Root Downgrade H-boot 1.15 or 1.19 for S-OFF

yarrimapirate said:

Confirmed working for 1.19

I just downgraded successfully again. Mac_Gyver, you may want to add this to the OP for easy reference... and THANKS for getting the ball rolling on this. You gave me enough information to take this and run with very little experience messing with low-level Android (but a little bit of Linux under my belt)

Here are some highlights:

• SU/Root is not needed for this to work. TWRP Recovery is needed however, so you need to unlock your bootloader.
  
• You will get the *** TAMPERED *** flag when you load the bootloader after doing this.

What I did before repeating this process:

• Relocked my bootloader (fastboot oem relock)
• Flashed Sprint 2.13 RUU with 1.12 Radio and 1.19 HBoot (and verified that it did indeed update HBoot again)

None of this is required, as I originally downgraded with Fresh 5.3.1 loaded. I just wanted to see if root was needed, and it isn't.

This was done on Kubuntu Precise (12.04) x64 but should work on any flavor of *buntu, Fedora, Debian, etc.

You will need:

• 
  EDIT: I've attached a file to this post with everything needed.

Standard disclaimers about this procedure possibly wiping out your entire extended family apply.

What to do:

Preparation: Unzip all the attachment files into a folder in your home directory. Open xterm/konsole/your favorite shell. CD to the folder you dumped everything into. Then:

Code:

$ chmod +x adb
$ chmod +x fastboot
$ chmod +x emmc_recovery_new
$ chmod +x brickdetect.sh

1. Unlock your bootloader with HTCDev Unlock (If you haven't already, So we can load TWRP)

2. Reboot to Bootloader (power+vol dn). Enter Fastboot. Plug your phone into the computer. (Duh)

3. Flash the TWRP Recovery image. This gives us ADB Shell ability before the ROM loads. (Maybe there's another way to do this?)

Code:

$ ./fastboot flash recovery openrecovery-twrp-2.1.8-jewel.img

4. Reboot the phone again. Enter Recovery. Just leave it at the main screen of TWRP.

5. Now we need to push the broken block 4 file onto the phones internal storage.

Code:

$ ./adb push ./spoofpartitions/mmcblk0p4 /sdcard/spoofp4

5. Enter ADB shell.

Code:

$ ./adb shell

6. Now we backup our current block 4 to internal storage so we can restore it later.

Code:

shell> dd if=/dev/block/mmcblk0p4 of=/sdcard/bakp4

7. Then we flash the broken block 4 in its place.

Code:

shell> dd if=/sdcard/spoofp4 of=/dev/block/mmcblk0p4

8. Now we EXIT shell. It is VITALLY IMPORTANT not to reboot the phone yet! You are kinda boned if you do.

Code:

shell> exit

9. Grab the backup block 4 from internal storage.

Code:

$ ./adb pull /sdcard/bakp4 ./bakp4

10. NOW we reboot.

Code:

$ ./adb reboot

*POOF* Your phone is now a brick. Hooray!
It won't even appear to turn on, nor will you have a charging light. This is normal.

11. Let's see if Linux sees the phone.

Code:

$ sudo dmesg | grep "qcserial"

You should see "Qualcomm USB modem converter detected" as the last line of the output. If not, you can unplug and replug the USB cable or run...

Code:

$ sudo modprobe qcserial

...to reload the driver.

12. Reset the driver, which removes any old block devices associated.

Code:

$ sudo modprobe -r qcserial

13. Now create the block device that emmc_recovery needs.

Code:

$ sudo mknod /dev/ttyUSB0 c 188 0

14. Emmc_recovery needs to know what disk to write to. An easy way to find this out is to run

Code:

$ sudo ./brickdetect.sh

Which will tell you if it sees your bricked phone, and also give the proper disk. Mine was /dev/sdc and so I use that in the following instructions. Replace /dev/sdc* with /dev/sdb* or /dev/sdd* or whatever yours is.

15. Now we load the 1.12 HBoot (how exciting!)

Code:

$ sudo ./emmc_recovery_new -f ./hboot_1.12_0000_signedbyaa.nb0 -d /dev/sdc12 -c 24576

You can hit enter at all of the prompts here. If it stalls at "Waiting for /dev/sdc12, hold the power button down on your phone for more than 30 seconds, then release it. 10 seconds or less after you do this, emmc_recovery will see your phone and proceed. Flashing Hboot will take several minutes, as it has to load data in ~23K chunks followed by a reset after each.

16. Once that is finished. We have to reset the qcserial driver again.

Code:

$ sudo modprobe -r qcserial

17. And then recreate the block device.

Code:

$ sudo mknod /dev/ttyUSB0 c 188 0

18. Now we restore our original block 4.

Code:

$ sudo ./emmc_recovery_new -f ./bakp4 -d /dev/sdc4 -c 24576

Again, if it hangs, hold your phone's power button for more than 30 seconds then release. This file will flash very quickly (it's only 1K) and once it completes, you'll immediately notice that your chargin light turns back on.

19. Unplug your USB cable and hold the power button to hard reset the phone. In a few seconds you'll be greeted by the familiar HTC screen. Enter bootloader and check out your HBoot version. 1.12!

20. Look for some pandas to feed.

I['m sure someone will boil this process down even further or script it. Hopefully this lets folks willing to brave a Linux shell accomplish this now though.

Click to expand...

closeone said:

This is what happens when I sleep though a lot of the day. Oops.

Thanks to yarrimapirate for the confirmation of partitions that have to be "zapped," you can expect a release of the new HBOOT Downgrade Toolkit by the end of the day (or soon thereafter).

~co~

Click to expand...

nobegging said:

going to get s-off on mine tonight (i'm hboot 1.12, went s-on 3 days after recieving my phone). Ive been watching this avadily the last couple days though, this is amazing work! I was going to root my wifes phone to s-on, now i think I'll wait for a scrited version of this. why go s-on and have to fart around with recovery to flash roms, when I can roll back to 1.12 and get s-off! 3 cheers for RXpert :beer:

Click to expand...