[GUIDE] Downgrade your Desire-Z from 1.72 to 1.34 (and get root and S-OFF)

---

First thanks to everybody who made it possible to root our great devices.


THIS WILL WIPE YOUR DEVICE, BACKUP EVERYTHING BEFORE DOING THIS!

Polish translation by trzype

If you don't know how to use adb/fastboot don't do this. Use the search function and google and learn how to use them. If you know everything about them come back. I made a pretty nice tutorial, many people used it already with success. But I won't add anything like "go to startmenu and type..."


If your INFOCID is NOT one of these you need to make a goldcard to downgrade!

• HTC__001
• HTC__032
• HTC__E11
• HTC__203
• HTC__Y13
• HTC__102
• HTC__405
• HTC__304
• HTC__A07
• HTC__N34
• HTC__J15

check with:

adb reboot bootloader
fastboot oem boot

Here is a great guide how to make a goldcard, follow the first part and come back here then.

1. Get theses 3 files:
   https://github.com/tmzt/g2root-kmod/...euter/psneuter (right click > save as...)
   https://rapidshare.com/files/1884723844/PC10IMG.zip
   https://rapidshare.com/files/948281832/root.zip
   
   Since this uses some security holes to gain root privileges on your phone some antivirus programs on your pc might warn you that this contains a virus. Thats not the case!
   
   

   Originally Posted by MikeChannon

   It might be worth saying in the thread that android/Exploit.ragecage.A is the exploit being used to gain root and Users should not worry about the warning some software will give.

2. Extract misc_version_01.zip (only misc_version is needed)
   
   
3. Get the PC10IMG.zip from here or download the full RUU from here.
   If you already downloaded the 1.34 RUU somewhere else you can skip this step.
   
   

4. adb push psneuter /data/local/tmp
   adb push misc_version /data/local/tmp
   adb  shell chmod 777 /data/local/tmp/psneuter
   adb shell chmod 777 /data/local/tmp/misc_version
   adb shell /data/local/tmp/psneuter
   adb shell

5. Check if you have the '#' sign instead of the '$'
   If you see the '#' sign you got root!
   
   

6. /data/local/tmp/misc_version -s 1.33.405.5
   exit

7. If you have downloaded the 1.34.405.5_PC10IMG.zip copy it to you SD-Card and rename it to PC10IMG.zip.
   
   If you downloaded the full RUU or had it already execute the exe file (mine is called RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e _26.03.02.26_M_release_155556_signed.exe), start explorer and type %temp% in the adress bar.
   Look in all the folders starting with a { sign and also in the sub directories if it also starts with a { sign, in one of the subdirectories there should be a rom.zip file with 298.442.206 bytes and the MD5 sum 2ff42897cd27e0db425a2cf36c8bd078.
   Copy this rom.zip to your SD-Card on the phone and rename it to PC10IMG.zip
   
   

8. adb reboot bootloader

   (or turn your phone of and on again while holding the trackbad).
   
   
9. Wait till the phone is in bootloader mode (white screen should look like this but with other infos http://www.brutzelstube.de/wp-conten...0/09/hboot.jpg)
   
   
10. Select bootloader (vol +/- buttons for navigation and power button for select).
    
    
11. Wait for the phone to scan the sdcard, once it's done it will ask you if you want to start the update. Confirm it and wait till it's done. Reboot with powerbutton when asked.
    
    
12. After the reboot check for version informations, it should show this:
    
    
    
13. Enable USB-Debugging on your phone
    
    
14. Extract root.zip
    
    

15. adb install AndroidTerm.apk
    adb push busybox /data/local/tmp/
    adb push gfree /data/local/tmp/
    adb push rage /data/local/tmp
    adb push root /data/local/tmp/
    adb shell chmod 0755 /data/local/tmp/*
    adb push su /sdcard/
    adb push Superuser.apk /sdcard/

16. Start the Terminal app on your phone and type:
    

    /data/local/tmp/rage

17. Wait until you see the message "Forked #### childs.", reset Terminal (menu > Reset Term). The Terminal app will close, launch it again. It will force close, launch it again.
    You should see the magic '#' sign again.
    
    
18. Next type in the terminal

    /data/local/tmp/gfree -f

    , this will turn Security off (S-OFF), remove SIM Lock and set CID to 11111111.
    
    
19. Last step in terminal app on your phone is to execute these commands.

    /data/local/tmp/root
    sync

    This will root your phone. It's possible that you get an error message "mkdir: /system/xbin already exists", don't worry everything should be ok.
    After that restart your phone.
    
    
20. Now get ROM Manager and install the recovery image from there. If you are happy with the 1.34 software everything is done here, if not you can flash anything you want now.

Nice work! We allways need more people using the magic of root

Sent from my HTC Vision using XDA App

Thanks a lot for your effort!

Just bought a Desire Z and accidentally upgraded OTA.

Will try it now and report back.

I get the following Error when trying to run misc version

# /data/local/tmp/misc_version -s 1.33.405.5
/data/local/tmp/misc_version -s 1.33.405.5
--set_version set. VERSION will be changed to: 1.33.405.5
Patching and backing up partition 17...
Error opening backup file.
#

Any ideas mate?

Edit: Sorry, forgot to unmount phone from windows when i copied the img over.

VERY IMPORTANT

The OP made a small mistake in the instructions:

/data/local/tmp/misc-version -s 1.33.405.5
exit

the dash (-) should be an underline (_)

/data/local/tmp/misc_version -s 1.33.405.5
exit

Please update the first post

Originally Posted by Darkyy

VERY IMPORTANT

The OP made a small mistake in the instructions:

/data/local/tmp/misc-version -s 1.33.405.5
exit

the dash (-) should be an underline (_)

/data/local/tmp/misc_version -s 1.33.405.5
exit

Please update the first post

Thanks, fixed it.

Question:

Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?

Originally Posted by Gnurf

Question:

Should the psneuter -file be without a suffix?
Or should it be like psneuter.txt?

Without the extension... .txt is added by your browser presumably so you'll have to rename it

Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."

Originally Posted by paw3lk

Without the extension... .txt is added by your browser presumably so you'll have to rename it

Thats what I thought aswell, but seeing there has been a post about it previously... (in the other tread)

Thanks.