• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root [guide] How to manually downgrade and root inspire 4g or Desire HD

scotty85

Extreme Android User
Jul 25, 2010
11,131
7,412
WARNING! do NOT use this guide if your desire HD or Inspire shipped with gingerbread. will work on devices running GB,as long as they shipped with froyo.

first,let me explain that i do realize that this is old news. there are now tools,and other means of doing this,so practical value may be minimal. its mainly for fun. im sure there are others out there who enjoy entering things in a cmd window,and doing things "old skool" :)

i also do believe it is good for folks to have some basic adb skills. i remember being overwhelmed at the thot of dowloading the sdk and getting it set up to use,and this is intented to simplyfiy that,as well as give some basic knowledge/skill about entering commands.

this guide is for the folks that want to learn about manipulating your phone in cmd with adb and fastboot, and/or are like me and just enjoy it. :)

first and foremost,i take no credit for the exploits,or most of the commands. bits of code were takin from various places,whom i will try and give credit for.

i performed the process on an ATT branded inspire 4g,but i believe it should work on any branded inspire 4g or Desire HD(ACE). if anyone encounters a build that fre3vo fails to work on,please let us know.

credits
-special shout out to DHD master D-U-R-X for constantly dragging me into threads in the DHD and other forums(love it :D) and for giveing me some links that helped immensely figure out what to downgrade to,and some general info about ACE
-drellisdee on xda for figuring out how to downgrade the htc merge to s-offable vzw firmware. check out his original thread here where a good chunk of the links,code,and files came from. i used this basic concept in this guide.
-Scotty2 & Tmzt who wrote and developed the wpthis & gfree exploits for the G2
-sele and the crew in the "rescue squad" on the thunderbolt forum for what i like to call the "mini-adb" concept.
-whomever came up with the psneuter exploit
-whomever came up with fre3vo,wich im finding to work on numerous devices(including merge and thunderbolt). when i find out who you are,ill add you.
-CuBz for basic info and fre3vo commands http://androidforums.com/desire-hd-...b-build-downgrade-1-32-405-6-easy-follow.html
-alpharev/unrevoked for everything they do for the root community

and now,on to the info :)

WARNING! this process will wipe your data
1)download this file:
http://www.androidfilehost.com/main/Thunderbolt_Developers/scotty85/DHD-root-downgrade-soff.zip
md5:DHD-root-downgrade-soff.zip 30387396024ec615b875dc01cc9806c3

its a big downlod,as is contains the downgrade ruu,as well as adb/fastboot/md5sums utilities and all the exploits.

also download your carriers most recent RUU,or the most recent unbranded RUU,if you wish to debrand.
Shipped ROMs
and
FileFactory Folder View - Ace

2)install drivers
use these,from revolutionary: htc drivers

3)make a gold card
this is neccessary in order to flash an unbranded RUU. you should be able to skip this step if your ACE happens to be unbranded allready.
directions can be found here
use the app goldcard helper from market. if you use it skip right to the step of "Go to this page and enter this new number into the SD Card Serial (CID) field" and enter the output of the sdcard cid for mmc2 into the goldcard generator site.

i personally would just pick up a small spare sd to use for this. its not really worth the effort of backin up,transfering,etc. the contents of your current sd to make it into a gold card.

after youre done,place the gold card into the phone. no real need to move stuff from your original sd card to the gold card,youll only need it this once.

4)prepare to downgrade
take the DHD-root-downgrade-soff.zip file and extract it if you need to. inside you will find another,same named folder. inside that folder you find a folder called "mini-adb_inspre". take this folder,and move it to your c drive on your computer,however you are comfortable. copy/paste,drag/drop,however is fine. you just want an unzipped mini-adb_inspire on your c drive.

open a CMD window. on windows 7,click the start bubble,type "command" or "cmd" in the search box. this should open a small black window. may be same or similar for other windows versions.

enable usb debugging in settings/apps/development. disable fastboot in settings/power. plug in your phone,and select charge only mode.

now type in the cmd window,at the prompt: cd c:\mini-adb_inspire

this should change your prompt to c:\mini-adb_inspire>

5)downgrade with adb
from this point forward,all commands will be in bold you can copy,then paste them into the cmd window,one at a time. blue are just additional info/comments,and should not be copy/pasted

md5sums RUU_Ace_HTC_WWE_1.32.405.6_Radio_12.28b.60.140e_26.03.02.26_M_release_155891_signed.zip
(make sure there are no spaces in your cmd command/ruu name if you get an error when running it)
it should spit out a few things,then a value of: c3d244a9f056e48ee3851a14ff52204c if you dont get this value,do not continue


adb devices should return your serial number,indicating your connected
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell /data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF (if you fail to get temp root,try at least once to reboot the phone,and restart step 4)

adb push misc_version /data/local/tmp
adb shell chmod 777 /data/local/tmp/misc_version
adb shell /data/local/tmp/misc_version -s 1.31.405.3

adb reboot bootloader

fastboot devices again,should return your serial number

fastboot getvar mainver should return 1.31.405.3 if not,something went wrong,reboot and start over step 5

fastboot getvar cid (will tell you y our stock CID. make ote of it if you think yuo may want to restore it later)

fastboot oem rebootRUU should boot your phone to a black screen with htc in the center
fastboot flash zip RUU_Ace_HTC_WWE_1.32.405.6_Radio_12.28b.60.140e_26.03.02.26_M_release_155891_signed.zip will flash the downgrade fimrware. it can take quite a while to push,and do the checks,so be patient. remember your goldcard must be in the phone,and if you get a cid failure/error,then your gold card was not made correctly. if you get a "cannot open" failure,make sure there are no spaces in the cmd command/ruu name.

after the firmware flashes:
fastboot reboot-bootloader should reboot you to the 0.85.0007 hboot of the 1.32.405.6 downgrade firmware

fastboot reboot will reboot your phone

6)s-off,superCID,simunlock with gfree

once booted to the old firmware, skip the startup stuff,enable usb debugging. then:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb push gfree /data/local/

adb shell
chmod 0755 /data/local/psneuter
chmod 0755 /data/local/wpthis
chmod 0755 /data/local/gfree
/data/local/psneuter (to get temp root again)

adb shell

/data/local/wpthis (to disable emmc write protect)
/data/local/gfree -f (this will supercid, simunlock, and s-off phone)

exit to get back to your mini-adb_inspire> prompt

adb reboot bootloader boot you to bootloader. verify s-off

fastboot getvar all will output a few variables

fastboot reboot to reboot your phone

7)finishing up
at this point you should run your carriers most recent,up to date ruu to get back on the most current firmware. this is important. you do not want to be running around on old,outdated radios and firmware. also,there are issuers with some ACE models not being compatible with the sound in the downgrade software. so dont freak out if your sound doesnt work on the downgrade. just flash your upgrade ruu and it will work again. :)

you can root this firmware by:
-install a recovery as a PD98IMG cwm-5.0.2.7-ace
-flash superuser files in recovery superuser 3.0.7

or,you can alternately flash a rom instead of flashing the root files. either way,its a good idea,IMO,to make a backup of your stock unrooted rom,in case you need it :)

last and not least,here are what you should see in your cmd window:
red are my copy/pasted inputs. blue are additional coments
1) downgrade session
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_inspire[/COLOR]

c:\mini-adb_inspire>[COLOR="red"]md5sums RUU_Ace_HTC_WWE_1.32.405.6_Radio_12.28b.60.140e_26.0
3.02.26_M_release_155891_signed.zip[/COLOR]

MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+
Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/
Type md5sums -h for help

[Path] / filename                              MD5 sum
-------------------------------------------------------------------------------
[c:\mini-adb_inspire\]
RUU_Ace_HTC_WWE_1.32.405.6_Radio_12.28... 100% c3d244a9f056e48ee3851a14ff52204c [COLOR="Blue"]<-must match[/COLOR]

c:\mini-adb_inspire>[COLOR="Red"]adb devices[/COLOR]
List of devices attached
HTxxxxxxxxxx    device

c:\mini-adb_inspire>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR]
797 KB/s (9796 bytes in 0.012s)

c:\mini-adb_inspire>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR]

c:\mini-adb_inspire>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start FBB00000 -end[/COLOR]
 FFFFFFFF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
  id: msmfb
  smem_start: 802160640
  smem_len: 3145728
  type: 0
  type_aux: 0
  visual: 2
  xpanstep: 0
  ypanstep: 1
  line_length: 1920
  mmio_start: 0
  accel: 0
fb_var_screeninfo:
  xres: 480
  yres: 800
  xres_virtual: 480
  yres_virtual: 1600
  xoffset: 0
  yoffset: 0
  bits_per_pixel: 32
  activate: 16
  height: 106
  width: 62
  rotate: 0
  grayscale: 0
  nonstd: 0
  accel_flags: 0
  pixclock: 0
  left_margin: 0
  right_margin: 0
  upper_margin: 0
  lower_margin: 0
  hsync_len: 0
  vsync_len: 0
  sync: 0
  vmode: 0
Buffer offset:      00000000
Buffer size:        8192
Scanning region fbb00000...
Potential exploit area found at address fbb6cc00:1400.
Exploiting device...

c:\mini-adb_inspire>[COLOR="red"]adb push misc_version /data/local/tmp[/COLOR]
1189 KB/s (15837 bytes in 0.013s)

c:\mini-adb_inspire>[COLOR="red"]adb shell chmod 777 /data/local/tmp/misc_version[/COLOR]

c:\mini-adb_inspire>[COLOR="red"]adb shell /data/local/tmp/misc_version -s 1.31.405.3[/COLOR]
--set_version set. VERSION will be changed to: 1.31.405.3
Patching and backing up partition 17...

c:\mini-adb_inspire>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\mini-adb_inspire>[COLOR="red"]fastboot devices[/COLOR]
HTxxxxxxxxxx    fastboot

c:\mini-adb_inspire>[COLOR="red"]fastboot getvar mainver[/COLOR]
mainver: 1.31.405.3 [COLOR="Blue"]<-must match[/COLOR]
finished. total time: 0.001s

c:\mini-adb_inspire>[COLOR="Red"]fastboot getvar cid[/COLOR]  [COLOR="Blue"](optional. do if you want to know your stock cid)[/COLOR]
cid: CWS__001
finished. total time: 0.000s

c:\mini-adb_inspire>[COLOR="Red"]fastboot oem rebootRUU[/COLOR]
                              ... OKAY [  0.167s]
finished. total time: 0.168s

c:\mini-adb_inspire>[COLOR="red"]fastboot flash zip RUU_Ace_HTC_WWE_1.32.405.6_Radio_12.28b.60.140e_26.03.02.26_M_release_155891_signed.zip[/COLOR] [COLOR="Blue"](if you get an error check for spaces)[/COLOR]
     sending 'zip' (336097 KB)... OKAY [ 55.460s]
                 writing 'zip'... INFOzip header checking...
INFOshift signature_size for header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOstart image[hboot] unzipping for pre-update check...
INFOstart image[hboot] flushing...
INFO[RUU]WP,hboot,0
INFO[RUU]WP,hboot,100
INFOstart image[radio] unzipping for pre-update...
INFOstart image[radio] flushing...
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,100
...
...   [COLOR="blue"](many lines of similar [/COLOR]
...   [COLOR="blue"]removed for simplicity)[/COLOR]
...
INFO[RUU]UZ,dzdata,0
INFO[RUU]UZ,dzdata,100
INFO[RUU]WP,dzdata,0
INFO[RUU]WP,dzdata,100
INFOstart image[rcdata] unzipping & flushing...
INFO[RUU]UZ,rcdata,0
INFO[RUU]WP,rcdata,0
INFO[RUU]WP,rcdata,100
OKAY [ 78.951s]
finished. total time: 135.884s

c:\mini-adb_inspire>[COLOR="Red"]fastboot reboot-bootloader[/COLOR]
     rebooting into bootloader... OKAY [  0.155s] [COLOR="Blue"]will reboot to fastboot. verify 0.85.0007[/COLOR]
finished. total time: 0.155s

c:\mini-adb_inspire>[COLOR="red"]fastboot reboot[/COLOR]
                     rebooting...
finished. total time: 0.155s

c:\miniadb_inspire>

2)gfree session
Code:
c:\mini-adb_inspire>[COLOR="Red"]adb push psneuter /data/local/[/COLOR]
1371 KB/s (585731 bytes in 0.417s)

c:\mini-adb_inspire>[COLOR="red"]adb push busybox /data/local/[/COLOR]
1408 KB/s (1062992 bytes in 0.737s)

c:\mini-adb_inspire>[COLOR="red"]adb push wpthis /data/local/[/COLOR]
1429 KB/s (679475 bytes in 0.464s)

c:\mini-adb_inspire>[COLOR="red"]adb push gfree /data/local/[/COLOR]
1458 KB/s (134401 bytes in 0.090s)

c:\mini-adb_inspire>[COLOR="red"]adb shell[/COLOR]
$ [COLOR="red"]chmod 0755 /data/local/psneuter[/COLOR]
chmod 0755 /data/local/psneuter
$ [COLOR="red"]chmod 0755 /data/local/wpthis[/COLOR]
chmod 0755 /data/local/wpthis
$ [COLOR="red"]chmod 0755 /data/local/gfree[/COLOR]
chmod 0755 /data/local/gfree
$ [COLOR="red"]/data/local/psneuter[/COLOR]
/data/local/psneuter
property service neutered.
killing adbd. (should restart in a second or two)

c:\mini-adb_inspire>[COLOR="red"]adb shell[/COLOR]
# [COLOR="red"]/data/local/wpthis[/COLOR]
/data/local/wpthis
Build: 25
Section header entry size: 40
Number of section headers: 45
Total section header table size: 1800
Section header file offset: 0x00014e90 (85648)
Section index for section name string table: 42
String table offset: 0x00014cc7 (85191)
Searching for .modinfo section...
 - Section[16]: .modinfo
 -- offset: 0x00000f80 (3968)
 -- size: 0x000000c4 (196)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Loading module... OK.
Write protect disabled.
Searching for mmc_blk_issue_rq symbol...
 - Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40001000
Searching for brq filter...
 - Address: 0xc02a9e00 + 0x34c
 - 0x2a000012 -> 0xea000012
Done.
# [COLOR="red"]/data/local/gfree -f[/COLOR]
/data/local/gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
 - Section[16]: .modinfo
 -- offset: 0x00000a14 (2580)
 -- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
 - Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
 - Address: 0xc02a9e00 + 0x34c
 - ***WARNING***: Found fuzzy match for brq filter, but conditional branch is
. (0xea000012)
Patching and backing up partition 7...
patching secu_flag: 0
Done.
# [COLOR="red"]exit[/COLOR]
exit

c:\mini-adb_inspire>[COLOR="red"]adb reboot bootloader[/COLOR]

c:\mini-adb_inspire>[COLOR="red"]fastboot getvar all[/COLOR]
INFOversion: 0.5
INFOversion-bootloader: 0.85.0007
INFOversion-baseband: 26.03.02.26_M
INFOversion-cpld: None
INFOversion-microp: 0438
INFOversion-main: 1.32.405.6
INFOserialno: HT18LT211769
INFOimei: 358920041110039
INFOproduct: ace
INFOplatform: HBOOT-7230
INFOmodelid: PD9812000
INFOcidnum: 11111111  [COLOR="Blue"]<-superCID[/COLOR]
INFObattery-status: good
INFObattery-voltage: 4196mV
INFOpartition-layout: Generic
INFOsecurity: off  [COLOR="Blue"]<- s-off[/COLOR]
INFObuild-mode: SHIP
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: dirty-7eafc656
INFOhbootpreupdate: 11
INFOgencheckpt: 0
all: Done!
finished. total time: 0.024s

c:\mini-adb_inspire>[COLOR="Red"]fastboot reboot[/COLOR]
                     rebooting...
finished. total time: 0.215s

c:\mini-adb_inspire>

IMAG0094.jpg


IMAG0098.jpg
 
i ruined a htc inspire with the ace hack kit so im kinda leary about trying this

The other guide is possibly a little safer,I'd prolly recomend.it over this one. In order to use this you must be 110% certain the phone SHIPPED with froyo

Don't do anything you're not comfortable with :)

sorry for the vaugness earlier,i had nott realized this post was in the inspire forum :eek:

this is the other thread i am refering to:
http://androidforums.com/desire-hd-...-s-off-simunlock-supercid-inspire-4g-dhd.html

just holler if you have questions :)
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones