Wolf's ultimate flash and downgrade guide (NO ROOT NEEDED) (root opportunity for .21)

Search This thread

Magissia

Senior Member
May 9, 2012
1,151
270
127.0.0.1
Hello

Method 3 worked like a charm for me, now looking for ways to keep root for .24 and busy box !

Thanks you very very much.

Best regards, Magissia
 

idcrisis

Senior Member
Aug 30, 2010
1,428
5,742
...

shell@android:/ $ dd if=/sdcard/recoveryblob of=/dev/block/mmcblk0p4
dd if=/sdcard/recoveryblob of=/dev/block/mmcblk0p4
8860+1 records in
8860+1 records out
4536396 bytes transferred in 2.322 secs (1953658 bytes/sec)

...
brwxrwx--x root shell 179, 4 2012-05-16 11:26 mmcblk0p4

It worked. It won't flash anything automatically, neither will anything be very apparent in the OS, except for the mmcblk0p4 permissions ( which seem to have been modified at your end).

You may then need to go into CWM recovery by rebooting with Power and Vol Down pressed together and then Vol up when asked ( within 5 secs). Then you need to flash the Superuser-3.0.7-efghi-signed.zip from the OP.

I can also confirm that Method 3 works very well for 9.2.2.4 WW ( TF101G)

It may not work upon first reboot after the 'dd' because the recovery is being 'activated' or 'enabled' or 'flashed' or whatever, but on subsequent reboots, CWM recovery can be reached using the ( Reboot with Power + Vol Down pressed ) -> Vol Up technique.
 
Last edited:

05GT

Senior Member
Oct 26, 2010
1,693
117
San Diego
Vivo X Fold
Dropbox links dosn't works anymore.

Sent from my Transformer TF101 using xda premium

You have to use the depositfile links. He's exceeded his Dropbox bandwidth.

---------- Post added at 11:59 PM ---------- Previous post was at 11:15 PM ----------

Confirmed:

This method worked to downgrade from US .24 back to .17. Attained root using Vipermod.
 
  • Like
Reactions: Badbullet

nikolam

Member
Mar 22, 2008
5
1
Works for me on 9.2.1.24 US downloaded from Asus. I used method 3 from the original post, without any modifications.
 
Apr 27, 2011
30
0
Hi,

I had rootet my tf201, but i had a problem. i was on the firmware de.21, then i downgrade to de.15. then i root with vipermod and install ota rootkepper. but i never get a ota to .21? where is the problem. sorry for my bad english.

please help me
 

wolf849

Senior Member
Mar 19, 2009
68
221
Hi,

I had rootet my tf201, but i had a problem. i was on the firmware de.21, then i downgrade to de.15. then i root with vipermod and install ota rootkepper. but i never get a ota to .21? where is the problem. sorry for my bad english.

please help me

Maybe you have updated recovery to CWM? Check this first and if that is not true, do so and download CWM update from development forum ;)



Superb, I've added it to mirror sites. Thanks

Cheers
 
Last edited:

Ellingsoc

Senior Member
Jul 26, 2010
237
11
So if i am understanding this right method 2 does not root the tablet but lets you downgrade the firmware to .17 so you can then root it then you update back to .24?
 

ced_c

New member
May 18, 2012
1
0
Hi wolf,

Thank you for amazingly usefull and yet simple hack !

I did some research to understand how it works, and I found that the fun part is here :
codeaurora.org/gitweb/quic/la/?p=platform/system/core.git;a=blob;f=init/builtins.c;hb=refs/heads/ics

For what I understand there is nothing transformer specific here.

By the way I tried to download recovery-clockwork (download.clockworkmod.com/recoveries/) and dd it on mmcblk0p4.
And it works (well, for some reason the latest didn't but 5.8.1.9 did), without any need to downgrade

My point is, did you just find the universal ICS flash method ?
I don't have access to another ICS device, but I tried on the emulator and even there, the change of permission on the block device worked.
If we can write directly on a block device, I assume we can flash any rom/recovery we want.

I'll be happy to hear from other people trying that on another device than a transformer.
The change of permission on /dev/block/mmcblk0p* should be harmless, and people that know what they do can try to flash a recovery (or even a full system?) on their device.
 

CapNCooK

Member
May 13, 2012
48
1
So if i am understanding this right method 2 does not root the tablet but lets you downgrade the firmware to .17 so you can then root it then you update back to .24?

(For the TF300T: )

Yes, If you are in the US, this should work..

But i've done the same steps on my EU (WW) model, rooted .17, and it doesn't get any OTA updates.

I wondered if this is because of the EU IP i got, so i installed openVPN and switched to an USA IP. Still getting no updates...
 

abczhou

Member
Apr 9, 2011
45
7
Yesterday i placed an order at Amazon for TF300 and start to learn to root in here.
I am totally noob on this.
Maybe it is a stupid question but anyone can share the procedure to how to start the ADB session. My OS is win7.

2. Connect tablet to the computer and start ADB shell session
 

andreas009

New member
May 17, 2012
4
0
stuck on boot screen

I completed 2 method and now am stuck on the Eee Pad boot screen and it never changes, can't get adb to detect tablet, think I managed to mess up the install somewhere :( guess I'm saving up another $400
 

pkfox

Senior Member
Jan 26, 2012
240
14
London
Hi there, I actually flashed an entire ROM blob ( I was already rooted ) using this method but instead of using adb I did it from a terminal on the tf101 , it worked perfectly - I now rarely use CWM as I can flash whatever I need with dd. I am reasonably competent with Linux and understand how dd works , my problem was my ignorance of how Android is structured e.g I didn't know /dev/block/mmcblk0p4 was a staging partition. This is by far the best piece of knowledge I've learnt here.
 

wolf849

Senior Member
Mar 19, 2009
68
221
Hi wolf,

Thank you for amazingly usefull and yet simple hack !

I did some research to understand how it works, and I found that the fun part is here :
codeaurora.org/gitweb/quic/la/?p=platform/system/core.git;a=blob;f=init/builtins.c;hb=refs/heads/ics

For what I understand there is nothing transformer specific here.

By the way I tried to download recovery-clockwork (download.clockworkmod.com/recoveries/) and dd it on mmcblk0p4.
And it works (well, for some reason the latest didn't but 5.8.1.9 did), without any need to downgrade

My point is, did you just find the universal ICS flash method ?
I don't have access to another ICS device, but I tried on the emulator and even there, the change of permission on the block device worked.
If we can write directly on a block device, I assume we can flash any rom/recovery we want.

I'll be happy to hear from other people trying that on another device than a transformer.
The change of permission on /dev/block/mmcblk0p* should be harmless, and people that know what they do can try to flash a recovery (or even a full system?) on their device.

Yes it will work on every device as symlinking trick can be done on every ICS ROM. However the change of permission on /dev/block/mmcblk0p* is not as harmless as you think. If you flash wrong partition with wrong img file you may become hard-bricked, that is why I am not telling that we can do so, because some of less-experienced users may eventually try it. But Yes it is possible and I am aware of it :)

Thanks for your appreciation I'm very glad that I could help people a little :)

Cheers
 

CapNCooK

Member
May 13, 2012
48
1
Yes it will work on every device as symlinking trick can be done on every ICS ROM. However the change of permission on /dev/block/mmcblk0p* is not as harmless as you think. If you flash wrong partition with wrong img file you may become hard-bricked, that is why I am not telling that we can do so, because some of less-experienced users may eventually try it. But Yes it is possible and I am aware of it :)

Thanks for your appreciation I'm very glad that I could help people a little :)

Cheers

Hiya Wolf,

Mayb you can help us out in this thread: http://xdaforums.com/showthread.php?p=26292352

Do you know if it's possible to extract an existing firmware (blob) from a memory partitition, with the goal to flash another device with the extracted blob ?

Your help/advice is apreciated!

thx

----------
TF300T on US .17 Rooted
Searching for WW .17 unrooted blob
 

knucklehead_11

Senior Member
Feb 21, 2011
256
42
Middle East
Thanks for your work. I just downgraded, rooted and now upgrading my prime back to .21. Thanks for the help. The hardest part of this whole downgrade is trying to get adb shell to work. Downgrading and rooting took 20 minutes and was simple. Now I just need to talk my wife into letting me root her prime. Thanks
 

redahaddad

Member
Apr 30, 2012
10
0
How to extract Recovery blob

Assuming you are on stock recovery based on your last post. And I assume you are on 9.2.2.4 stock recovery too.

3 possiblities:

1. Clear data as mentioned in the end of Method 1 from OP

If that doesn't work, then:

2. If you still have adb and su, then do Method 1 completely with the 9.2.2.3 complete blob ( maybe from Asus or original post) and removing data as per instruction at the end.

If that doesn't work then:

3. a) If you still have adb and su, then downgrade the recovery partition to 9.2.2.3 using 'Revert_To_9.2.2.3_WW_Recovery.bat'.

b) Download WW_epad_user_9_2_2_3_UpdateLauncher.zip (from Asus official). From that extract WW_epad-user-9.2.2.3.zip and rename it to EP101_SDUPDATE.zip and store it in a MicroSD and insert this into the tablet.

c) Then reboot holding power key and vol down key and press Volume Up button when you are prompted to do so. Recovery should start and restore 9.2.2.3 WW.

d) Clear data as mentioned in the end of Method 1 from OP

Because you are on 9.2.2.4 recovery, putting a 9.2.2.3 ZIP in the micro-SD may fail as Asus stock recovery doesn't allow downgrades. But if you are on 9.2.2.3 stock recovery (from step (3.a) above) , then EP101_SDUPDATE.zip may work.

I don't think the 9.2.2.4 WW_epad_user_9_2_2_4_UpdateLauncher.zip is out on Asus yet, else you would have been able to simply extract WW_epad-user-9.2.2.4.zip from it and since you are on 9.2.2.4 recovery, step (3.b) above would have worked.

Dear id
Thank you for your follow up and support, I sent my Transformer to ASUS and came back with with Stock ICS 4.0.3, TW 9.2.2.4,

1- Now I want to root it again, So do I use method 3 and if so which recoveryblob do I need to use,

2- I downloaded the (TW_epaduser9_2_2_4UpdateLauncher.zip) from ASUS web site (http://support.asus.com/download.aspx?SLanguage=en&m=Eee+Pad+Transformer+TF101G&os=32) , and I tried to blobunpack it to get the recovery Blob (SOS) using Ubuntu , but Ubuntu says that blobunpack is not an internal command or so.

I need this recovery blob just in case anything goes wrong again.
So may you can do me a favor and unpack it for me or tell me how to extract it from the launcher.

Thank you very much for your support.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 192
    WARNING

    This method will not work on any JB rom available, apparently google has patched the exploit.

    Note that downgrading method for unrooted devices is highly experimental and may turn your device into worthless brick. Read this WHOLE thread carefully before you start doing anything with your Transformer.

    MOD EDIT: It is reported that this method doesn't work with the new Jelly Bean firmwares on the TF201 and the TF300T,

    Sorry, but I will not be able to support you between 3rd and 15th of May because I have to pass my final exams.
    However feel free to post your questions in this topic I am sure that somebody will be able to help you.
    Description
    Method 1 - Rooted Devices
    This method allows you to flash any update released by ASUS without need for custom recovery.
    ROOT is required to unlock mmcblk0p4 write access for dd.


    Method 2 - UnRooted Devices
    This method allows you to flash any update released by ASUS, no mater for SKU etc.
    It uses file linking trick to unlock mmcblk0p4 write access even when su is not present.


    Method 3 - UnRooted Devices - Recommended
    This method allows you to directly flash the recovery even on unrooted device. This may be used next to root your TF by prepared su package.
    It uses file linking trick to unlock mmcblk0p4 write access.
    Disclaimer

    Despite both methods have been confirmed (by myself) to work, the whole process of flashing mmcblk0p4 with dd brings high risk of bricking device by for example file system corruption.

    I do not take any responsibility for damaged or bricked devices. Before flashing you have to assume the risk and chances of geting bricked.

    Under no circumstances should you brake cmd during blob file is flashed by dd. If that happens do not reboot. PM me and go on IRC
    Requirements


    • BLOB file (look at links box at the bottom for few)
    • ADB enabled
    • Root acces (only method 1)

    Notes​
    Sorry for the mistakes, but English is not my native language PM me if you find any so I will be able to correct them.

    Before posting a question look into FAQ maybe it have been already answered.

    Guide is inspired by Turge who wrote similar article for TFP (link here). However whole 2nd method was invented and described by me.

    Thanks go to:
    Code:
    [CENTER]
    AndroidRoot.mobi - for RazorClaw
    ViperBoy - for viperMOD rooting tool
    jcase - for NachoRoot
    sparkym3 - for his ICS rooting methods
    Roach2010 - for all his work
    sbiriguda - who inspired me to dig around symlinking
    [/CENTER]

    Instructions - Method 1 - Rooted
    1. Upload the BLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB session.
    3. When you will be in adb shell execute following comands:
    Code:
    su
    dd if=/sdcard/blob of=/dev/block/mmcblk0p4
    4. The command prompt will be empty as wnen nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    5. When you see the following message:
    Code:
    1066806+1 records in
    1066806+1 records out
    546204969 bytes transferred in 250.309 secs (2182122 bytes/sec)
    (the numbers in resulted message may be diffrent but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    6. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    7. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    8. Be happy from your new firmware.

    ADDITIONAL OPTIONAL STEP

    In some cases flashing previous firmware leaves data partition intact.
    I suggest to clean it by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. It mostly happen when downgrading to HC from ICS.

    Instructions - Method 2 - UnRooted
    1. Upload the BLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB shell session.
    3. When you will be in adb shell execute following commands:
    Code:
    mv /data/local/tmp /data/local/tmp.bak
    ln -s /dev/block/mmcblk0p4 /data/local/tmp
    exit
    4. Now reboot your tab through:
    Code:
    adb reboot
    5. Once you see ASUS loading screen you should be able to start ADB shell session again (if not just wait), than (in shell) execute:
    Code:
    dd if=/sdcard/blob of=/dev/block/mmcblk0p4
    6. The command prompt will be empty as wnen nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    7. When you see the following message:
    Code:
    1066806+1 records in
    1066806+1 records out
    546204969 bytes transferred in 250.309 secs (2182122 bytes/sec)
    (the numbers in resulted message may be diffrent but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    8. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    9. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    10. Be happy from your new firmware.

    ADDITIONAL OPTIONAL STEP

    In some cases flashing previous firmware leaves data partition intact.
    I suggest to clean it by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. It mostly happen when downgrading to HC from ICS.

    Instructions - Method 3 - UnRooted

    This will definitely not work with Transformer Prime continue only if you are owner of TF101 of TF101G

    1. Upload the RECOVERYBLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB shell session.
    3. When you will be in adb shell execute following commands:
    Code:
    mv /data/local/tmp /data/local/tmp.bak
    ln -s /dev/block/mmcblk0p4 /data/local/tmp
    exit
    4. Now reboot your tab through:
    Code:
    adb reboot
    5. Once you see ASUS loading screen you should be able to start ADB shell session again (if not just wait), than (in shell) execute (some times it gets longer, but do not panic it is normal):
    Code:
    dd if=/sdcard/recoveryblob of=/dev/block/mmcblk0p4
    6. The command prompt will be empty as when nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    7. When you see the following message:
    Code:
    8860+1 records in
    8860+1 records out
    4536396 bytes transferred in 1.718 secs (2640509 bytes/sec)
    (the numbers in resulted message may be different but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    8. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    9. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    10. Be happy from your new recovery.

    ADDITIONAL - ROOTING

    11. Download this SU + Superuser.apk package and place it on internal memory or microsd
    12. Boot to recovery. (turn off your TF and than boot with [vol down]+[power] pressed, once you see the letters identifying the system press [vol up]
    13. Now you should be in custom recovery. Select 'Install from zip file' and then select the file on desired location internal or external.
    14. Once flashing is done go back and select 'Reboot system'
    15. Now you got freshly rooted Transformer. ENJOY

    BLOBs

    BLOB file can be extracted from any update file. It is contained inside XX_epad-user-x.x.x.x.zip achive. Where XX (e.g WW or TW) refers to SKU of firmware and x.x.x.x to its version (e.g 9.2.2.3)

    Or you can pick up a few here ;)

    Now they are ziped to reduce the sizes (MD5 value shows the control sum of each blob not zip) (sorry for hostings but I don't have space on dropbox any more, you may register to increase) (if you know faster mirror PM me)

    NEW MIRROR SITE WITH ALMOST ALL FIRMWARES HERE

    TF101/G BLOBs (Transformer)

    Honeycomb

    WW 8.6.6.19 - MD5: D63D60F6C71F5B614B338244D3788735 - or mirrors (1 2)

    WW 8.6.6.23 - MD5: 1227F19BC4415661CACB05A483504953 - or mirrors (1 2)

    Ice Cream Sandwich

    US 9.2.1.11 - MD5: 4F6069430B20C35C8833F50DFA0FE0FD - or mirrors (1 2)

    WW 9.2.1.17 - MD5: 5C78C28C31888943AB67CCE4B4448319

    US 9.2.1.17 - MD5: 380CA6399374FF5F84154509365A83F7 - or mirrors (1 2)

    TW 9.2.1.17 - MD5: CA52E4AD670DFFA29DC1CBA04A0A4164 - or mirrors (1 2)

    WW 9.2.2.3 - MD5: 5D5A44069346C4D7D2740E4100520692 - or mirrors (1 2)

    TW 9.2.2.3 - MD5: pending


    TF201 BLOBs (Transformer Prime)

    Honeycomb

    WW 8.8.3.33 - MD5: 5136E579FAEDDFE15F6AAE623B6CB67D - (or mirrors 1 2)

    Ice Cream Sandwich

    WW 9.4.2.11 - MD5: B2668A3387924B19A91F74ABF5DBE4E8 - (mirror)

    US 9.4.2.14 - MD5: EF2E635BD6921BFA9D01FC0E4DD0644B - (mirror)

    WW 9.4.2.15 - MD5: 55122257B30E9376DF463F3C1A8BA702 - (or mirror 1 )

    WW 9.4.2.21 - MD5: 1129DC2643BD0F5DC6C07B9A1B619548 - (or mirror 1 )

    RECOVERYBLOBs (only for TF101)

    Rburrow's Rogue XM Recovery (mirror) - MD5: 6EE759A84ED02F0D95A029EC245CFDC5 - thread

    Hope it will help
    Results​
    Confirmed to work on both TF101/G (ASUS Transformer) and TF201 (ASUS Transformer Prime)

    However keep in mind that TFP have to be locked in order to use second method otherwise you may brick your device.


    It probably can be used with slider as well :)

    I also confirmed that it is possible to root any official OTA (on TF101/G) by flashing recoveryblob containing custom recovery and than update.zip with su and superuser app.

    Proven that Method 2 also work with 9.2.1.21 update to downgrade the software and reroot device. - thanks alvin612.

    Method 2 may also work on locked Transformer Prime however be careful and read warning and disclaimer in this thread.

    Click 'Thanks' if I helped you ;)
    14
    *THIS TOOL IS USING WOLF'S 2nd method of downgrading, this is Viperboys one click tool, I modded to add Wolf's downgrade*

    ONE CLICK Downgrade, using Wolf's method and root tool (thanks to viperboy)
    I modded ViperMods awesome prime tool, to add an option to one click downgrade, using wolf's no root method :D. Just put the blob of FW you want to go to on the root of your primes internal memory, then run option 1 on my modded vipermods tool :D

    99.9% credit go to -Viperboy- and Wolf849 :D i just added option in viperMOD's tool

    EDIT: Fixed error in script

    Download:
    https://docs.google.com/uc?id=0B8gHyfs-S25Lal9KOWFQbWtzalE&export=download

    http://205.196.122.126/9jvynozv3cpg...MOD+Primer+Tool+v4.5+-+Modded+by+bpear_v3.zip (mediafire direct link)

    http://d-h.st/KrP

    *NOTE* this is using Wolf's method 2 which is confirmed to work on prime, im not sure about tf101 etc. from here http://xdaforums.com/showthread.php?t=1622628

    Mirrors of WW and US .15 blob (TRANSFORMER PRIME): you have to extract the .zip, possibly twice, then there will be a blob file, put that on /sdcard
    http://xdaforums.com/showpost.php?p=25503960&postcount=47
    3
    Let me just say this: you are a freaking genius. I didn't even think of symlinking /dev/block/mmcblk0p4 to /data/local/tmp so it would change ownership and permissions on reboot. This is f*ing brilliant!

    Moreover, if you have a blob for CWM you can also use the second method to install it on an unrooted device and then root it using the customary update.zip with su and superuser.apk (yes, even on 9.2.2.3 TF101Gs).

    Again, great job! ;)
    3
    FAQ

    I'm confused, which BLOB file should I choose?

    You have to choose BLOB with the firmware you want to install e.g. if you are on 9.2.2.3 and want to downgrade to Honeycomb just choose BLOB file from 8.6.6.19 or 8.6.6.23


    Wolf help something happened to my tab, it wont boot up.

    If you let dd to finish all its job and after reboot you saw the flashing bar, but your ROM still don't want to boot up you have probably downgraded from ICS to HC. Just do the wipe by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. Than everything should be fine.


    I'm stuck on step 3 all the time I have message like -> failed on '/data/local/tmp' - Not a directory <- What should I do?

    It means that you have already symlinked something to /data/local/tmp and moved your previous tmp to tmp.bak. To fix that you can either execute:
    Code:
    rm /data/local/tmp.bak
    or:
    Code:
    mv /data/local/tmp /data/local/tmp.mad
    and repeat procedure.


    Can I root the latest firmware and keep my data untouched?

    Yes, on both TF and TFP. For TF101 use method 3.
    For TF201 backup your data with ASUS Backup utility, than do a downgrade, root and install OTA ROOT Keeper from Voodoo. After that update OTA and recover your root and data.



    Can this method be used to root TF301? (aka EeePAD Infinity)

    Unfortunately no, it only allows us to do a step back without root permissions and than apply a root. However I'm still working around ASUS Backup App as I have an idea of exploit (but not enough time to study apk more). If you are interested in this consider donation as I don't have access to any TF301 and that would speed up the researches.