Root Downgrade & Root issues

[JSLEnterprises]

When finally applying the PD98IMG via Bootloader, you get a "version is older" or similar message, you must remake the goldcard.


Instead of Goldcard Helper.

- Open up a command prompt (Windows Key + R, type "CMD", press enter)
- connect your phone as "charge only" and have usb debugging enabled
- navigate the command prompt to the downgrade folder.
- Type:

adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid

-Select and copy the cid, then paste into the appropriate field on the Goldcard Generator webpage.

You will now get a proper image, that once applied, will give you a proper working Goldcard to copy the PD98IMG.zip to and downgrade your device.

Cheers.

 

[CuBz]

When finally applying the PD98IMG via Bootloader, you get a "version is older" or similar message, you must remake the goldcard.


Instead of Goldcard Helper.

- Open up a command prompt (Windows Key + R, type "CMD", press enter)
- connect your phone as "charge only" and have usb debugging enabled
- navigate the command prompt to the downgrade folder.
- Type:

adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid

-Select and copy the cid, then paste into the appropriate field on the Goldcard Generator webpage.

You will now get a proper image, that once applied, will give you a proper working Goldcard to copy the PD98IMG.zip to and downgrade your device.

Cheers.

Cheers for that. It's always good to have an alternate

 

[wiggmond]

I'll definitely keep that in mind also next time.

I have found if using 'copy to clipboard' with Goldcard Helper it copies the mmc0 CID and this did not work no matter what SD Card I used. Manually taking the mmc2 worked first time. I could have saved 3hrs yesterday

Keep this in mind and use the above methods instead.

 

[CuBz]

I'll definitely keep that in mind also next time.

I have found if using 'copy to clipboard' with Goldcard Helper it copies the mmc0 CID and this did not work no matter what SD Card I used. Manually taking the mmc2 worked first time. I could have saved 3hrs yesterday

Keep this in mind and use the above methods instead.

When I used 'Copy to clipboard, it copied mmc2

 

[daveycliff]

happy to say I've successfully managed to downgrade from 2.50.161.2, obtained permanent root with S-OFF and just about to install 1st cutom rom.

thanks to everyone who gave their time and effort into getting the 2.37+ version "fixed"

my potential exploit address was fbb7f800:1800

thanks again (p.s. where's the thanks button)

 

[wiggmond]

When I used 'Copy to clipboard, it copied mmc2

Oh!!

I just checked with Goldcard Helper again and it copied mmc0

Maybe its to do with different SD Cards.

I feel post after post coming of people who's mmc2 was copied and I'm the only one with something different. Story of my life!

 

[JSLEnterprises]

happy to say I've successfully managed to downgrade from 2.50.161.2, obtained permanent root with S-OFF and just about to install 1st cutom rom.

thanks to everyone who gave their time and effort into getting the 2.37+ version "fixed"

my potential exploit address was fbb7f800:1800

thanks again (p.s. where's the thanks button)

thats a new address and offset I havent seen yet, thanks for the info addition

 

[daveycliff]

thats a new address and offset I havent seen yet, thanks for the info addition

I got this one first time: fbb56400:1c00

but had to restart the whole process for some reason

not sure if it helps...

 

[JSLEnterprises]

I got this one first time: fbb56400:1c00

but had to restart the whole process for some reason

not sure if it helps...

Yep, i've seen that address-offset before, guy had a problem with it too and redid the method, his new address-offset was fbb6b00:1a00

I think at that offset its just a false positive, possibly a glitch in the data comparison.

 

[springy]

Can't seem to get temp root.

I am on USB debug and on charged only. I get this in the CMD

Potential exploit area found at address fbb6cc00:400.
Payload verification failed.

Anyone can help, on 2.50

 

[JSLEnterprises]

Can't seem to get temp root.

I am on USB debug and on charged only. I get this in the CMD

Potential exploit area found at address fbb6cc00:400.
Payload verification failed.

Anyone can help, on 2.50

redownload the tools found here, reboot your phone, and try it again.

If it still doesnt work for some reason, try my version of this method: HOW TO: Downgrade ,Root, Radio & Eng S-OFF DHD/Inspire 4G in 9 Steps

 

[springy]

That guide looks like it is rooting and getting the ROM. I just want temp so i can backup data

 

[JSLEnterprises]

That guide looks like it is rooting and getting the ROM. I just want temp so i can backup data

go into the resource folder of my toolkit, open "fre3vo.cmd" in notepad
delete everything after and including the first "CLS" and save.
Now it will only temproot.

 

[springy]

Still doesn't seem to work

adb server is out of date. killing...
* daemon started successfully *
612 KB/s (0 bytes in 9796.000s)
15 KB/s (0 bytes in 15837.001s)
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Potential exploit area found at address fbb6c1ff:e01.
Payload verification failed.
----------------------------------------
- -
- Exploit Found - Data Patched -
- Please Disconnect Then Reconnect -
- Your Device -
- -
----------------------------------------

 

[JSLEnterprises]

Still doesn't seem to work

Its finding the exploit, but its not able to verify, odd.

Which verison of 2.50 do you have exactly, i'll look into it a bit further (basically, im going to download the actual ruu and see what raw data is sitting in the system.img at its corresponding location)

 

[springy]

I am on stock 2.50.405.2

2.50.405.2 CL87995 release-keys

By the way, that is the same thing I get when I use the one by the OP as well, payload verification failed.

 

[JSLEnterprises]

I am on stock 2.50.405.2

2.50.405.2 CL87995 release-keys

By the way, that is the same thing I get when I use the one by the OP as well, payload verification failed.

This version has not been a problem for the temproot method for other people.
Are you running the command prompt as an admin?


If you're just wanting to back up, export the contacts with the built in ability, and make sure everything is synced (with htc sync or with the cloud - google, etc...).

if you cant gain temproot now, the only way to get temproot is if you reset the device or reload the stock rom and then doing the method again. there's something (possibly a 3rd party app or similar) preventing the changes from taking place, especially with the exploit found.... in 2 different hex addresses (should only be one).

 

[springy]

I don't want to do that as I will lose my app data and I don't want to lose it. That's why I want temp access to back up my application data.

Guess I wait until HTC unlocks the boot loader for DHD

 

[DMADROX]

Hey there guys, when I load PD98IMG via Bootloader the blue bar loads and then I get a yellow bar and then I get an error saying invalid CID number, I've tried to make multiple gold cards and use different programs to make them each time and I am still getting the same error message.

Can anyone advise on what to do about this?

Thanks.

-MADROX-

 

[CuBz]

Hey there guys, when I load PD98IMG via Bootloader the blue bar loads and then I get a yellow bar and then I get an error saying invalid CID number, I've tried to make multiple gold cards and use different programs to make them each time and I am still getting the same error message.

Can anyone advise on what to do about this?

Thanks.

-MADROX-

Make sure you are copying mmc2 not mmc0

 

[BigWill]

I'm lost.. thats too long instructions man..

 

[CuBz]

I'm lost.. thats too long instructions man..

Can't get any simpler than that pal

 

[JSLEnterprises]

I'm lost.. thats too long instructions man..

Its in sections depending on what you want to do.
If you dont want to back up data, then just skip that whole part.

 

[BrutalUK]

My exploit address was fbb80000:1000

 

[thepiecemaka]

I created my goldcard, I got to the bootloader and it was reading the zip file and then I got this message:

"Main Version is older! Update Fail!"

Any idea how to get around this. I have a Telus Desire HD running 2.3.3

Thanks