanning region f6720000...
    171. Scanning region f6810000...
    172. Scanning region f6900000...
    173. Scanning region f69f0000...
    174. Scanning region f6ae0000...
    175. Scanning region f6bd0000...
    176. Scanning region f6cc0000...
    177. Scanning region f6db0000...
    178. Scanning region f6ea0000...
    179. Scanning region f6f90000...
    180. Scanning region f7080000...
    181. Scanning region f7170000...
    182. Scanning region f7260000...
    183. Scanning region f7350000...
    184. Scanning region f7440000...
    185. Scanning region f7530000...
    186. Scanning region f7620000...
    187. Scanning region f7710000...
    188. Scanning region f7800000...
    189. Scanning region f78f0000...
    190. Scanning region f79e0000...
    191. Scanning region f7ad0000...
    192. Scanning region f7bc0000...
    193. Scanning region f7cb0000...
    194. Scanning region f7da0000...
    195. Scanning region f7e90000...
    196. Scanning region f7f80000...
    197. Scanning region f8070000...
    198. Scanning region f8160000...
    199. Scanning region f8250000...
    200. Scanning region f8340000...
    201. Scanning region f8430000...
    202. Scanning region f8520000...
    203. Scanning region f8610000...
    204. Scanning region f8700000...
    205. Scanning region f87f0000...
    206. Scanning region f88e0000...
    207. Scanning region f89d0000...
    208. Scanning region f8ac0000...
    209. Scanning region f8bb0000...
    210. Scanning region f8ca0000...
    211. Scanning region f8d90000...
    212. Scanning region f8e80000...
    213. Scanning region f8f70000...
    214. Scanning region f9060000...
    215. Scanning region f9150000...
    216. Scanning region f9240000...
    217. Scanning region f9330000...
    218. Scanning region f9420000...
    219. Scanning region f9510000...
    220. Scanning region f9600000...
    221. Scanning region f96f0000...
    222. Scanning region f97e0000...
    223. Scanning region f98d0000...
    224. Scanning region f99c0000...
    225. Scanning region f9ab0000...
    226. Scanning region f9ba0000...
    227. Scanning region f9c90000...
    228. Scanning region f9d80000...
    229. Scanning region f9e70000...
    230. Scanning region f9f60000...
    231. Potential exploit area found at address f9fd6200:e00.
    232. Exploiting device...
    233.  
    234. c:\tbolt2>[COLOR="red"]adb shell[/COLOR]
    235. # [COLOR="Blue"]<-indicates that you have temp root access[/COLOR]
    236.  
    (ignore tbolt2,these are actually my thunderbolt directions ;))

    if you get your "#" prompt,indicating temp root,type exit to get back to your miniadb_merge> prompt,and pickup the directions in the first post at:
    adb push busybox /data/local

    basically,youre just eliminating those first few lines that pertain to zergrush. once youve successfully downgraded,you can follow the directions exactly,as youre on older firmware where the exploits will work for sure.

    hope that helps :)

    taco root
    5)downgrade with adb. make sure your phone is charged to 100% before starting.
    -on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

    -make sure phone is plugged in and usb debugging checked on in charge only mode

    -at the promt in your command window:


    cd c:\miniadb_merge this should change your command promt to "miniadb_merge>",indicating youre using that directory.
    adb devices this should output your phones serial number,indicating its recognized

    adb push tacoroot.sh /data/local/

    adb shell chmod 755 /data/local/tacoroot.sh

    adb shell /data/local/tacoroot.sh --setup

    your phone will reboot,eventually ending up on the stock recovery screen,with a picture of a phone,red ! and triangle. press vol up and power. this should bring up some writing(menu options for stock recovery). dont select any of these options. hold vol up,vol down,and power until the phone reboots.

    once your fully booted:


    adb shell /data/local/tacoroot.sh --root

    at this point your phone will become confused and unstable. it will reboot. maybe a couple of times.it may hang. it may start boot looping(what my phone did),or it may do other strange things as well. let the phone boot as far as its going to.

    if it gets so far,and starts bootlooping,thats ok,continue on:


    adb push misc-downgrade.img /sdcard/

    adb push busybox /data/local

    adb shell this should change your promt to a #

    chmod 0755 /data/local/busybox

    Next we backup our existing misc partition:
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /dev/block/mmcblk0p17


    Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17

    reflash the misc image to allow donwgrading to older firmware:

    dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
    sync


    to end the taco root unstability and get back a working phone:
    /data/local/tacoroot.sh --undo

    at this point,your phone will reboot again. this time,it should boot fully back into the OS,and once again be stable. as soon as it does:

    adb reboot bootloader

    fastboot devices again,this should output your serial number,indicating youre connected and drivers are working

    fastboot getvar mainver it should output 1.23.605.1 if it does,then procede. if not,something above was not entered correctly,and the downgrade will not flash. reboot your phone using the command fastboot reboot and start again at step 4.

    if you did get 1.23.605.1 then continue:

    press "power" to select bootloader

    assuming you have made your gold card and preformed the above steps correctly,you should see a status bar as the phone checks the downgrade RUU,then asks to update. choose yes and allow the update. if this is the first time youve ever flashed an RUU in hboot,dont panic,it will take a few minutes.

    HTCDEV
    5)downgrade with adb. make sure your phone is charged to 100% before starting.
    -on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

    -unlock with htcdev,install recovery and flash superuser(directions here: http://androidforums.com/merge-all-things-root/635459-unlock-htcdev.html )

    -make sure phone is plugged in and usb debugging checked on in charge only mode

    -at the promt in your command window:


    cd c:\miniadb_merge this should change your command promt to "miniadb_merge>",indicating youre using that directory.
    adb devices this should output your phones serial number,indicating its recognized

    adb push busybox /data/local

    adb shell this should change your promt to a #

    chmod 0755 /data/local/busybox

    Next we backup our existing misc partition:
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /dev/block/mmcblk0p17


    Make sure the md5sum of the misc-stock.img matches the one from /dev/block/mmcblk0p17

    exit to get back to miniadb_merge> prompt

    reflash the misc image to allow donwgrading to older firmware:
    adb push misc-downgrade.img /sdcard/
    adb shell
    dd if=/sdcard/misc-downgrade.img of=/dev/block/mmcblk0p17
    sync


    now you can flash the exploitable vzw firmware

    exit to get back to the miniadb_merge> promt

    adb reboot bootloader this will boot your phone into fastboot.

    fastboot oem lock to relock the bootloader,so you can run the downgrade ruu

    press "power" to select bootloader



    assuming you have made your gold card and preformed the above steps correctly,you should see a status bar as the phone checks the downgrade RUU,then asks to update. choose yes and allow the update. if this is the first time youve ever flashed an RUU in hboot,dont panic,it will take a few minutes.
  3. getitnowmarketing

    getitnowmarketing Well-Known Member Developer

    Just a tip to flash a ruu zip from hboot you can do "fastboot oem rebootRUU" this will change to a black screen with a HTC splash. Then "fastboot flash zip nameofzip" This will flash a PD42IMG.zip which must be signed unless s-off then you can flash unsigned hboot zips this way too. Works on nearly every HTC. To get out of RUU screen use "fastboot reboot" or "fastboot reboot-bootloader"
  4. scotty85

    scotty85 Guides Guide

    Cool,thanx for the info :)
  5. scary alien

    scary alien not really so scary Moderator

    Scotty!

    Awesome rooting guide here, sir!

    You are certainly getting around ;) :)!

    Just wanted to drop you a line that I've seeded this all-things-root sub-forum with a template root guide and included this thread in there.

    Since you're now a Guide, you'll be able to tweak the root guide, too, with any new links, etc. that you run across over here.

    Cheers!
    scotty85 likes this.
  6. scotty85

    scotty85 Guides Guide

    Cool,not much(any ;)) activity here,but ill see what I can do to add a return to stock guide :)
  7. kot222

    kot222 Member

    Thank you very much, you alone who wrote this. But for ordinary peoples can you do that via video recommendations?
  8. scotty85

    scotty85 Guides Guide

    sorry,i cannot make any videos. i dont actually have a merge to test on ATM.
  9. B Rich

    B Rich Member

    First of all, wanted to say that I joined this forum for the pure factor to thank you for taking the time to write all of this up. I'm following along right now on my Merge with US Cellular.

    However, when I get to this line:

    /data/local/zergRush

    and zergRush runs and does it's thing (says the "funny" lines) on the screen, it says:

    Found a GingerBread ! 0x00016118
    Scooting...
    Sending 149 zerglings ...
    Zerglings found a way to enter!
    Overseer found a path!
    Sending 149 zerglings ...

    And it will repeat the "Sending 149 zerglings" and "Overseer found a path!" about 7 or 8 times and then eventually I'll get the line:

    Zerglings did not leave interesting stuff

    And I'll get a blank command prompt. I'm not one to post a question and ask about my issue, but I did a quick google search for "Zerglings did not leave interesting stuff" with no results. Attached I have a picture of how I have things laid out in my C drive (the folder) so if I have something there that's wrong maybe? I'm not sure.

    But anyway, do you have any idea of what could be wrong? Again I appreciate all of your help, I'm really excited to finally root my Merge :)

    Attached Files:

    • 1.jpg
      1.jpg
      File size:
      173 KB
      Views:
      45
    • 2.jpg
      2.jpg
      File size:
      127.4 KB
      Views:
      44
    scotty85 likes this.
  10. scotty85

    scotty85 Guides Guide

    hmm,not really sure. i have no merge to test on,so i couldnt say for sure this would work. zergRush did work just fine on my 2.3.4 incredible. at first glance,it looks like youre doing everything right,and its just not working.

    your merge is currently s-on,and not rooted,correct?

    only thing that comes to mind right away,is maybe you could download the zergRush binary from xda,in case it has been updated.

    download it from here:
    Revolutionary - zergRush local root 2.2/2.3 [22-10: Samsung/SE update] - xda-developers

    delete the one thats currently in your miniadb_merge folder,and replace it with this one. if its different,your md5 sum wont match the one i listed,but thats ok.

    grasping at straws,make sure phone is in charge only mode,usb debugging checked on,and "allow non market app installs" is checked. ill sleep on it(been sitting in front of this screen too long:eek:) and let you know if i can think anything else...

    edit:i have found a vzw merge for what im willing to pay for one,so if its still available ill pick it up and hopefully be of more help :) its a lil tricky to do things for a phone you dont have :eek:

    second edit: a copy of your session may prove helpful. right click,click "mark" then highlight everyting. hit enter. in a post,click the # simbol to get the CODE tags. right click inside the tags and then paste.
    B Rich likes this.
  11. B Rich

    B Rich Member

    Thanks for the quick reply. Haha I totally understand with you not having the phone, and that's why things are so impressive.

    I've decided to put things aside for now, but I'll be trying what you recommended later on tonight.

    Yes, the phone is in charge only mode, usb debugging mode is on, and yes I can install non-market applications.

    I didn't see your 2nd edit in time there. I've lost my session, but I'll re-do things if I run into problems later on tonight. I tried to highlight things to send it to you, but I couldn't figure it out :p I consider myself an "advanced" computer user, but haven't messed with a command prompt very much at all.

    Thanks again for all of the help, I'll be back later tonight with my findings.
    scotty85 likes this.
  12. B Rich

    B Rich Member

    Also, to answer another question and to give more information, I'm running the latest Gingerbread (updated literally 2 weeks ago) and everything else is bone stock. The S-on is "on" or what not.
  13. B Rich

    B Rich Member

    We have progress! What you linked worked out great for me. I replaced the binary file and tried it again and it worked. However, when I try to do the following line of code:

    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096

    I get the error:

    "/sdcard/misc-stock.img: cannot open for write: I/O error"

    edit: this is the code that is right below the line that I'm supposed to skip because it's not a Verizon phone. Hope that makes sense.

    And I'm stuck as of right now. I still have my phone plugged into my computer, afraid if I unplug half way through all of this code stuff I'll get in trouble. Also, you have a PM sir.

    Thanks.


    PS:

    Here is my entire code:


    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\Brian>cd c:\miniadb_merge

    c:\Miniadb_merge>adb devices
    List of devices attached
    SERIAL NUMBER HERE device


    c:\Miniadb_merge>adb push zergRush /data/local/
    1876 KB/s (23060 bytes in 0.012s)

    c:\Miniadb_merge>adb shell
    $ chmod 755 /data/local/zergRush
    chmod 755 /data/local/zergRush
    $ /data/local/zergRush
    /data/local/zergRush

    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.

    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

    [+] Found a GingerBread ! 0x00000118
    [*] Scooting ...
    [*] Sending 149 zerglings ...
    [+] Zerglings found a way to enter ! 0x10
    [+] Overseer found a path ! 0x000161e0
    [*] Sending 149 zerglings ...
    [+] Zerglings caused crash (good news): 0x401219c4 0x0054
    [*] Researching Metabolic Boost ...
    [+] Speedlings on the go ! 0xafd1997b 0xafd39a97
    [*] Popping 24 more zerglings
    [*] Sending 173 zerglings ...

    [+] Rush did it ! It's a GG, man !
    [+] Killing ADB and restarting as root... enjoy!

    c:\Miniadb_merge>adb shell
    # dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    /sdcard/misc-stock.img: cannot open for write: I/O error
    # dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img
    /sdcard/misc-stock.img: cannot open for write: I/O error
    # /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox: not found
    # dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    /sdcard/misc-stock.img: cannot open for write: I/O error
    #
  14. B Rich

    B Rich Member

    Didn't have the SD card mounted..... :eek:

    So now I started completely over with the command prompt part and ran the zergRush a second time (oops?) and the phone kept on restarting on me (3 times until I finally took the battery out and got my pulse back) and then the phone slowly started back up and all is fine. Well, now, I seem to be getting an access denied error and I can't even get as far as I used to be.... here is my code:


    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\Brian>
    C:\Users\Brian>cd c:\miniadb_merge

    c:\Miniadb_merge>adb devices
    List of devices attached
    SERIAL NUMBER HERE device


    c:\Miniadb_merge>adb push zergRush /data/local/
    1876 KB/s (23060 bytes in 0.012s)

    c:\Miniadb_merge>adb shell
    $ adb shell
    adb shell
    adb: permission denied
    $ dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    /dev/block/mmcblk0p25: cannot open for read: Permission denied
    $
  15. scotty85

    scotty85 Guides Guide

    sorry,i was sleepin :eek: however,you have done a fantastic job figuring out your issues :cool:

    in this bit of code:
    Code (Text):
    1. c:\Miniadb_merge>adb shell
    2. $ adb shell
    3. adb shell
    4. adb: permission denied
    5. $ dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    6. dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    7. /dev/block/mmcblk0p25: cannot open for read: Permission denied
    the prollem you are having is simply,that you typed adb shell a second time :eek: you type that,when at the "miniadb_merge>" prompt to turn it into the "$". you cant type adb shell while in the "$" because youre allready in the shell ;)

    you got the error when entering the other command,because you need root privledges to copy that block. i.e.,the prompt needs to be a "#" not a "$"

    all you need to do is start over,and carefully go thru and enter all the commands again,being careful not to miss any,or get any twice ;) dont worry,youll get it!
    B Rich likes this.
  16. B Rich

    B Rich Member

    Bah, I guess that's what I get for working on it so late in the evening :rolleyes: lol

    I'll try again this afternoon and report back. Thanks again!
  17. B Rich

    B Rich Member

    I hate to keep coming back with issues :eek: but here is what I have now.... still access denied :(

    Hard reset the phone and start completely over? I'm already prepared to lose all my data on my phone.


    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\Brian>cd c:\miniadb_merge

    c:\Miniadb_merge>adb devices
    List of devices attached
    SERIAL NUMBER HERE device


    c:\Miniadb_merge>adb push zergRush /data/local/
    1876 KB/s (23060 bytes in 0.012s)

    c:\Miniadb_merge>adb shell
    $ chmod 755 /data/local/zergRush
    chmod 755 /data/local/zergRush
    $ /data/local/zergRush
    /data/local/zergRush

    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.

    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

    [-] Cannot copy boomsh.: Permission denied
    $
  18. scotty85

    scotty85 Guides Guide

    Doesn't look like anything wrong at 1st glance. Try rebooting your phone,and PC
    B Rich likes this.
  19. B Rich

    B Rich Member

    Gosh darnit! I had my regular 8gb memory card in there, not the other 8gb memory card that i used as my gold card. I'll shut up now until I really run into problems :eek: :p
  20. B Rich

    B Rich Member

    Still getting the same error :-/
  21. scotty85

    scotty85 Guides Guide

    Did you try the reboots?

    Allowing nonmarket apps?

    Maybe try and re-download zergRush. Maybe its become corrupted somehow?

    Going to pick up a merge tonite :)
    B Rich likes this.
  22. B Rich

    B Rich Member

    Yeah did the reboots and allow non-market apps. I'll try re-downloading it in a bit.

    Glad to hear you're picking one up tonight :)
  23. scotty85

    scotty85 Guides Guide

    Just curious... what happens If you type "su" at your $ prompt?
    B Rich likes this.
  24. B Rich

    B Rich Member

    I'll tell you in about an hour or so when I give things another try :)
  25. B Rich

    B Rich Member


    :(

Share This Page