Wolf's ultimate flash and downgrade guide (NO ROOT NEEDED) (root opportunity for .21)

Search This thread

wolf849

Senior Member
Mar 19, 2009
68
221
Ive used adb many times before. Its the transformer. Its not listed as a adb device. Im on the newest ics update trying to downgrade.

Than it may be a case of drivers or... but not likely adb. I personally used linux. However on windows I had problem that adb did not recognize the tab so I reinstalled drivers from viperMOD and used the ADB stored in its archives. Maybe you should give it a shot. Otherwise get linux LiveCD and do it from terminal prompt.
 

steven178s

Senior Member
May 9, 2009
233
8
Queens
Thank You i figured out the problem. I was not using the right blob, and I did not let it boot all the way before completing the next step.
 

qmaxmobile

Senior Member
Nov 18, 2011
83
9
Altavilla Vicentina
Thanks, many many thanks!!!!

Thanks, here in Italy are all desperate, however, this system works, thank you! You really are a genius

Happy owner of Tf Asus 101G (ex) Fota Stock rom 9.2.2.3 ICS
 

kgb-agent

Member
Jul 26, 2008
31
4
Method 2 said it works but seems not to have

:eek:

Hi Folks

Have a Transformer Prime that yesterday I Asus unlocked - I need to change roms so I can access the 3g dongle features as I travel alot overseas and will use local sims. So i was pleased to see this thread about getting recovery on my Prime as I had installed the OTA update to version 9.4.2.21.

I used Method 2 and everything went as expected from the shell commands --- correct amount of time, correct numbers written etc ---- all looked good. However after a reboot it booted as normal and in 'settings/ about' it still shows:

Android Version 4.0.3
Kernel 2.6.39.4-00003-g12de84f
Build Num iml74k.WW_epad-9.4.2.21-20120323

So I downloaded the other 500 meg blob file and thought I would try that one --- however, when I go to the adb shell I now get this error ?

C:\Asus Transformer\Prime Stuff\viperMOD PrimeTime v4.5\
adb devices
List of devices attached
C1OKAS064362 device


C:\Asus Transformer\Prime Stuff\viperMOD PrimeTime v4.5\adb shell

shell@android:/ $ mv /data/local/tmp /data/local/tmp.bak
mv /data/local/tmp /data/local/tmp.bak
failed on '/data/local/tmp' - Not a directory

255|shell@android:/ $

Any ideas ... this is getting weird :eek::confused::(:mad:

Cheers
 
  • Like
Reactions: stdlyman3k

roygaard

Member
Sep 21, 2011
34
7
Vienna
Google Nexus 5
Nexus 6
:eek:
shell@android:/ $ mv /data/local/tmp /data/local/tmp.bak
mv /data/local/tmp /data/local/tmp.bak
failed on '/data/local/tmp' - Not a directory

255|shell@android:/ $
[/INDENT]

Any ideas ... this is getting weird :eek::confused::(:mad:

Cheers

Try to list the directory at /data/local by doing something like:

android:/ $ cd /data/local
android:/dat/local $ ls -l

I think you already symlinked the tmp-directory once so that you can go to the next step when the directory already looks like:
android:/data/local $ ls -l
-rwxrwxrwx shell shell 684 2012-01-24 23:56 mempohelper
lrwxrwxrwx shell shell 2012-04-29 11:51 tmp -> /dev/block/mmcblk0p4
drwxrwx--x shell shell 2012-04-27 09:13 tmp.bak

regards,
Roy
 

wolf849

Senior Member
Mar 19, 2009
68
221
Have a Transformer Prime that yesterday I Asus unlocked
Than if you have unlocked bootloader my guide will not work for you because it will lead you to turn your TFP into brick. Read about it in "]this thread.

I used Method 2 and everything went as expected from the shell commands --- correct amount of time, correct numbers written etc ---- all looked good. However after a reboot it booted as normal and in 'settings/ about' it still shows:

Android Version 4.0.3
Kernel 2.6.39.4-00003-g12de84f
Build Num iml74k.WW_epad-9.4.2.21-20120323

It is normal because you have used BLOB file dedicated for TF101. To obtain blob for your device you have to extract it out of ASUS update what is pretty simple (just unzip archive). However do not flash BLOB by this method if you are unlocked.


shell@android:/ $ mv /data/local/tmp /data/local/tmp.bak
mv /data/local/tmp /data/local/tmp.bak
failed on '/data/local/tmp' - Not a directory
255|shell@android:/ $
It is the case that once you have done it and now you have tmp.bak file in /data/local to over work that just do

mv /data/local/tmp /data/local/tmp.mad

and it will work. But again if you are unlocked search for method to flash CWM through fastboot.
 

roygaard

Member
Sep 21, 2011
34
7
Vienna
Google Nexus 5
Nexus 6
Rooted - thanks!!!!

I've bought a new "ASUS TF 201" with stock 9.4.2.21 installed on it and using your "option-2"-Downgrade-method, Vipermod-option 1 (xda), OTA RootKeeper (from the market) and OTA-Update (thanks to ASUS) to .21 I am on .21 rooted!!!! Don't install .21 manually - I've heard that this method "disables" RootKeeper.

BTW: I've used ASUS Firmware 9.4.2.15 for downgrading: DE_epaduser9_4_2_15UpdateLauncher.zip (German)

GREAT WORK!!!!!
 
Last edited:
  • Like
Reactions: ScriptJunkie

kgb-agent

Member
Jul 26, 2008
31
4
Thanks Roy

Did as you suggested - below is the result

adb shell
shell@android:/ $ cd /data/local
cd /data/local
shell@android:/data/local $ ls -l
ls -l
-rwxrwxrwx shell shell 2005736 2011-12-29 10:32 busybox
-rwxrwxrwx shell shell 101 2012-01-11 18:20 installbusybox
-rwxrwxrwx shell shell 305 2012-01-11 18:31 installbusybox2
-rwxrwxrwx shell shell 684 2012-01-24 23:56 mempohelper
-rwxrwxrwx shell shell 15182 2012-04-29 16:33 nachoroot.bin
-rwxrwxrwx shell shell 80 2012-01-11 10:42 sysro
-rwxrwxrwx shell shell 80 2012-01-11 10:19 sysrw
drwxrwx--x shell shell 2012-04-29 18:28 tmp
drwxrwx--x shell shell 2012-04-29 16:41 tmp.bak
-rwxrwxrwx shell shell 81 2012-01-11 11:45 unroot
-rwxrwxrwx shell shell 433 2012-01-11 18:41 unroot2​

I thought that may have been the case that the link was already done but when I go to Step 3 and run the command

shell@android:/data/local $ mv /data/local/tmp /data/local/tmp.bak
mv /data/local/tmp /data/local/tmp.bak
failed on '/data/local/tmp' - Not a directory
255|shell@android:/data/local $​

So, assuming it exists I go to Step 5 and run the next command and get this

255|shell@android:/data/local $ dd if=/sdcard/blob of=/dev/block/mmcblk0p4
dd if=/sdcard/blob of=/dev/block/mmcblk0p4
/dev/block/mmcblk0p4: cannot open for write: Permission denied
1|shell@android:/data/local $​

Any other ideas ?

Cheers


Try to list the directory at /data/local by doing something like:



I think you already symlinked the tmp-directory once so that you can go to the next step when the directory already looks like:


regards,
Roy
 

wolf849

Senior Member
Mar 19, 2009
68
221
I've bought a new "ASUS TF 201" with stock 9.4.2.21 installed on it and using your "option-2"-Downgrade-method, Vipermod-option 1 (xda), OTA RootKeeper (from the market) and OTA-Update (thanks to ASUS) to .21 I am on .21 rooted!!!! Don't install .21 manually - I've heard that this method "disables" RootKeeper.

BTW: I've used ASUS Firmware 9.4.2.15 for downgrading: DE_epaduser9_4_2_15UpdateLauncher.zip (German)

GREAT WORK!!!!!

Thanks for confirmation, now I can add TFP to compatibility list.

Cheers
 
  • Like
Reactions: slopppy

alvin612

Senior Member
Apr 17, 2011
80
18
Confirming method 3 roots 9.2.1.21 on my tf101

thanks again wolf!
btw, I've been seeing some random reboots on stock 9.2.1.21, which was unrooted. I'm going to custom rom now..finger crossed.
 

hearts king101

Senior Member
Nov 1, 2010
728
146
Jizan
Yes, you can. Just flash the package that is in step 11 after entering CWM and you will be rooted.

BTW method 3 is the safest because it leaves system untouched.

Thanks.
I reverted back to honeycomb then i rooted before upgrade and used ota rootkeeper then update and now I HAVE ICS 9.2.2.3 WITH ROOT :D:cool::p:);):cool:.

Thank u so much ;)

Edit: Method 3 worked with ICS 9.2.2.3.
 
Last edited:

hajalie24

Senior Member
Apr 9, 2011
248
15
Does anybody have a mirror for the .15 transformer prime blob file?

edit: nvm extracted it from the update file

update: Now rooted on my transformer prime!
 
Last edited:

mopar400

Senior Member
Mar 3, 2011
51
11
You sir are F#$king awsume.

Even a noob like me made it work on my prime.

was at .21 now at .15 backing up with Voodo OTA Rootkeeper installed.

By the way S/N: BCOKAS1@@@@@

Thanks Wolf :):):)
 

prog19

Senior Member
Apr 29, 2012
573
186
Noob question here...

The BLOB files from TF 101G will work on my regular TF101 ?
Looking forward to downgrade my B80 to HC 3.2.1 just to check some battery drain issues.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 192
    WARNING

    This method will not work on any JB rom available, apparently google has patched the exploit.

    Note that downgrading method for unrooted devices is highly experimental and may turn your device into worthless brick. Read this WHOLE thread carefully before you start doing anything with your Transformer.

    MOD EDIT: It is reported that this method doesn't work with the new Jelly Bean firmwares on the TF201 and the TF300T,

    Sorry, but I will not be able to support you between 3rd and 15th of May because I have to pass my final exams.
    However feel free to post your questions in this topic I am sure that somebody will be able to help you.
    Description
    Method 1 - Rooted Devices
    This method allows you to flash any update released by ASUS without need for custom recovery.
    ROOT is required to unlock mmcblk0p4 write access for dd.


    Method 2 - UnRooted Devices
    This method allows you to flash any update released by ASUS, no mater for SKU etc.
    It uses file linking trick to unlock mmcblk0p4 write access even when su is not present.


    Method 3 - UnRooted Devices - Recommended
    This method allows you to directly flash the recovery even on unrooted device. This may be used next to root your TF by prepared su package.
    It uses file linking trick to unlock mmcblk0p4 write access.
    Disclaimer

    Despite both methods have been confirmed (by myself) to work, the whole process of flashing mmcblk0p4 with dd brings high risk of bricking device by for example file system corruption.

    I do not take any responsibility for damaged or bricked devices. Before flashing you have to assume the risk and chances of geting bricked.

    Under no circumstances should you brake cmd during blob file is flashed by dd. If that happens do not reboot. PM me and go on IRC
    Requirements


    • BLOB file (look at links box at the bottom for few)
    • ADB enabled
    • Root acces (only method 1)

    Notes​
    Sorry for the mistakes, but English is not my native language PM me if you find any so I will be able to correct them.

    Before posting a question look into FAQ maybe it have been already answered.

    Guide is inspired by Turge who wrote similar article for TFP (link here). However whole 2nd method was invented and described by me.

    Thanks go to:
    Code:
    [CENTER]
    AndroidRoot.mobi - for RazorClaw
    ViperBoy - for viperMOD rooting tool
    jcase - for NachoRoot
    sparkym3 - for his ICS rooting methods
    Roach2010 - for all his work
    sbiriguda - who inspired me to dig around symlinking
    [/CENTER]

    Instructions - Method 1 - Rooted
    1. Upload the BLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB session.
    3. When you will be in adb shell execute following comands:
    Code:
    su
    dd if=/sdcard/blob of=/dev/block/mmcblk0p4
    4. The command prompt will be empty as wnen nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    5. When you see the following message:
    Code:
    1066806+1 records in
    1066806+1 records out
    546204969 bytes transferred in 250.309 secs (2182122 bytes/sec)
    (the numbers in resulted message may be diffrent but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    6. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    7. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    8. Be happy from your new firmware.

    ADDITIONAL OPTIONAL STEP

    In some cases flashing previous firmware leaves data partition intact.
    I suggest to clean it by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. It mostly happen when downgrading to HC from ICS.

    Instructions - Method 2 - UnRooted
    1. Upload the BLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB shell session.
    3. When you will be in adb shell execute following commands:
    Code:
    mv /data/local/tmp /data/local/tmp.bak
    ln -s /dev/block/mmcblk0p4 /data/local/tmp
    exit
    4. Now reboot your tab through:
    Code:
    adb reboot
    5. Once you see ASUS loading screen you should be able to start ADB shell session again (if not just wait), than (in shell) execute:
    Code:
    dd if=/sdcard/blob of=/dev/block/mmcblk0p4
    6. The command prompt will be empty as wnen nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    7. When you see the following message:
    Code:
    1066806+1 records in
    1066806+1 records out
    546204969 bytes transferred in 250.309 secs (2182122 bytes/sec)
    (the numbers in resulted message may be diffrent but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    8. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    9. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    10. Be happy from your new firmware.

    ADDITIONAL OPTIONAL STEP

    In some cases flashing previous firmware leaves data partition intact.
    I suggest to clean it by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. It mostly happen when downgrading to HC from ICS.

    Instructions - Method 3 - UnRooted

    This will definitely not work with Transformer Prime continue only if you are owner of TF101 of TF101G

    1. Upload the RECOVERYBLOB file to internal storage of your tab. (mounted as /sdcard)
    2. Connect tablet to the computer and start ADB shell session.
    3. When you will be in adb shell execute following commands:
    Code:
    mv /data/local/tmp /data/local/tmp.bak
    ln -s /dev/block/mmcblk0p4 /data/local/tmp
    exit
    4. Now reboot your tab through:
    Code:
    adb reboot
    5. Once you see ASUS loading screen you should be able to start ADB shell session again (if not just wait), than (in shell) execute (some times it gets longer, but do not panic it is normal):
    Code:
    dd if=/sdcard/recoveryblob of=/dev/block/mmcblk0p4
    6. The command prompt will be empty as when nothing happen, do not panic wait until the end of the process. DO NOT INTERRUPT (it will take apx.3-10 min)
    7. When you see the following message:
    Code:
    8860+1 records in
    8860+1 records out
    4536396 bytes transferred in 1.718 secs (2640509 bytes/sec)
    (the numbers in resulted message may be different but it has to have the same structure)
    You can safety reboot the device by exiting shell and executing :
    Code:
    adb reboot
    8. Once rebooted you will see ASUS EeePAD flashing progress bar. Be patient and wait till the end.
    9. Tablet will reboot itself and start loading new system. (as it is first boot it may take few minutes)
    10. Be happy from your new recovery.

    ADDITIONAL - ROOTING

    11. Download this SU + Superuser.apk package and place it on internal memory or microsd
    12. Boot to recovery. (turn off your TF and than boot with [vol down]+[power] pressed, once you see the letters identifying the system press [vol up]
    13. Now you should be in custom recovery. Select 'Install from zip file' and then select the file on desired location internal or external.
    14. Once flashing is done go back and select 'Reboot system'
    15. Now you got freshly rooted Transformer. ENJOY

    BLOBs

    BLOB file can be extracted from any update file. It is contained inside XX_epad-user-x.x.x.x.zip achive. Where XX (e.g WW or TW) refers to SKU of firmware and x.x.x.x to its version (e.g 9.2.2.3)

    Or you can pick up a few here ;)

    Now they are ziped to reduce the sizes (MD5 value shows the control sum of each blob not zip) (sorry for hostings but I don't have space on dropbox any more, you may register to increase) (if you know faster mirror PM me)

    NEW MIRROR SITE WITH ALMOST ALL FIRMWARES HERE

    TF101/G BLOBs (Transformer)

    Honeycomb

    WW 8.6.6.19 - MD5: D63D60F6C71F5B614B338244D3788735 - or mirrors (1 2)

    WW 8.6.6.23 - MD5: 1227F19BC4415661CACB05A483504953 - or mirrors (1 2)

    Ice Cream Sandwich

    US 9.2.1.11 - MD5: 4F6069430B20C35C8833F50DFA0FE0FD - or mirrors (1 2)

    WW 9.2.1.17 - MD5: 5C78C28C31888943AB67CCE4B4448319

    US 9.2.1.17 - MD5: 380CA6399374FF5F84154509365A83F7 - or mirrors (1 2)

    TW 9.2.1.17 - MD5: CA52E4AD670DFFA29DC1CBA04A0A4164 - or mirrors (1 2)

    WW 9.2.2.3 - MD5: 5D5A44069346C4D7D2740E4100520692 - or mirrors (1 2)

    TW 9.2.2.3 - MD5: pending


    TF201 BLOBs (Transformer Prime)

    Honeycomb

    WW 8.8.3.33 - MD5: 5136E579FAEDDFE15F6AAE623B6CB67D - (or mirrors 1 2)

    Ice Cream Sandwich

    WW 9.4.2.11 - MD5: B2668A3387924B19A91F74ABF5DBE4E8 - (mirror)

    US 9.4.2.14 - MD5: EF2E635BD6921BFA9D01FC0E4DD0644B - (mirror)

    WW 9.4.2.15 - MD5: 55122257B30E9376DF463F3C1A8BA702 - (or mirror 1 )

    WW 9.4.2.21 - MD5: 1129DC2643BD0F5DC6C07B9A1B619548 - (or mirror 1 )

    RECOVERYBLOBs (only for TF101)

    Rburrow's Rogue XM Recovery (mirror) - MD5: 6EE759A84ED02F0D95A029EC245CFDC5 - thread

    Hope it will help
    Results​
    Confirmed to work on both TF101/G (ASUS Transformer) and TF201 (ASUS Transformer Prime)

    However keep in mind that TFP have to be locked in order to use second method otherwise you may brick your device.


    It probably can be used with slider as well :)

    I also confirmed that it is possible to root any official OTA (on TF101/G) by flashing recoveryblob containing custom recovery and than update.zip with su and superuser app.

    Proven that Method 2 also work with 9.2.1.21 update to downgrade the software and reroot device. - thanks alvin612.

    Method 2 may also work on locked Transformer Prime however be careful and read warning and disclaimer in this thread.

    Click 'Thanks' if I helped you ;)
    14
    *THIS TOOL IS USING WOLF'S 2nd method of downgrading, this is Viperboys one click tool, I modded to add Wolf's downgrade*

    ONE CLICK Downgrade, using Wolf's method and root tool (thanks to viperboy)
    I modded ViperMods awesome prime tool, to add an option to one click downgrade, using wolf's no root method :D. Just put the blob of FW you want to go to on the root of your primes internal memory, then run option 1 on my modded vipermods tool :D

    99.9% credit go to -Viperboy- and Wolf849 :D i just added option in viperMOD's tool

    EDIT: Fixed error in script

    Download:
    https://docs.google.com/uc?id=0B8gHyfs-S25Lal9KOWFQbWtzalE&export=download

    http://205.196.122.126/9jvynozv3cpg...MOD+Primer+Tool+v4.5+-+Modded+by+bpear_v3.zip (mediafire direct link)

    http://d-h.st/KrP

    *NOTE* this is using Wolf's method 2 which is confirmed to work on prime, im not sure about tf101 etc. from here http://xdaforums.com/showthread.php?t=1622628

    Mirrors of WW and US .15 blob (TRANSFORMER PRIME): you have to extract the .zip, possibly twice, then there will be a blob file, put that on /sdcard
    http://xdaforums.com/showpost.php?p=25503960&postcount=47
    3
    Let me just say this: you are a freaking genius. I didn't even think of symlinking /dev/block/mmcblk0p4 to /data/local/tmp so it would change ownership and permissions on reboot. This is f*ing brilliant!

    Moreover, if you have a blob for CWM you can also use the second method to install it on an unrooted device and then root it using the customary update.zip with su and superuser.apk (yes, even on 9.2.2.3 TF101Gs).

    Again, great job! ;)
    3
    FAQ

    I'm confused, which BLOB file should I choose?

    You have to choose BLOB with the firmware you want to install e.g. if you are on 9.2.2.3 and want to downgrade to Honeycomb just choose BLOB file from 8.6.6.19 or 8.6.6.23


    Wolf help something happened to my tab, it wont boot up.

    If you let dd to finish all its job and after reboot you saw the flashing bar, but your ROM still don't want to boot up you have probably downgraded from ICS to HC. Just do the wipe by booting with [vol down] and [power] pressed (you will see the info about the rom). Than wait until the screen with android and wipe data appear. Select wipe by switching with [vol down] and accepting with [vol up] pressed two times. Than everything should be fine.


    I'm stuck on step 3 all the time I have message like -> failed on '/data/local/tmp' - Not a directory <- What should I do?

    It means that you have already symlinked something to /data/local/tmp and moved your previous tmp to tmp.bak. To fix that you can either execute:
    Code:
    rm /data/local/tmp.bak
    or:
    Code:
    mv /data/local/tmp /data/local/tmp.mad
    and repeat procedure.


    Can I root the latest firmware and keep my data untouched?

    Yes, on both TF and TFP. For TF101 use method 3.
    For TF201 backup your data with ASUS Backup utility, than do a downgrade, root and install OTA ROOT Keeper from Voodoo. After that update OTA and recover your root and data.



    Can this method be used to root TF301? (aka EeePAD Infinity)

    Unfortunately no, it only allows us to do a step back without root permissions and than apply a root. However I'm still working around ASUS Backup App as I have an idea of exploit (but not enough time to study apk more). If you are interested in this consider donation as I don't have access to any TF301 and that would speed up the researches.