Root [how to] HoneyComb root,downgrade,and achieve s-off

[scotty85]

this is a guide to ultimately achieve a patched s-off hboot on your honeycomb htc flyer.

the basic steps will be:
1)unlock with htcdev,install recovery and root
2)downgrade to gingerbread
3)run revolutionary
4)install honeycomb s-off hboot,firmware and rom

a couple credits:
-Team Revolutionary for the S-OFF and IEF for hboot
-attn1 for the revolutionary version of clockwork recovery
-Paul O'Brien for getting his hands on the early leaks,and patching clockwork to work with HC
-globatron for the initial HC hboot,upgrade RUUs, and upgrade method found here: http://forum.xda-developers.com/showthread.php?t=1358758

first,download these files:
1)varioius_htc_exploits.zip

2)one of the following honeycomb upgrades,depending on the version of your flyer:
a) if you have a wifi/3g flyer: http://hyuh.net/files/flyer/PG41IMG-3G-B09.zip
md5: D6BA3D134B9D60C865187F42C66B996B

b)non-us wifi only flyer: http://hyuh.net/files/flyer/PG41IMG-WIFI-B10.zip
md5: f215eec88fe4b000cc9b3063c0724bdc

c)us wifi(best buy) flyer: http://hyuh.net/files/flyer/RUU_US_WIFI_B10.zip
md5: 8ffedc67d4c1032e601e81adf0cfebe3

3)a downgrade ruu. you will have to do a little bit of research on this. i will try and assemble a collection of what works with what,but for now,you need to find a gingerbread ruu that contains 1.10.0000 or 1.11.0003,and is compatible with your current CID. the easiest way,is to look at your build number: x.xx.xxx.x, where xxx will be unique to an unbranded ruu,or a specific carrier.

for example: 3.61.1540.31 is a us wifi HC. to downgrade,you would use 2.27.1540.3,wich contains hboot 1.11.0003

an alternate method would be to simply create a goldcard,so you could downgrade to any ruu that you wanted.

available ruus are found here and here

i recomend to extract "rom.zip" from a .exe file in the following manner:
-run the utility
-check the "i understand" box and move on to screen 2
-hide the utility out of site temporarily
-search your C drive for "rom.zip". you will find it in a temporary location
-transfer rom.zip from the temporary location to somewhere you can find it easily on the PC(such as the desktop)
-unhide and cancel the utility
____________________________________________________________________________________

1)unlock with htcdev,install recovery and root

Spoiler

use this guide: http://androidforums.com/flyer-all-things-root/645207-guide-unlock-htcdev-install-recovery-root.html

2)downgrade to gingerbread

Spoiler

1)extract various_htc_exploits,and then extract the zipped folder inside. move the file named "misc_version" into the mini-adb folder that you used to htcdev unlock

2)trasnfer rom.zip from your .exe above(or your downloaded zip file,if your downgrade ruu was allready a .zip file) into mini-adb as well

3)change the main version:
-open a cmd window

-change to your mini adb directory. enter:
cd c:\foldername

(example: cd c:\mini-adb if you didnt change the name)

plug in your flyer,enable usb debugging,turn off fastboot in settings/power

md5sums downgradefilename.zip compare the output to a known md5 sum,if available

md5sums misc_version should return 050f55d34ddbcc860efa5982491437de

adb devices should return your flyers serial number. indicating drivers are working,and youre connected.

adb push misc_version /data/local/tmp/misc_version

adb shell should change your prompt to a #if not,have your phone awake and watch the screen to grant superuser permissions when you enter su

chmod 777 /data/local/tmp/misc_version *have your phone awake and be watching it,incase superuser needs you to grant permission

/data/local/tmp/misc_version -s 1.00.000.0

exit exit again if your promt changes to a $

adb reboot bootloader

fastboot devices again,this should output your serial number,indicating youre connected and drivers are working

fastboot getvar mainver it should output 1.00.000.0 if it does,then procede. if not,something above was not entered correctly,and the downgrade will not flash. reboot your phone using the command fastboot reboot and start again at step 2.

if you did get 1.00.000.0 then continue:

fastboot oem lock *may casue a security warning if youre on a cusom rom,or extrememly modded stock rom. if it does,dotn panic,this is normal. in a worse case if the ruu wont flash,yo can simply re-unlock with your original unlock token. if your phone reboots,thats ok. let it boot,re-enable usb bebug,and adb reboot bootloaderback to fastboot

fastboot erase cache

fastboot oem rebootRUU

fastboot flash zip downgradefilename.zip

this part will take some time,so please be patient,its not hung. it will check the file,send it,then start writing. do not under any circumstance interupt the flyer while the writing is flashing in the cmd window,indicating partitions are being written to.

if it fails with a hboot pre-update,dont panic,this is normal just enter again:
fastboot flash zip downgradefilename.zip

this time it will finish.

once you get OKAY and finished. total time: xxx.xxxs then:[/COLOR]

fastboot reboot-bootloader

this will take your phone out of RUU mode,and back to fastboot. note that you now have hboot 1.10.0000 or 1.11.0003(depending on your downgrade)

fastboot reboot will boot you fully into the revolutionary-able gingerbread firmware.

3)run revolutionary

Spoiler

download and run Revolutionary

4)install honeycomb s-off hboot,firmware and rom

Spoiler

-place the honeycomb upgrade into your mini-adb/fastboot folder. once youre ready to upgrade to s-off,rooted honeycomb:

-open a cmd window

-change to your mini adb directory. enter:
cd c:\foldername

(example: cd c:\mini-adb if you didnt change the name)

-plug in your flyer,enable usb debugging,turn off fastboot in settings/power

-check the md5sum
md5sums upgradefilename.zip (it should match the md5 provided with the download above)

-then:
adb devices

if you get a serial number,then
adb reboot bootloader

once in fastboot
fastboot devices

if you get your serial number back,flash the upgrade ruu:
fastboot erase cache

fastboot oem rebootRUU

fastboot flash zip upgradefilename.zip

as above,if it fails with a hboot pre-update,dont panic,this is normal just enter again:
fastboot flash zip upgradefilename.zip

this time it will finish

fastboot reboot-bootloader

note that you are now on honeycomb compatible revolutionary hboot 6.11.1111

fastboot reboot will reboot your flyer.

congratulations,youre done. the upgrade ruu has installed 6.11.1111 hboot and matvhing firmware,clockwork recovery,and a rooted stock 3.55.405.1 build.

you are free to enjoy as is,or go back and flash a custom rom.

 

[davito888]

hi you have great post of htc flyer but fond late and i have same of the problems when i take instruction xda developers post. can you help me ?
i will try to understand what happen for me
1 unlock with htcdev done
2.flash a recovery
i type this command but some of the command type wrong and when reboot htc flyer i view only black screen and after make some command key power and down vol goes at fastboot and when i choice recovery started revolutionary CWM 4 i change commands factory recover don't work but few day micro sd card view update android 4.0.1 not working. i think micro sd card helps get partition but after that don't saw sd card.

I am confused as to what to do

 

[arunjayaseelan]

I am having issue at this particular step:

adb devices should return your flyers serial number. indicating drivers are working,and youre connected.

adb push misc_version /data/local/tmp/misc_version

adb shell should change your prompt to a #if not,have your phone awake and watch the screen to grant superuser permissions when you enter su

chmod 777 /data/local/tmp/misc_version *have your phone awake and be watching it,incase superuser needs you to grant permission

/data/local/tmp/misc_version -s 1.00.000.0

At this point I get the following message:

/sbin/sh: /data/local/tmp/misc_version: not found

Looks like the system is trying to execute from /sbin/sh . should I just add this as an environment variable?

By the way I am executing all these commands while in recovery because I tried upgrading to dexter jelly bean rom without rolling back to the old hboot version. Now my tablet won't boot. Please help me get past this step. I've unlocked and rooted other devices before. This is the first time I am dealing with changing Hboot version.

Also thanks for this step by step instruction for HTC flyer. I was very happy to find your post after a lot of searching.

 

[scotty85]

I am having issue at this particular step:

adb devices should return your flyers serial number. indicating drivers are working,and youre connected.

adb push misc_version /data/local/tmp/misc_version

adb shell should change your prompt to a #if not,have your phone awake and watch the screen to grant superuser permissions when you enter su

chmod 777 /data/local/tmp/misc_version *have your phone awake and be watching it,incase superuser needs you to grant permission

/data/local/tmp/misc_version -s 1.00.000.0

At this point I get the following message:

/sbin/sh: /data/local/tmp/misc_version: not found

Looks like the system is trying to execute from /sbin/sh . should I just add this as an environment variable?

By the way I am executing all these commands while in recovery because I tried upgrading to dexter jelly bean rom without rolling back to the old hboot version. Now my tablet won't boot. Please help me get past this step. I've unlocked and rooted other devices before. This is the first time I am dealing with changing Hboot version.

Also thanks for this step by step instruction for HTC flyer. I was very happy to find your post after a lot of searching.

what hboot are you currently running? you are a bit confused,you need to be on honeycomb firmware in order to run dexters jellybean.

im going to assume that your flyer is not booting,because you have not successfully installed the boot image. you can get it working in a couple different ways,if thats the case:
-fastboot flash the dexter boot image
-restore a backup that uses the kernel on the tablet(i.e.,what was there prior to trying to flash JB)
-flashing a stock rom
-flashing a stock RUU(youll need to relock)

you may want to consider getting the tablet booting,so you can more easily downgrade,as acheiving s-off will make your life immensely easier for flashing roms and modding your flyer. as you prolly know,youll need to go back to GB so you can run revolutionary,then install the HC s off hboot from there.

if you wish to continue on your path of running the commands in recovery,youll need to mount data prior to running misc_version:

adb shell mount /data

id do it after adb devices,prior to pushing misc version. i just ran thru it in recovery on mine:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Users\Scott>[COLOR="red"]cd c:\miniadb_flyer[/COLOR]

c:\miniadb_flyer>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HTxxxxxxxxxx    recovery


c:\miniadb_flyer>[COLOR="red"]adb shell mount /data[/COLOR]

c:\miniadb_flyer>[COLOR="red"]adb push misc_version /data/local/tmp/misc_version[/COLOR]
3983 KB/s (367096 bytes in 0.090s)

c:\miniadb_flyer>[COLOR="red"]adb shell[/COLOR]
~ # [COLOR="red"]chmod 777 /data/local/tmp/misc_version[/COLOR]
chmod 777 /data/local/tmp/misc_version
~ # [COLOR="red"]/data/local/tmp/misc_version -s 1.00.000.0[/COLOR]
/data/local/tmp/misc_version -s 1.00.000.0
--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up misc partition...
~ # [COLOR="red"]exit[/COLOR]
exit

c:\miniadb_flyer>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\miniadb_flyer>[COLOR="red"]fastboot getvar mainver[/COLOR]
mainver: 1.00.000.0
finished. total time: 0.001s

c:\miniadb_flyer>

if you still have prollems at that point,you can try a reboot of the pc and device(even if it wont fully boot) try some different usb ports and cables,make sure yuor not using a hub or usb 3.0. make sure nothign is running on the PC(htc sync,pdanet,easy tether,even itunes,etc)

failing all that,the filesystem of JB may just be different. best bet at this point is to restore a backup or run an ruu to get back to a working tablet,and start over with the process from stock HC

 

[scotty85]

hi you have great post of htc flyer but fond late and i have same of the problems when i take instruction xda developers post. can you help me ?
i will try to understand what happen for me
1 unlock with htcdev done
2.flash a recovery
i type this command but some of the command type wrong and when reboot htc flyer i view only black screen and after make some command key power and down vol goes at fastboot and when i choice recovery started revolutionary CWM 4 i change commands factory recover don't work but few day micro sd card view update android 4.0.1 not working. i think micro sd card helps get partition but after that don't saw sd card.

I am confused as to what to do

i am a little confused as to what your isuues are,exactly. is the flyer booting,and working? do you have recovery installed?

 

[arunjayaseelan]

First of all... thanks for responding. Here is a more structured summary:

My Flyer was upgraded to Honey Comb before I decided to root and install JB.

I followed the steps to get the device unlocked using the HTC dev site.

I also installed recovery.

Then installed Super User.

I downloaded the correct RUU (Brightstar_wwe_1540). Haven't downgraded yet.

Tried changing the main version with is the steps that I had mentioned in the previous post and kept running into the issue. may be I should try mounting /data. I will try that and let you know what happens.

But I googled online and learned that S-off is not required for flashing ROMs so went ahead and flashed the JB rom (installed the tablet UI). Maybe I should have not done this without changing the Hboot version.

I cleared cache, Dalvik cache and also took a backup and did a factory reset before flashing the JB ROM.

Tried restoring the back up. Restoration completes successfully but tablet wont boot. Same behavior as the JB rom. I get the white HTC screen and then a blank black screeen. I can tell the screen is back lit but is blank. Turns off if i press and hold the power button long enough.

Once again thanks for the response. I am going to try mounting /data. Sorry... I'm not well versed with android or unix/linux

 

[scotty85]

again,you dont need to change the hboot version. as i said above,the prollem is that your recovery has not installed a compatible kernel,youll need to install it manually.

technically it is true that you can flash roms while s on. however,with s on flashing,the recovery CANNOT INSTALL THE KERNEL. IT MUST BE INSTALLED MANUALLY

process for s on flashing will go like this:
-open rom download AND find boot.img
-transfer boot.img to adb/fastboot folder
-place rom on sd card
-boot to recovery
-make a backup
-wipe data/cache/dalvik
-flash rom
-boot to fastboot
-install kernel(boot.img) with this command:
fastboot flash boot boot.img

-after you have a successfull boot image flash,you can then reboot with this fastboot command:
fastboot reboot

and you will need to do that basic process EVERY TIME you want to flash a rom,or restore a backup,thats using a different kernel.

s off may not be needed to flash roms,but it will make your life immensely easier

hope that clears it up some

 

[davito888]

If you do not have a problem add me skype ID davito-84 . i explain what i am doing.
my htc flyer get start is a black screen after i push Power Button and Down Button restart view fastboot screen and i connect usb cable htc flyer but view that error

i choice recovery mode started CWM recovery. tell me what i am doing

 

[davito888]

okey guy

please tell me if nothing write on the htc flyer. how i install basic android any version write instruction
what i am doing anybody help me

 

[scotty85]

so,if i understand correctly,your flyer only gets a bkack screen if you try and boot,but you can still get to bootloader.

why dont you tell me the info in the hboot screen,and then put it into fastboot mode,and do this:

first download and install these drivers: revolutionary drivers (mirror)

then,download this small file:
mini-adb.zip

-unzip it,and place the unzipped folder onto the root of your C drive(not inside a folder)

-open a cmd window(with win 7,click start bubble,type "command" or "cmd" in hte search box)

-now change to your mini-adb directory(assuming you didnt chagne the name). type in the black cmd window that opened on your PC:
cd c:\mini-adb

-pull the battery in your phone for a few seconds. hold volume down,then power. hold them both until you see the white/colored writing hboot screen

-select "fastboot" from the hboot menu with the vol rocker/power button

-in your cmd window type:
fastboot devices

it should output your phones serial number. if so youre good to go. if not,youre apparently having a driver issue. i usually recomend these drivers from Revolutionary: modified htc drivers download and install the drivers(you should just have to run that file). afterwards,unplug your phone,plug it back in. make sure its in fastboot. as soon as you get a result from "fastboot devices" your ready to procede to the next step.

-in your cmd window,type(or copy/paste,is much easier):
fastboot getvar all

-copy the info that outputs here. right click in your cmd window,click mark,highlight it all in white. hit enter. paste the info here. it will help us know which ruu for you to run.

if you allready have adb/fastboot and working drivers,you dont need to follow step by step,but what is important is the output of the fastboot getvar all command.

 

[davito888]

more thanks i do it what do you say

C:\mini-adb>fastboot getvar all
INFOversion: 0.5
INFOversion-bootloader: 1.11.0011
INFOversion-baseband: 3822.10.08.07
INFOversion-cpld: None
INFOversion-microp: 0950
INFOversion-main: 3.61.1540.31
INFOserialno: HT15EJN03277
INFOimei: 355195000000017
INFOproduct: flyer
INFOplatform: HBOOT-7230
INFOmodelid: PG4140000
INFOcidnum: BS_US001
INFObattery-status: low
INFObattery-voltage: 3491mV
INFOpartition-layout: Generic
INFOsecurity: on
INFObuild-mode: SHIP
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: f0e1145e
INFOhbootpreupdate: 12
INFOgencheckpt: 0
all: Done!
finished. total time: 0.016s

 

[davito888]

more thanks i do it what do you say

C:\mini-adb>fastboot getvar all
INFOversion: 0.5
INFOversion-bootloader: 1.11.0011
INFOversion-baseband: 3822.10.08.07
INFOversion-cpld: None
INFOversion-microp: 0950
INFOversion-main: 3.61.1540.31
INFOserialno: HT15EJN03277
INFOimei: 355195000000017
INFOproduct: flyer
INFOplatform: HBOOT-7230
INFOmodelid: PG4140000
INFOcidnum: BS_US001
INFObattery-status: low
INFObattery-voltage: 3491mV
INFOpartition-layout: Generic
INFOsecurity: on
INFObuild-mode: SHIP
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: f0e1145e
INFOhbootpreupdate: 12
INFOgencheckpt: 0
all: Done!
finished. total time: 0.016s

now i have error android 1.0

 

[davito888]

i found my note if you need

modelid: PG4140000 (Wifi Flyer)
RUU_Flyer_BrightstarUS_cidnum: BS_US001

i think if we will be online problem make easy

my skype ID davito-84 add me if you not be problem

 

[scotty85]

ok,there is not an available ruu for the HC wifi brightstar upgrde. prolly best thing at this point,is to lower the main version and flash the downgrade ruu.

since youre flyer is not booting,you will need to do the adb steps in recovery.

since you are unlocked,follow the dirctions in the first post to flash or boot recovery.

once in recovery,youll need to follow the directions froma few posts up to lower main version in recovery:

if you wish to continue on your path of running the commands in recovery,youll need to mount data prior to running misc_version:

adb shell mount /data

id do it after adb devices,prior to pushing misc version. i just ran thru it in recovery on mine:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


C:\Users\Scott>[COLOR="red"]cd c:\miniadb_flyer[/COLOR]

c:\miniadb_flyer>[COLOR="red"]adb devices[/COLOR]
List of devices attached
HTxxxxxxxxxx    recovery


c:\miniadb_flyer>[COLOR="red"]adb shell mount /data[/COLOR]

c:\miniadb_flyer>[COLOR="red"]adb push misc_version /data/local/tmp/misc_version[/COLOR]
3983 KB/s (367096 bytes in 0.090s)

c:\miniadb_flyer>[COLOR="red"]adb shell[/COLOR]
~ # [COLOR="red"]chmod 777 /data/local/tmp/misc_version[/COLOR]
chmod 777 /data/local/tmp/misc_version
~ # [COLOR="red"]/data/local/tmp/misc_version -s 1.00.000.0[/COLOR]
/data/local/tmp/misc_version -s 1.00.000.0
--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up misc partition...
~ # [COLOR="red"]exit[/COLOR]
exit

c:\miniadb_flyer>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\miniadb_flyer>[COLOR="red"]fastboot getvar mainver[/COLOR]
mainver: 1.00.000.0
finished. total time: 0.001s

c:\miniadb_flyer>

if you still have prollems at that point,you can try a reboot of the pc and device(even if it wont fully boot) try some different usb ports and cables,make sure yuor not using a hub or usb 3.0. make sure nothign is running on the PC(htc sync,pdanet,easy tether,even itunes,etc)

youce you have lowered the main version successfully,then place the flyer in fastboot,and run the 2.27.1540.3(or older) brightstar RUU.

once the flyer is booting with that software,you can run revolutionary and become s off,then follow the rest of the guide to update back to honeycomb

 

[Agentluke]

hi you have great post of htc flyer but fond late and i have same of the problems when i take instruction xda developers post. can you help me ?
i will try to understand what happen for me
1 unlock with htcdev done
2.flash a recovery
i type this command but some of the command type wrong and when reboot htc flyer i view only black screen and after make some command key power and down vol goes at fastboot and when i choice recovery started revolutionary CWM 4 i change commands factory recover don't work but few day micro sd card view update android 4.0.1 not working. i think micro sd card helps get partition but after that don't saw sd card.

I am confused as to what to do

i tried the method recomended above but i dont get rom.zip , i get ruu.log in the c drive.. please help.. sorry for replying this way i am new at this '-'