root,s-off,simunlock,superCID htc merge


  1. scotty85

    scotty85 Guides Guide

    yes,we should be able to figure it out and get you a rooted,working phone. :) i still do not understand why the firmware has anything to do with the carrier recognizing the device. in the mean time,while we are waiting to get hold of your sisters phone,you can try running a usc stock ruu. its using the same radio and hboot as your sisters phone,its close in firmware version number,and its not vzw firmware,so who knows? defiantely wont hurt to give it a shot.

    you can download it from here: Lexikon_US_Cellular_WWE_2.04.573.2_Radio_1.08.00.0320_NV_USC_1.65_1217_PRL15075_release_183281_signed.exe

    this is a .exe file,so youll download it,right click on the download and "run as administrator" if possible. if not,just run it. follow the onscreen directions to plug in your phone,etc.

    if your phone number doesnt pop back into it and your phone start working, afterwardyou might call bluegrass activation again while on that software and see if it activates,or directs you somewhere else :eek:

    now that youve successfully s-offed your merge,rooting is easy,so well concentrate on getting your phone working again first. ;)

    i will go ahead and start typing up the directions to get back up the system/boot/recovery from your sisters phone.
  2. scotty85

    scotty85 Guides Guide

    ok,heres what youll need to do:

    charge her phone to 100%. check usb debugging,plug it in,place it in charge mode.


    cd c:\miniadb_merge this should change your command promt to "miniadb_merge>",indicating youre using that directory.
    adb devices this should output your phones serial number,indicating its recognized

    adb push zergRush /data/local/
    adb shell this will change your promt to a $
    chmod 755 /data/local/zergRush
    /data/local/zergRush

    this will cause zergRush to start,and it shoudl say "found a gingerbread!" or "found a froyo!" followed by a bunch of other funny stuff.

    last thing it says will be: Killing ADB and restarting as root... enjoy!

    you should then be returned to your "miniadb_merge>" prompt


    adb push busybox /data/local

    adb shell this should change your promt to a #

    chmod 0755 /data/local/busybox

    back up the system image:
    dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096

    /data/local/busybox md5sum /sdcard/system.img
    /data/local/busybox md5sum /dev/block/mmcblk0p25

    *make sure numbers match

    back up the boot image:
    dd if=/dev/block/mmcblk0p22 of=/sdcard/boot.img bs=4096

    /data/local/busybox md5sum /sdcard/boot.img
    /data/local/busybox md5sum /dev/block/mmcblk0p22

    *make sure numbers match

    back up recovery:
    dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096

    /data/local/busybox md5sum /sdcard/recovery.img
    /data/local/busybox md5sum /dev/block/mmcblk0p21

    *make sure numbers match

    backup existing misc partition:
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096

    /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /dev/block/mmcblk0p17

    Make sure the numbers match

    exit to get back to miniadb_merge> prompt

    at this point,you havent done anything besides back things up. put the phone in disk drive mode,and make sure there are 4 image files on the sd card- boot,system,recovery,and misc. once youve verified that they are there,you can unplug her phone from the computer,and reboot it.

    upload boot,system,and recovery and post the links here. ill put them together and test it out,then upload it for you to download and flash. that should get you back to stock :)
  3. chill0398

    chill0398 Active Member

    Thank you so much for your help :)
  4. chill0398

    chill0398 Active Member

    So I download the USSC ruu and called the number to reactivate it and it still took me to Verizon, that made me realize that maybe I'm calling Verizon bc I'm roaming right now bc I'm out of town and Bluegrass uses Verizon towers outside their area. The phone number is still missing though, maybe if I get in my home area I can reactivate it? I'm going home tonight and will probably get ahold of my sister's phone.
    scotty85 likes this.
  5. scotty85

    scotty85 Guides Guide

    very well vould be the case... let me know how it goes :)
  6. chill0398

    chill0398 Active Member

    Microsoft Windows [Version 6.1.7600]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\Corey>cd c:\miniadb_merge

    c:\miniadb_merge>adb devices
    List of devices attached
    HT15XM800011 device


    c:\miniadb_merge>adb push zergRush /data/local/
    1407 KB/s (23060 bytes in 0.016s)

    c:\miniadb_merge>adb shell
    $ rm /data/local/tmp/boomsh
    rm /data/local/tmp/boomsh
    $ rm /data/local/tmp/sh
    rm /data/local/tmp/sh
    $ chmod 755 /data/local/zergRush
    chmod 755 /data/local/zergRush
    $ /data/local/zergRush
    /data/local/zergRush

    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.

    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

    [+] Found a Froyo ! 0x00000108[*] Scooting ...[*] Sending 149 zerglings ...
    [+] Zerglings found a way to enter ! 0x10
    [+] Overseer found a path ! 0x000150e8[*] Sending 149 zerglings ...
    [+] Zerglings caused crash (good news): 0x401219e4 0x006c[*] Researching Metabolic Boost ...
    [+] Speedlings on the go ! 0xafd1598f 0xafd1adb3[*] Sending 149 zerglings ...

    [+] Rush did it ! It's a GG, man !
    [+] Killing ADB and restarting as root... enjoy!

    c:\miniadb_merge>adb push busybox /data/local
    1774 KB/s (1062992 bytes in 0.585s)

    c:\miniadb_merge>adb shell
    # chmod 0755 /data/local/busybox
    chmod 0755 /data/local/busybox
    # exit
    exit

    c:\miniadb_merge>adb push busybox /data/local
    1718 KB/s (1062992 bytes in 0.604s)

    c:\miniadb_merge>adb shell
    # chmod 0755 /data/local/busybox
    chmod 0755 /data/local/busybox
    # dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096

    Here is my coding but when I get it this point the prompt doesn't go back to a # instead it just keeps flashing an underscore. Am I doing something wrong?
  7. chill0398

    chill0398 Active Member

    Microsoft Windows [Version 6.1.7600]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\Corey>cd c:\miniadb_merge

    c:\miniadb_merge>adb devices
    List of devices attached
    HT15XM800011 device


    c:\miniadb_merge>adb push zergRush /data/local/
    1407 KB/s (23060 bytes in 0.016s)

    c:\miniadb_merge>adb shell
    $ rm /data/local/tmp/boomsh
    rm /data/local/tmp/boomsh
    $ rm /data/local/tmp/sh
    rm /data/local/tmp/sh
    $ chmod 755 /data/local/zergRush
    chmod 755 /data/local/zergRush
    $ /data/local/zergRush
    /data/local/zergRush

    [**] Zerg rush - Android 2.2/2.3 local root
    [**] (C) 2011 Revolutionary. All rights reserved.

    [**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

    [+] Found a Froyo ! 0x00000108
    [*] Scooting ...
    [*] Sending 149 zerglings ...
    [+] Zerglings found a way to enter ! 0x10
    [+] Overseer found a path ! 0x000150e8
    [*] Sending 149 zerglings ...
    [+] Zerglings caused crash (good news): 0x401219e4 0x006c
    [*] Researching Metabolic Boost ...
    [+] Speedlings on the go ! 0xafd1598f 0xafd1adb3
    [*] Sending 149 zerglings ...

    [+] Rush did it ! It's a GG, man !
    [+] Killing ADB and restarting as root... enjoy!

    c:\miniadb_merge>adb push busybox /data/local
    1774 KB/s (1062992 bytes in 0.585s)

    c:\miniadb_merge>adb shell
    # chmod 0755 /data/local/busybox
    chmod 0755 /data/local/busybox
    # exit
    exit

    c:\miniadb_merge>adb push busybox /data/local
    1718 KB/s (1062992 bytes in 0.604s)

    c:\miniadb_merge>adb shell
    # chmod 0755 /data/local/busybox
    chmod 0755 /data/local/busybox
    # dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    dd if=/dev/block/mmcblk0p25 of=/sdcard/system.img bs=4096
    /data/local/busybox md5sum /sdcard/system.img
    /data/local/busybox md5sum /sdcard/system.img
    /data/local/busybox md5sum /dev/block/mmcblk0p25
    /data/local/busybox md5sum /dev/block/mmcblk0p25
    131007+1 records in
    131007+1 records out
    536607232 bytes transferred in 394.439 secs (1360431 bytes/sec)
    # dd if=/dev/block/mmcblk0p22 of=/sdcard/boot.img bs=4096
    dd if=/dev/block/mmcblk0p22 of=/sdcard/boot.img bs=4096
    /data/local/busybox md5sum /sdcard/boot.img
    /data/local/busybox md5sum /sdcard/boot.img
    /data/local/busybox md5sum /dev/block/mmcblk0p22
    /data/local/busybox md5sum /dev/block/mmcblk0p22
    a2c57b333ea3312ea3f5b8fc97516016 /sdcard/system.img
    # dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096
    dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096
    a2c57b333ea3312ea3f5b8fc97516016 /dev/block/mmcblk0p25
    # 1024+0 records in
    1024+0 records out
    4194304 bytes transferred in 0.386 secs (10866072 bytes/sec)
    # 9fa881629fd4628dc883a27fbf9ea07c /sdcard/boot.img
    # 9fa881629fd4628dc883a27fbf9ea07c /dev/block/mmcblk0p22
    # 2175+1 records in
    2175+1 records out
    8909824 bytes transferred in 3.195 secs (2788677 bytes/sec)
    # /data/local/busybox md5sum /sdcard/recovery.img
    /data/local/busybox md5sum /sdcard/recovery.img
    840082542fc71d9f5e812bc777505df8 /sdcard/recovery.img
    # /data/local/busybox md5sum /dev/block/mmcblk0p21
    /data/local/busybox md5sum /dev/block/mmcblk0p21
    840082542fc71d9f5e812bc777505df8 /dev/block/mmcblk0p21
    # dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    dd if=/dev/block/mmcblk0p17 of=/sdcard/misc-stock.img bs=4096
    64+0 records in
    64+0 records out
    262144 bytes transferred in 0.022 secs (11915636 bytes/sec)
    # /data/local/busybox md5sum /sdcard/misc-stock.img
    /data/local/busybox md5sum /sdcard/misc-stock.img
    39ee4399a5ae69f23b0906f65cb309ab /sdcard/misc-stock.img
    # /data/local/busybox md5sum /dev/block/mmcblk0p17
    /data/local/busybox md5sum /dev/block/mmcblk0p17
    39ee4399a5ae69f23b0906f65cb309ab /dev/block/mmcblk0p17
    # exit
    exit

    c:\miniadb_merge>

    Okay so I just continued and maybe I didn't be patient enough, but this is what I got. It's all scrambled but did it still work. I'm gonna upload the images and I'll post you the links.
  8. scotty85

    scotty85 Guides Guide

    Yes,I should have mentioned that,sorry. The system image is huge and it takes it forever to backup,and to calculate the md5... You did need to just be more patient and wait for the prompt to come back.

    Nonetheless... Looks like all the md5s of the images on the sd match the ones for the images on the phone. Upload them and ill whip it up and test it for you :)
  9. chill0398

    chill0398 Active Member

    Note to self...need faster upload speed lol.
  10. scotty85

    scotty85 Guides Guide

    Cool... ill get to it as soon as I get Home his afternoon :)
  11. scotty85

    scotty85 Guides Guide

    downloading now :)
    chill0398 likes this.
  12. chill0398

    chill0398 Active Member

    Cool thank you so much Scotty.
  13. scotty85

    scotty85 Guides Guide

    well good news is that 2.05.557.3 booted just fine on my phone :) it should restore you to stock radio,firmware,etc. its uploading now. unfortunately,you have an idea how long it takes,lol. it says estimated 45 min left :eek:

    ill get you the link as soon as its done

    md5 is: PD42IMG-bluegrass-wireless-2.05.557.03.zip 3aa77a14b989d6bdacf8ce3b11b0bae0

    edit:
    uploading rooted version :)
  14. scotty85

    scotty85 Guides Guide

  15. chill0398

    chill0398 Active Member

    So I just flash this PD42IMG file like the other custom ROMs and it restores me to stock or my phone will still be rooted? Then with this ROM I just take it up to Bluegrass and have them reactivate it?
  16. scotty85

    scotty85 Guides Guide

    Correct. Flash in hboot... have them reactivate. It wont be rooted,but you don't want it to be if they are gonna mess with it ;)
  17. scotty85

    scotty85 Guides Guide

    once your phone is working again,there are a couple different ways you can root it.

    1)flash the amon recovery linked in the first post by renaming it PD42IMG,just like you did the RUUs. after youve booted and deleted or renamed the PD42IMG,you can go to recovery and flahs the eng-merge-toolkit

    or

    2)you can flash this custom upgrade RUU. its got superuser,busybox,and recovery allready installed:

    Multiupload.com - upload your files to multiple file hosting sites!
    md5: a903e463f71fef87843cb5a9523de33d

    id get the phone activated and working again before attempting to root it.

    #2 will wipe your data :eek:
    #1 is prolly the best way. basically rename the amon recovery PD42IMG,flash,then do step 7
  18. chill0398

    chill0398 Active Member

    I did notice one difference when I turn my phone on. The image that comes on the screen is just an HTC Quietly Brilliant instead of the Bluegrass image I use to have. You think this will be a problem?
  19. chill0398

    chill0398 Active Member

    And which way would you suggest I do it so that the same problem doesn't occur again?
  20. scotty85

    scotty85 Guides Guide

    no,it shouldnt be a prollem. if someone at a store notices it,just claim ignorance ;) "i dunno... always been that way" :D

    its just the splash screen,has no affect on the operation.
  21. scotty85

    scotty85 Guides Guide

    see above,i musta been edditing as you were asking :p #1 would be the safest
  22. chill0398

    chill0398 Active Member

    Thank you again. I'll let you know how it goes.
  23. chill0398

    chill0398 Active Member

    Quick rando question Scotty, are you going to play Star Wars The Old Republic by any chance.
  24. chill0398

    chill0398 Active Member

    Also, the problem occurred when I was flashing ROMs, how do I know the same problem won't occur again when I flash another ROM to get root? What's different this time around? And for step 8 I'm restoring my misc-image. Should I just put the one from my sister's phone on my SD card and then perform the coding to restore it or will I even have to do that part?

Share This Page