Root [Guide] TEMP-ROOT ANY DHD GB build & downgrade to 1.32.405.6 [Easy to Follow]

[CuBz]

Here is a guide to Temproot and downgrade any HTC Desire HD Gingerbread Build. However, there is now a tool which will do the entire process for you in a couple of clicks. It will also root, S-OFF and install clockwork mod for you, please see the 2nd post.

This method has been confirmed working for all DHD Gingerbread builds!

Please could you post the Exploit address when successfully rooted with fre3vo. Thanks

Thanks go to:
agrabren
aswethinkweiz
JSLEnterprises

I am not responsible for any damage incurred to your handset during this process, you're voiding your warranty and doing so at your own risk.

That being said, it is a relatively easy procedure but is obviously not 100% risk free.

Please make sure you have the phone's drivers installed on the computer you are using, otherwise this will not work.

Temp Root:

1. Enable USB debugging on your phone and place your phone on CHARGE ONLY (If this doesn't work, try choosing 'HTC Sync' when connecting USB)
2. Download the DHD Downgrade folder and extract it to the root of your hard drive (usually this is the "C:\" drive on your computer)
3. Run the file named "RUN THIS FOR ROOT". A command prompt will open and will begin to do the adb steps for you.

Alternatively (If step 3 fails):

1. Open a command prompt (right click "Run as Administrator" is using Vista or W7) and locate the downgrade folder (type "CD C:\DHDDowngrade" minus the quotes in CMD)
2. Run the below commands (be sure to press enter after each line)


adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell /data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF

If the scan hangs, just reboot your DHD and start again.

You may not get all the messages (due to flushing issues when we kill adb), but if you get kicked back to your system command prompt, try "adb shell"

If you see '#' you successfully have temproot.

If you want to use Titanium Backup, you must do the following:

1. Download Busybox, su & fixsu.sh and Superuser.apk

2. Run the following commands in CMD...

adb push fixsu.sh /data/local/tmp
adb push su /data/local/tmp
adb push busybox /data/local/tmp
adb shell chmod 777 /data/local/tmp/fixsu.sh
adb shell chmod 777 /data/local/tmp/su
adb shell chmod 777 /data/local/tmp/busybox

3. Install Superuser.apk

4. Install Titanium Backup from the Market

5. Run the following commands in CMD:

adb shell
# cd /data/local/tmp
# ./fixsu.sh

If you see...

rm failed for /system/bin/su Read-only file system

...ignore it

You can now use Titanium to backup all User Apps + Data (You can backup System apps too)
If you don't want to go any further than rooting, and just want temproot to remove bloatware, you can also use Titanium backup to do that.
Temproot will be enabled until phone is rebooted.

Downgrade:


1. Create a goldcard:

1. Format SDCard to FAT32

2. Download Goldcard Helper from Android Market

3. Open Goldcard Helper with the SDCard in the phone, and you will see the mmc2 reverse CID

Note: Do not use the Copy feature in the app as this will copy the wrong CID!​

Alternate to the Goldcard helper app:

1. Open up a command prompt (Windows Key + R, type "CMD", press enter)
2. connect your phone as "charge only" and have usb debugging enabled
3. navigate the command prompt to the downgrade folder.
4. Type the following command:

adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid

5. Select and copy the cid

4. Go to Free HTC goldcard generator | RevSkills

5. Enter your email address and the mmc2 reverse CID that is showing on the Goldcard Helper app then submit it

6. The img file will be emailed to you, download and save it somewhere you will remember

7. Download this hex editor - Downloads | mh-nexus

8. Open HxD hex editor on your computer by right-clicking it and clicking 'Run as Administrator'

9. Mount your SD card to your computer, preferably using a card reader but you can use your phone as well

10. Go to 'Extra' menu > 'Open Disk'. Select Removable Disk (which should be your SD card) under Physical Disk (and NOT logical disk), uncheck 'Open as Readonly' and click OK

11. Go to the 'Extra' > 'Open Disk Image' and open the goldcard image downloaded in Step 6. . Select '512 (Hard disks/Floppy disks)' as the sector size when prompted and click OK

12. In the goldcard image tab, go to 'Edit' > 'Select All' and then 'Edit' >'Copy'

13. In the 'Removable Disk' tab, highlight offset (line) 00000000 to offset (line) 00000170 including the 00000170 line and go to 'Edit' menu > 'Paste Write'

14. Click 'File' > 'Save' and accept any warning that you get

2. Place the stock 1.32 PD98IMG.zip on the root of your SDcard/Goldcard

4. Open the file in the folder named "RUN THIS FOR DOWNGRADE". The command prompt will opn and begin to do the adb steps for you.

Alternatively (If step 4 fails):


Run the below commands in CMD:


adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/misc_version -s 1.31.405.3
adb reboot bootloader

5. You should see a white bootloader screen, press the power button to enter the bootloader and it should automatically start to detect the PD98IMG.zip file.
6. You will see a blue progress bar on the right of the screen while the file is being checked. You should now be asked to confirm if you want to install this ROM, press 'Volume Up' to confirm. Wait patiently while the ROM is installed.
7. Once the installation is complete, press the 'power' button to restart your phone.

You have successfully downgraded to stock 1.32

How to Root 1.32:

1. Download and install Visionary+ to your Desire HD
2. Open Visionary+ and choose "Temproot now". The screen may go black and may become unresponsive, please allow it to finish.
3. After temproot, choose "Attempt permroot now". This will attempt to permanently root your Desire HD. Your device should then reboot.
4. After reboot, you should successfully be rooted.

How to Radio S-Off & SimUnlock Your Desire HD - Thanks to jkoljo

How to Flash recovery with ClockworkMod

1. Search Android Market for a free app called 'ROM Manager'. Once found, install it.
2. Once it has been installed, launch 'ROM Manager' on your phone.
3. In ROM Manager, tap 'Flash ClockworkMod Recovery'. Tap on 'Desire HD' when it pops up.
4. Be patient as ClockworkMod is installed, as it can take quite some time. Once it has finished , you have ClockworkMod recovery installed on your phone.

You should now have stock 1.32, root, S-off, and CWM Recovery.
You can now flash a ROM using Clockworkmod

FAQs​

Q. How do I run CMD?

A. Windows Vista and 7 users: Press Start, type CMD. You should see CMD sppear, right click and 'Run as Administrator'. Windows XP users: Press Start, Press 'Run', type CMD, then click OK.



Q. How do I enable USB Debugging?

A. On your Desire HD go to Settings -> Applications -> Development -> Enable USB Debugging



Q. Why do I keep getting CID error in bootloader?

A. This is most often a problem with your goldcard. First make sure you have created a goldcard using the guide at the top of this post. If you have created a goldcard, format the SDCard using FAT32 and try again making sure you have followed each step very carefully. Also, make sure you have the .bin file on your SDCard after doing the adb steps.



Q. When going into bootloader it says "no image or wrong image"

A. This message will be displayed when files it is looking for cannot be found. Leave it to continue and it will update. If it displays this message after searching for PD98IMG.zip, then the file is damaged or you do not have it on your SDCard.



Q. Do I have to disconnect the phone from the computer before booting into bootloader?

A. Yes....Simplez



Q. I have tried many times to create the goldcard, but continue to get errors.

A. This could be because you are continuously making mistakes, or your SDCard cannot be made into a goldcard, try another SDCard.


More will be added when needed

Please press Thanks

 

[El Presidente]

The link below contains a tool which will root, S-OFF and install ClockworkMod on your handset. It mentions the Inspire, but it has been confirmed as working on the Desire HD

Ace Hack Kit

If you've not got the Gingerbread OTA update yet and feel like freestyling it, here are instructions on how to downgrade and root manually:

http://androidforums.com/desire-hd-all-things-root/354749-how-root-install-custom-rom-desire-hd.html

The guide contains the tool and instructions on how to obtain ENG S-OFF which allows you to flash a new radio (recommended for some ROMs).

All other posts from this thread have been moved here: http://androidforums.com/desire-hd-all-things-root/417041-downgrade-root-issues.html

If you've any queries about the downgrade process, the above link is where to post them.

 

[hengyongjie]

Sir,

I was unable to downgrade to 1.32

I follow your steps of the first post until i tried the bootloader. It tells me:
"Main Version is older!"



my specs:
HTC Desire HD

Android version:
2.3.3

HTC Sense version:
2.1

Baseband version:
12.54.60.25U_26.09.04.11_M2

Kernel version:
2.6.35.10-gd2564fb
htc-kernel@and18-2 #1
Thu Jun 9 14:20:29 CST 2011

Build number:
2.50.707.4 CL91002 release-keys

Software number:
2.50.707.4

Browser version:
Webkit/533.1



the only fishy part i noticed was when i try to run "RUN THIS FOR DOWNGRADE".
After "adb shell /data/local/tmp/misc_version -s 1.31.405.3"
it says the following:
--set_version set. VERSION will be changed to: 1.31.405.3
Patching and backing up partition 17...
Error opening backup file.

 

[D-U-R-X]

Sir,

I was unable to downgrade to 1.32

I follow your steps of the first post until i tried the bootloader. It tells me:
"Main Version is older!"



my specs:
HTC Desire HD

Android version:
2.3.3

HTC Sense version:
2.1

Baseband version:
12.54.60.25U_26.09.04.11_M2

Kernel version:
2.6.35.10-gd2564fb
htc-kernel@and18-2 #1
Thu Jun 9 14:20:29 CST 2011

Build number:
2.50.707.4 CL91002 release-keys

Software number:
2.50.707.4

Browser version:
Webkit/533.1



the only fishy part i noticed was when i try to run "RUN THIS FOR DOWNGRADE".
After "adb shell /data/local/tmp/misc_version -s 1.31.405.3"
it says the following:
--set_version set. VERSION will be changed to: 1.31.405.3
Patching and backing up partition 17...
Error opening backup file.

Have you tried this method of rooting... it is a one click tool, that roots, gains S-Off and installs clockworkmod - http://androidforums.com/desire-hd-...guide-dhd-all-things-root-roundup-sticky.html

 

[hengyongjie]

Hi,

I downloaded the aahk-25102011.zip
i extracted and follow the instructions from "effen-manual.html"

I uninstall all my htc sync and drivers. and i installed the USB driver from the tools\windriver\HTCDrivers3.0.0.007.exe

then now i run the "hack-ace.cmd"
it tells me "Enter the Pass Key".. or to read the effen manual..
seems like i've missed a step.

 

[El Presidente]

Hi,

I downloaded the aahk-25102011.zip
i extracted and follow the instructions from "effen-manual.html"

I uninstall all my htc sync and drivers. and i installed the USB driver from the tools\windriver\HTCDrivers3.0.0.007.exe

then now i run the "hack-ace.cmd"
it tells me "Enter the Pass Key".. or to read the effen manual..
seems like i've missed a step.

In the manual, the passkey is given in the FAQ section at the bottom.

 

[hengyongjie]

thanks! i flashed my phone with RCmix into sensation XL..

It seems pretty buggy.. but i can live with this! thank you!

 

[D-U-R-X]

You had put that you lost your contacts... they can be sync'd with google mail (worth doing, as you can always then have all contacts on your phone if you change ROM/phone)

 

[El Presidente]

thanks! i flashed my phone with RCmix into sensation XL..

It seems pretty buggy.. but i can live with this! thank you!

No probs, glad you're sorted.

Run Fix Permissions in ROM Manager if you're getting a lot of Force Closes, it can help resolve some issues.

 

[Xyro]

I'm trying the RCMix with the sensation base (not the sensation xl) and its all been relatively smooth, actually.

 

[hengyongjie]

contacts problem solved. I lost all contacts that were saved to phone.
apparently i thought all my contacts were saved to gmail. I only managed to retain contacts that were added after i got my HTC Desire HD, those were saved to gmail.

previously i find the LEDs at the 4 buttons and the keyboard vibrations feedback seems buggy.. they turn on and off at random.. it was because of some power economic settings by RCmix. adjusted the battery setting and its all good.

Thank you everybody!

 

[jboy]

Hi all,
got a few problems, this is when the bootloader is looking for the device and then it shows three different lines like this :
PD98IMG.zip
no image
PD98IMG.zip
no image or file (something along that line)
PD98IMG.zip

After the last line it the blue progress bar starts to move, does this mean that my goldcard has been accepted as i don't want the progress bar to complete then brick my phone because of the branded software?
Any ideas
Thanks Jboy

 

[El Presidente]

Hi all,
got a few problems, this is when the bootloader is looking for the device and then it shows three different lines like this :
PD98IMG.zip
no image
PD98IMG.zip
no image or file (something along that line)
PD98IMG.zip

After the last line it the blue progress bar starts to move, does this mean that my goldcard has been accepted as i don't want the progress bar to complete then brick my phone because of the branded software?
Any ideas
Thanks Jboy

If you're using the method in the first post, there is an easier one here: [TOOL] Advanced Ace Hack Kit (UPDATED 25-10-2011) - xda-developers

It does everything for you in a couple of clicks. You don't need to downgrade either so you won't lose apps and data.

 

[shushobhan]

Hi I am getting this error:

CID incorrect!
Update Fail!
press <Power> to reboot.

This happens after Step 6 of DOWNGRADE is complete. A gold progress bar while checking PD98IMG.zip completes and the error comes up.

I reboot the phone.

Since past 2 attempts this is happening.

I'm located in India with 2.3.3 Android and software version 2.37.720.3

Please help me in resolving this.

 

[El Presidente]

Hi shushobhan, that method is sort of outdated, you might want to the method linked to here instead: http://androidforums.com/desire-hd-...guide-dhd-all-things-root-roundup-sticky.html

 

[D-U-R-X]

For your info, that happened to me when I first tried to root... that's to do with needing a goldcard. As El Presidente says... the one click tool will sort the root for you... it doesn't need a goldcard!

 

[shushobhan]

Hi Presidente! Thanks for the info. This has rooted the phone successfully. Can you please tell me how to install CM7 MOD after launching ROM Manager?

 

[El Presidente]

In the same link I posted, there's an install guide for CM7 too, just scroll down a bit to the ROMs section.

Have a read about Titanium and the google contacts backup before you do anything though.

 

[shushobhan]

Thanks El great tips thanks a lot!

 

[El Presidente]

No probs! Shout if you get stuck

 

[shushobhan]

My Phone is stuck in the CM7 loading icon at boot. Not going past this screen. Is my phone nuked?

 

[El Presidente]

Nope, not at all. How long has it been like that for? First boot can take anything up to 15 mins.

If you've waited longer than that, take the battery out, put it back in. Turn the handset back on whilst holding volume down to take you into HBOOT. Select recovery to take you into clockwork again. Once there, select Wipe Data/Factory Reset, then head to Advanced and wipe the dalvik cache partition. Then flash both the CM7 zip and the google apps package again and see what happens.

 

[shushobhan]

Awesome! You rock El! I'm now into the phone working CM7. All looks fine Thanks a ton!

 

[El Presidente]

No worries, give LorDmods kernel a whirl, it's much better on battery life and performance wise. There's a link in the install thread.

 

[shushobhan]

Hi El, can we do a Internet Pass through within CM7? is it at all possible? if not then what alternative for connecting to Internet without Mobile Network or Wi-Fi.