First of all, unforgiven512 deserves most of the credit for coming up with the initial tutorial for perm root and s=off for the new HTC devices. Also, thanks to adwinp for the instructions on hexeditting the kernel module to make it work with the MT4G.
This was a collaborative #g2root effort, primarily involving scotty2, tmzt, IntuitiveNipple but also many others!
Ok, so the usual disclaimers go here:
I am not responsible for your bricked phone or the ignorance that may or may not have caused it based on the fact that you CHOSE to follow these steps. Read through the forums and LEARN before you attempt to flash any device. You have been warned.
This method only works for those devices who have already received their OTA update!!!
Now that that is out of the way here we go:
First make sure you have visionary installed!
Root.rar (all files plus a script to make things a little easier.
)
http://www.mediafire.com/?flit79p2y069bb3
md5sum: 46361b0cc8652d88688c0ab66d44950b
1. Download the root.rar file and unzip it to /sdcard on your device.
2. Run VISIONary to gain temp root.
Now I am going to run two different sets of instructions (you'll understand why in a minute):
Terminal Emulator Method
3a. Start terminal emulator up on your device.(I prefer this method b/c you can see the output.)
a. type "su" + enter to gain root privileges.
b. Type "cd /sdcard/root" + enter.
c. Type "sh root.sh" + enter.
d. Follow the on screen prompts.
File Explorer Method
3b. Start up root explorer, sufbs, or some other type of file browser with root privileges.
a. Navigate to /sdcard/root on your device.
b. Click on root.sh and allow it to run. Some file browsers ask you if you want to or not.
c. Now wait about 18 to 20 seconds and restart your device into the bootloader to check if S=off is displayed.
4. Start the device back up.
5. Run visionary again and reboot again. This will make root stick.
You can now uninstall visionary and enjoy permaroot.
Alternative Root Process
First, uninstall visionary and superuser and restart your device to wipe out temp root.
Second, download MT4G Modperm.zip and unzip its contents to your sdk tools directory.
MT4G Modperm.zip: http://www.mediafire.com/?eaw0q0zjc7rrrwh
MD5Sum: 3ea4a7a6ddee711d12f7350ce60fae33
Then:
Windows Users:
1a. Using Explorer navigate to the root of your sdk. Hold shift and right mouse click on the tools folder. Select "Open command window here".
2a. Type "adbbat" + enter. Wait till the batch file finishes.
Linux Users:
1b. Using file browser of your choice (or terminal) navigate to the tools folder of your sdk and double click on adbbat.sh (type sh adbbat.sh if you are using terminal). Credit for adbbat.sh goes to slhpss.
2. Disconnect your phone from the PC.
3. Open terminal emulator on the phone and type "/data/local/rage" + enter. Wait for "Forked XXXXXXXX children" to appear and then close the terminal.
4. Start terminal back up. It should force close.
5. Start terminal back up, again. This time it should stay open and you should have a "#" prompt instead of a "$" prompt. Then type "/data/local/temp.sh.
6. When the script finishes run /data/local/rage again and sit tight. The phone should start acting weird and do a soft reboot. Then right after everything loads it should do a hard reboot. After the hard reboot reboot and check S.(If it doesn't do the two reboots just reboot into hboot yourself after rage finishes with the "forked xxxxxxxx children" message.
7. Enjoy root!
If you still have problems getting su to work after this uninstall visionary, shutdown, pull battery, and restart. Should work after that. Props to PolishDude for figuring that one out.
If you have tried EVERYTHING and still cannot get it to work for through the process and wait 30 minutes to an hour. The driver might have a cache delay write and you may need to give it some time to allow the sync command to work. This has worked for one other person (mfouco). BTW, this was figured out by coachmai. Props man!
If su doesn't stick, flash again! You can't overroot it!
Process for turning S back on
Download this file and unzip it to /sdcard on your device.
unroot.rar
http://www.mediafire.com/?12oi5elu7v2y8og
md5sum: aad4e64126cf8d92d7e8b5abb48fdadd
Terminal Emulator Method
1. Open up terminal editor on your device.(I prefer this method b/c you can see the output.)
a. Type "su" + enter to gain root privileges.
b. Type "cd /sdcard/unroot" + enter.
c. Type "sh unroot.sh" + enter.
d. Follow the onscreen prompts.
File Explorer Method
2. Open root explorer, sufbs, or some other file browser with root access.
a. Navigate to /sdcard/unroot.
b. Click on unroot.sh and allow it to run. Some file browsers ask permission before they execute scripts.
c. Wait 18 to 20 seconds and reboot your phone into the bootloader to check if S=on.
You now have S=ON again.
Since we opened up the nand to writes you should still retain persistent root privileges.
Hope this makes it all easier for you.
Cheers --grankin01
For everyone that is have trouble writing to the protected areas of the system after following the rooting procedures.
Reboot into Clockwork recovery and choose the mounts and storage option. From there choose mount system (or whichever protected directory you want access to) and click the trackpad. When unmount system shows you have rw access to the /system directory and all of its subs.
This was a collaborative #g2root effort, primarily involving scotty2, tmzt, IntuitiveNipple but also many others!
Ok, so the usual disclaimers go here:
I am not responsible for your bricked phone or the ignorance that may or may not have caused it based on the fact that you CHOSE to follow these steps. Read through the forums and LEARN before you attempt to flash any device. You have been warned.
This method only works for those devices who have already received their OTA update!!!
Now that that is out of the way here we go:
First make sure you have visionary installed!
Root.rar (all files plus a script to make things a little easier.
)http://www.mediafire.com/?flit79p2y069bb3
md5sum: 46361b0cc8652d88688c0ab66d44950b
1. Download the root.rar file and unzip it to /sdcard on your device.
2. Run VISIONary to gain temp root.
Now I am going to run two different sets of instructions (you'll understand why in a minute):
Terminal Emulator Method
3a. Start terminal emulator up on your device.(I prefer this method b/c you can see the output.)
a. type "su" + enter to gain root privileges.
b. Type "cd /sdcard/root" + enter.
c. Type "sh root.sh" + enter.
d. Follow the on screen prompts.
File Explorer Method
3b. Start up root explorer, sufbs, or some other type of file browser with root privileges.
a. Navigate to /sdcard/root on your device.
b. Click on root.sh and allow it to run. Some file browsers ask you if you want to or not.
c. Now wait about 18 to 20 seconds and restart your device into the bootloader to check if S=off is displayed.
4. Start the device back up.
5. Run visionary again and reboot again. This will make root stick.
You can now uninstall visionary and enjoy permaroot.
Alternative Root Process
First, uninstall visionary and superuser and restart your device to wipe out temp root.
Second, download MT4G Modperm.zip and unzip its contents to your sdk tools directory.
MT4G Modperm.zip: http://www.mediafire.com/?eaw0q0zjc7rrrwh
MD5Sum: 3ea4a7a6ddee711d12f7350ce60fae33
Then:
Windows Users:
1a. Using Explorer navigate to the root of your sdk. Hold shift and right mouse click on the tools folder. Select "Open command window here".
2a. Type "adbbat" + enter. Wait till the batch file finishes.
Linux Users:
1b. Using file browser of your choice (or terminal) navigate to the tools folder of your sdk and double click on adbbat.sh (type sh adbbat.sh if you are using terminal). Credit for adbbat.sh goes to slhpss.
2. Disconnect your phone from the PC.
3. Open terminal emulator on the phone and type "/data/local/rage" + enter. Wait for "Forked XXXXXXXX children" to appear and then close the terminal.
4. Start terminal back up. It should force close.
5. Start terminal back up, again. This time it should stay open and you should have a "#" prompt instead of a "$" prompt. Then type "/data/local/temp.sh.
6. When the script finishes run /data/local/rage again and sit tight. The phone should start acting weird and do a soft reboot. Then right after everything loads it should do a hard reboot. After the hard reboot reboot and check S.(If it doesn't do the two reboots just reboot into hboot yourself after rage finishes with the "forked xxxxxxxx children" message.
7. Enjoy root!
If you still have problems getting su to work after this uninstall visionary, shutdown, pull battery, and restart. Should work after that. Props to PolishDude for figuring that one out.
If you have tried EVERYTHING and still cannot get it to work for through the process and wait 30 minutes to an hour. The driver might have a cache delay write and you may need to give it some time to allow the sync command to work. This has worked for one other person (mfouco). BTW, this was figured out by coachmai. Props man!
If su doesn't stick, flash again! You can't overroot it!
Process for turning S back on
Download this file and unzip it to /sdcard on your device.
unroot.rar
http://www.mediafire.com/?12oi5elu7v2y8og
md5sum: aad4e64126cf8d92d7e8b5abb48fdadd
Terminal Emulator Method
1. Open up terminal editor on your device.(I prefer this method b/c you can see the output.)
a. Type "su" + enter to gain root privileges.
b. Type "cd /sdcard/unroot" + enter.
c. Type "sh unroot.sh" + enter.
d. Follow the onscreen prompts.
File Explorer Method
2. Open root explorer, sufbs, or some other file browser with root access.
a. Navigate to /sdcard/unroot.
b. Click on unroot.sh and allow it to run. Some file browsers ask permission before they execute scripts.
c. Wait 18 to 20 seconds and reboot your phone into the bootloader to check if S=on.
You now have S=ON again.
Since we opened up the nand to writes you should still retain persistent root privileges.
Hope this makes it all easier for you.
Cheers --grankin01
For everyone that is have trouble writing to the protected areas of the system after following the rooting procedures.
Reboot into Clockwork recovery and choose the mounts and storage option. From there choose mount system (or whichever protected directory you want access to) and click the trackpad. When unmount system shows you have rw access to the /system directory and all of its subs.
Last edited:
