This guide is written for anyone who has "Stock Gingerbread" to downgrade their phone which originally had "Stock Froyo". The following is a list of phone models this guide is intended for and that are known to work:
Working Phone Models:
G2 (Vision)
Desire Z (Vision)
myTouch 4G (Glacier)
Desire HD (Ace)
It should also be noted, this guide WILL NOT work with the following:
myTouch 4G Slide (Doubleshot)
Desire HD (Ace) w/ Sense 3.x (a recent OTA update as patched this method).
Table of Contents
Sections
Introduction
Gaining Temp Root
Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
Temp-Rooting to Backup (*Optional*)
Downgrading
Sources
Troubleshooting
Change Log
Attachments
Introduction
This guide is written with the assumption that the user has previously used "adb". If you are unfamiliar with "adb" or do not even know what "adb" is, download the Android SDK (found at
http://developer.android.com/sdk/index.html). There are a couple guides to help you get started setting up the Android SDK and understanding ADB. If you have not installed the Android SDK or you are unfamiliar with ADB, please take some time and read a couple guides to get a basic understanding of it.
[GUIDE] ADB Workshop and Guide for everyone
[HOW-TO] ADB for Dummies(How-To Learner's Guide)
How To Set Up ADB/USB Drivers for Android Devices
Gaining Temp Root
Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file sta gran ceppa di minchia terrona of the fre3vo.zip file and the misc_version file sta gran ceppa di minchia terrona the misc_version_01.zip file in your platform-tools directory.).
Make sure you have your sdcard inserted in your phone, and you are NOT in USB Storage Mode, and your sdcard is NOT FULL.
Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)
Code:
> adb shell cat /dev/msm_rotator
/dev/msm_rotator: invalid length
If you received the same message, you're good to continue on. If not... I'd recommend going back to #g2root and asking them. (I am just passing along the information after all).
Run the following commands from your platform-tools directory.
Code:
> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
After you enter that command, with luck you should see something similar to the last few lines in the following displayed. (It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)
Code:
Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...
If the exploit works, you will be kicked out of ADB shell, proceed to Step #8.
If the above does not work, and fails, you can try the following, and hopefully one will work, try the following (you must reboot your phone before you try another set):
Code:
$ /data/local/tmp/fre3vo -debug -start 10000000 -end 1FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 20000000 -end 2FFFFFFF
$ /data/local/tmp/fre3vo -debug -start 30000000 -end 3FFFFFFF
$ /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
$ /data/local/tmp/fre3vo -debug -start E0000000 -end EFFFFFFF
If you did get kicked out of adb shell, open it again. You should now see the lovely # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.
Code:
> adb shell
# exit
Changing Version Number to Allow Downgrade and Gaining SuperCID with a Goldcard
If you followed the first portion of this, you should of unzipped misc_version_01.zip ad flashgc.zip in the platform-tools directory.
If you haven't done that yet, do that now and then run the following commands from your platform-tools directory.
Code:
> adb push misc_version /data/local/tmp/misc_version
> adb push flashgc /data/local/tmp/flashgc
> adb shell chmod 777 /data/local/tmp/*
> adb shell
> cd /data/local/tmp
# ./misc_version -s 1.00.000.0
--set_version set. VERSION will be changed to: 1.00.000.0
Patching and backing up partition 17...
# ./flashgc
*Note: If you get the following error, please make sure your sdcard is inserted in your phone and is NOT mounted to your computer (ie: make sure you are NOT in USB Storage Mode).
Code:
Error opening backup file.
Code:
# sync
Double check and make sure everything looks good so far by running the following command (still in adb shell).
Code:
# dd if=/dev/block/mmcblk0p17 bs=1 skip=160 count=10
1.00.000.010+0 records in
10+0 records out
10 bytes transferred in 0.001 secs (10000 bytes/sec)
Manual Downgrade
Rename the downloaded rom to it's proper update name:
(Please note, the filenames MUST be all uppercase except for the extension, and if file extensions are hidden, do not include ".zip"):
G2: "PC10IMG.zip"
Desire Z: "PC10IMG.zip"
myTouch 4G: "PD15IMG.zip"
Desire HD: "PD98IMG.zip"
[*]Place the zip file in the root of your sdcard.[*]Reboot your phone into bootloader by typing the following command:
Code:
> adb reboot bootloader
[*]After your phone has entered bootloader, press the power button. It will then scan for the associated rom file and ask you to update by pressing a key.[*]Press the key it requests to perform the update.
DO NOT INTERRUPT THIS PROCESS.
Your phone will reboot once or twice - this is completely normal.
This process will take roughly 5-10 minutes so make sure your phone is plugged in, either to an outlet or your computer.[*]Once the process is finished, it will ask you to reboot by pressing a key. Press the associated key and it will reboot into the Stock Froyo rom!
Login
Chat [0]
FAQ
Cerca
