well one last thing to try then I need to get going, try fastboot oem rebootRUU and then flashing like normal. Make sure you use the same PC36IMG.zip version that came with your phone, you can find them on my OP
well one last thing to try then I need to get going, try fastboot oem rebootRUU and then flashing like normal. Make sure you use the same PC36IMG.zip version that came with your phone, you can find them on my OP
# /data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img
mtd: erase failure at 0x00000000 (I/O error)
mtd: erase failure at 0x00000000 (I/O error)
mtd: skipping write block at 0x00000000
mtd: erase failure at 0x00020000 (I/O error)
mtd: erase failure at 0x00020000 (I/O error)
mtd: skipping write block at 0x00020000
mtd: erase failure at 0x00040000 (I/O error)
mtd: erase failure at 0x00040000 (I/O error)
mtd: skipping write block at 0x00040000
mtd: erase failure at 0x00060000 (I/O error)
mtd: erase failure at 0x00060000 (I/O error)
mtd: skipping write block at 0x00060000
mtd: erase failure at 0x00080000 (I/O error)
mtd: erase failure at 0x00080000 (I/O error)
mtd: skipping write block at 0x00080000
mtd: erase failure at 0x000a0000 (I/O error)
mtd: erase failure at 0x000a0000 (I/O error)
mtd: skipping write block at 0x000a0000
mtd: erase failure at 0x000c0000 (I/O error)
mtd: erase failure at 0x000c0000 (I/O error)
mtd: skipping write block at 0x000c0000
mtd: erase failure at 0x000e0000 (I/O error)
mtd: erase failure at 0x000e0000 (I/O error)
mtd: skipping write block at 0x000e0000
mtd: erase failure at 0x00100000 (I/O error)
mtd: erase failure at 0x00100000 (I/O error)
mtd: skipping write block at 0x00100000
mtd: erase failure at 0x00120000 (I/O error)
mtd: erase failure at 0x00120000 (I/O error)
mtd: skipping write block at 0x00120000
mtd: erase failure at 0x00140000 (I/O error)
mtd: erase failure at 0x00140000 (I/O error)
mtd: skipping write block at 0x00140000
mtd: erase failure at 0x00160000 (I/O error)
mtd: erase failure at 0x00160000 (I/O error)
mtd: skipping write block at 0x00160000
mtd: erase failure at 0x00180000 (I/O error)
mtd: erase failure at 0x00180000 (I/O error)
mtd: skipping write block at 0x00180000
mtd: erase failure at 0x001a0000 (I/O error)
mtd: erase failure at 0x001a0000 (I/O error)
mtd: skipping write block at 0x001a0000
mtd: erase failure at 0x001c0000 (I/O error)
mtd: erase failure at 0x001c0000 (I/O error)
mtd: skipping write block at 0x001c0000
mtd: erase failure at 0x001e0000 (I/O error)
mtd: erase failure at 0x001e0000 (I/O error)
mtd: skipping write block at 0x001e0000
mtd: erase failure at 0x00200000 (I/O error)
mtd: erase failure at 0x00200000 (I/O error)
mtd: skipping write block at 0x00200000
mtd: erase failure at 0x00220000 (I/O error)
mtd: erase failure at 0x00220000 (I/O error)
mtd: skipping write block at 0x00220000
mtd: erase failure at 0x00240000 (I/O error)
mtd: erase failure at 0x00240000 (I/O error)
mtd: skipping write block at 0x00240000
mtd: erase failure at 0x00260000 (I/O error)
mtd: erase failure at 0x00260000 (I/O error)
mtd: skipping write block at 0x00260000
mtd: erase failure at 0x00280000 (I/O error)
mtd: erase failure at 0x00280000 (I/O error)
mtd: skipping write block at 0x00280000
mtd: erase failure at 0x002a0000 (I/O error)
mtd: erase failure at 0x002a0000 (I/O error)
mtd: skipping write block at 0x002a0000
mtd: erase failure at 0x002c0000 (I/O error)
mtd: erase failure at 0x002c0000 (I/O error)
mtd: skipping write block at 0x002c0000
mtd: erase failure at 0x002e0000 (I/O error)
mtd: erase failure at 0x002e0000 (I/O error)
mtd: skipping write block at 0x002e0000
mtd: erase failure at 0x00300000 (I/O error)
mtd: erase failure at 0x00300000 (I/O error)
mtd: skipping write block at 0x00300000
mtd: erase failure at 0x00320000 (I/O error)
mtd: erase failure at 0x00320000 (I/O error)
mtd: skipping write block at 0x00320000
mtd: erase failure at 0x00340000 (I/O error)
mtd: erase failure at 0x00340000 (I/O error)
mtd: skipping write block at 0x00340000
mtd: erase failure at 0x00360000 (I/O error)
mtd: erase failure at 0x00360000 (I/O error)
mtd: skipping write block at 0x00360000
mtd: erase failure at 0x00380000 (I/O error)
mtd: erase failure at 0x00380000 (I/O error)
mtd: skipping write block at 0x00380000
mtd: erase failure at 0x003a0000 (I/O error)
mtd: erase failure at 0x003a0000 (I/O error)
mtd: skipping write block at 0x003a0000
mtd: erase failure at 0x003c0000 (I/O error)
mtd: erase failure at 0x003c0000 (I/O error)
mtd: skipping write block at 0x003c0000
mtd: erase failure at 0x003e0000 (I/O error)
mtd: erase failure at 0x003e0000 (I/O error)
mtd: skipping write block at 0x003e0000
mtd: erase failure at 0x00400000 (I/O error)
mtd: erase failure at 0x00400000 (I/O error)
mtd: skipping write block at 0x00400000
mtd: erase failure at 0x00420000 (I/O error)
mtd: erase failure at 0x00420000 (I/O error)
mtd: skipping write block at 0x00420000
mtd: erase failure at 0x00440000 (I/O error)
mtd: erase failure at 0x00440000 (I/O error)
mtd: skipping write block at 0x00440000
mtd: erase failure at 0x00460000 (I/O error)
mtd: erase failure at 0x00460000 (I/O error)
mtd: skipping write block at 0x00460000
mtd: erase failure at 0x00480000 (I/O error)
mtd: erase failure at 0x00480000 (I/O error)
mtd: skipping write block at 0x00480000
mtd: erase failure at 0x004a0000 (I/O error)
mtd: erase failure at 0x004a0000 (I/O error)
mtd: skipping write block at 0x004a0000
mtd: erase failure at 0x004c0000 (I/O error)
mtd: erase failure at 0x004c0000 (I/O error)
mtd: skipping write block at 0x004c0000
mtd: erase failure at 0x004e0000 (I/O error)
mtd: erase failure at 0x004e0000 (I/O error)
mtd: skipping write block at 0x004e0000
error writing recovery: No space left on device
#
Firstly, I'd like to say thanks for the Write-up and help provided within this thread. I've attempted to follow this tutorial on a Mac (I know) and was able to access root since I had the '#' symbol in Terminal. However, with the eng-pc36img.zip file provided in the second post, my phone got stuck in the Fastboot screen (white screen with androids skating). I could not get out of the menu, nor could I access the phone via abd. I found another PC36IMG file and it got me too boot back up, but to 2.1 update 1 (phone came with 2.2)
The problem:
When I try to flash the Amon Recovery I get this:
Code:# /data/flash_image recovery /sdcard/recovery-RA-evo-v1.8.0.img mtd: erase failure at 0x00000000 (I/O error) mtd: erase failure at 0x00000000 (I/O error) mtd: skipping write block at 0x00000000 mtd: erase failure at 0x00020000 (I/O error) mtd: erase failure at 0x00020000 (I/O error) mtd: skipping write block at 0x00020000 mtd: erase failure at 0x00040000 (I/O error) mtd: erase failure at 0x00040000 (I/O error) mtd: skipping write block at 0x00040000 mtd: erase failure at 0x00060000 (I/O error) mtd: erase failure at 0x00060000 (I/O error) mtd: skipping write block at 0x00060000 mtd: erase failure at 0x00080000 (I/O error) mtd: erase failure at 0x00080000 (I/O error) mtd: skipping write block at 0x00080000 mtd: erase failure at 0x000a0000 (I/O error) mtd: erase failure at 0x000a0000 (I/O error) mtd: skipping write block at 0x000a0000 mtd: erase failure at 0x000c0000 (I/O error) mtd: erase failure at 0x000c0000 (I/O error) mtd: skipping write block at 0x000c0000 mtd: erase failure at 0x000e0000 (I/O error) mtd: erase failure at 0x000e0000 (I/O error) mtd: skipping write block at 0x000e0000 mtd: erase failure at 0x00100000 (I/O error) mtd: erase failure at 0x00100000 (I/O error) mtd: skipping write block at 0x00100000 mtd: erase failure at 0x00120000 (I/O error) mtd: erase failure at 0x00120000 (I/O error) mtd: skipping write block at 0x00120000 mtd: erase failure at 0x00140000 (I/O error) mtd: erase failure at 0x00140000 (I/O error) mtd: skipping write block at 0x00140000 mtd: erase failure at 0x00160000 (I/O error) mtd: erase failure at 0x00160000 (I/O error) mtd: skipping write block at 0x00160000 mtd: erase failure at 0x00180000 (I/O error) mtd: erase failure at 0x00180000 (I/O error) mtd: skipping write block at 0x00180000 mtd: erase failure at 0x001a0000 (I/O error) mtd: erase failure at 0x001a0000 (I/O error) mtd: skipping write block at 0x001a0000 mtd: erase failure at 0x001c0000 (I/O error) mtd: erase failure at 0x001c0000 (I/O error) mtd: skipping write block at 0x001c0000 mtd: erase failure at 0x001e0000 (I/O error) mtd: erase failure at 0x001e0000 (I/O error) mtd: skipping write block at 0x001e0000 mtd: erase failure at 0x00200000 (I/O error) mtd: erase failure at 0x00200000 (I/O error) mtd: skipping write block at 0x00200000 mtd: erase failure at 0x00220000 (I/O error) mtd: erase failure at 0x00220000 (I/O error) mtd: skipping write block at 0x00220000 mtd: erase failure at 0x00240000 (I/O error) mtd: erase failure at 0x00240000 (I/O error) mtd: skipping write block at 0x00240000 mtd: erase failure at 0x00260000 (I/O error) mtd: erase failure at 0x00260000 (I/O error) mtd: skipping write block at 0x00260000 mtd: erase failure at 0x00280000 (I/O error) mtd: erase failure at 0x00280000 (I/O error) mtd: skipping write block at 0x00280000 mtd: erase failure at 0x002a0000 (I/O error) mtd: erase failure at 0x002a0000 (I/O error) mtd: skipping write block at 0x002a0000 mtd: erase failure at 0x002c0000 (I/O error) mtd: erase failure at 0x002c0000 (I/O error) mtd: skipping write block at 0x002c0000 mtd: erase failure at 0x002e0000 (I/O error) mtd: erase failure at 0x002e0000 (I/O error) mtd: skipping write block at 0x002e0000 mtd: erase failure at 0x00300000 (I/O error) mtd: erase failure at 0x00300000 (I/O error) mtd: skipping write block at 0x00300000 mtd: erase failure at 0x00320000 (I/O error) mtd: erase failure at 0x00320000 (I/O error) mtd: skipping write block at 0x00320000 mtd: erase failure at 0x00340000 (I/O error) mtd: erase failure at 0x00340000 (I/O error) mtd: skipping write block at 0x00340000 mtd: erase failure at 0x00360000 (I/O error) mtd: erase failure at 0x00360000 (I/O error) mtd: skipping write block at 0x00360000 mtd: erase failure at 0x00380000 (I/O error) mtd: erase failure at 0x00380000 (I/O error) mtd: skipping write block at 0x00380000 mtd: erase failure at 0x003a0000 (I/O error) mtd: erase failure at 0x003a0000 (I/O error) mtd: skipping write block at 0x003a0000 mtd: erase failure at 0x003c0000 (I/O error) mtd: erase failure at 0x003c0000 (I/O error) mtd: skipping write block at 0x003c0000 mtd: erase failure at 0x003e0000 (I/O error) mtd: erase failure at 0x003e0000 (I/O error) mtd: skipping write block at 0x003e0000 mtd: erase failure at 0x00400000 (I/O error) mtd: erase failure at 0x00400000 (I/O error) mtd: skipping write block at 0x00400000 mtd: erase failure at 0x00420000 (I/O error) mtd: erase failure at 0x00420000 (I/O error) mtd: skipping write block at 0x00420000 mtd: erase failure at 0x00440000 (I/O error) mtd: erase failure at 0x00440000 (I/O error) mtd: skipping write block at 0x00440000 mtd: erase failure at 0x00460000 (I/O error) mtd: erase failure at 0x00460000 (I/O error) mtd: skipping write block at 0x00460000 mtd: erase failure at 0x00480000 (I/O error) mtd: erase failure at 0x00480000 (I/O error) mtd: skipping write block at 0x00480000 mtd: erase failure at 0x004a0000 (I/O error) mtd: erase failure at 0x004a0000 (I/O error) mtd: skipping write block at 0x004a0000 mtd: erase failure at 0x004c0000 (I/O error) mtd: erase failure at 0x004c0000 (I/O error) mtd: skipping write block at 0x004c0000 mtd: erase failure at 0x004e0000 (I/O error) mtd: erase failure at 0x004e0000 (I/O error) mtd: skipping write block at 0x004e0000 error writing recovery: No space left on device #
Any thoughts or ideas as to why I have no space on the device? Also, I downloaded ROM manager and attempted to install Clockwork Recovery, which resulted in an error. Thanks in advance
hey guys just picked up an evo tonight
trying to root
ran the runexploit (using win xp pro 32 bit) after copying moveme to the sd card, had over 1.2gb free before copying
i got "
ADB server didn't ACK
* failed to start daemon *
error:
*This will take a few moments, please do not disturb this window or your phone
until it finishes...
"
its been 30 mins, the log generated reads as follow :
"
----------
Sun 11/21/2010 2:20:45.15 runexploit.bat Begin
----------
UID 'adb'
adb server is out of date. killing...
* daemon started successfully *
adb server is out of date. killing...
"
phone is still on, nothing has happened
it is a rev3
debating if i should unplug, reboot and start over
i doubt anyone is up but if so any suggestions would be awesome
yw. Something must not have taken, you may just need to reboot and try again.
Its also possible something in the script isn't working right on your pc, what windows do you have?
Sent from my PC36100 using XDA App
# cat /sdcard/moveme/flash_image > /data/flash_image
# chmod 755 /data/flash_image
# /data/flash_image recovery /sdcard/moveme/recovery-RA-evo-v1.8.0.img
I'm on a MacBook so I used the last set of commands provided at the end of the second post.
I'm not loading the latest Radio and WiMax at this point so I skipped ahead to flash the Recovery. Everything goes good until the last part when I get the out of memory error. I"ll try again.
**Edit**
Code:# cat /sdcard/moveme/flash_image > /data/flash_image # chmod 755 /data/flash_image # /data/flash_image recovery /sdcard/moveme/recovery-RA-evo-v1.8.0.img
The last line results in the error
Hello All, completely unable to get this to work: I have rooted with z4 on Rogers 2.1 - Phone is unlocked. Below is the errors I am getting:
Error when running exploit:
error: device not found
Error: ADB can not see your phone. Make sure it is plugged in, ADB Debugging is
enable, and on charge only. If it is already connected you will need to restart
it and try again.
Press any key to continue . . .
Error when running recovery:
*This will take a few moments, please do not disturb this window or your phone
until it finishes...
Waiting for server to restart...
Checking for Root...
error: device not found
Unable to get a root shell, try running the exploit manually.
Type: adb shell {enter}
Then: ./data/local/tmp/rageagainstthecage-arm5.bin
It should kick you out of the shell after a moment and disconnect your phone, on
ce it does that run 'adb shell' and check for a root prompt (#).
If it says Device not found you will have to reboot your phone and try again.
Root access re-acquired, please restart flashrecovery.bat.
Press any key to continue . . .
\
Manually running exploit from command prompt:
D:\EVORoot_-_No_Boot_Radio_ROM>runexploit
*This will take a few moments, please do not disturb this window or your phone
until it finishes...
error: protocol fault (status 2f 64 61 74?!)
Waiting for server to restart...
Checking for Root...
error: device not found
Unable to get a root shell, try running the exploit manually.
Type: adb shell {enter}
Then: ./data/local/tmp/rageagainstthecage-arm5.bin
It should kick you out of the shell after a moment and disconnect your phone, on
ce it does that run 'adb shell' and check for a root prompt (#).
If it says Device not found you will have to reboot your phone and try again.
Press any key to continue . . .
D:\EVORoot_-_No_Boot_Radio_ROM>
D:\EVORoot_-_No_Boot_Radio_ROM>adb shell
$ ./data/local/tmp/rageagainstthecage-arm5.bin
./data/local/tmp/rageagainstthecage-arm5.bin
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
[*] checking NPROC limit ...
[+] RLIMIT_NPROC={2872, 2872}
[*] Searching for adb ...
[+] Found adb as PID 18170
[*] Spawning children. Dont type anything and wait for reset!
[*]
[*] If you like what we are doing you can send us PayPal money to
[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.
[*] If you are a company and feel like you profit from our work,
[*] we also accept donations > 1000 USD!
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
D:\EVORoot_-_No_Boot_Radio_ROM>adb shell
error: device not found
Sorry another typo....
OK, type adb reboot oem-78 and have it ready in your cmd window...
Power on your phone and when you release the power button start hitting enter / up arrow / enter / up arrow / etc.. in the cmd window. At first you will get error: device not found, but eventually it will take and your phone will go to an black screen with HTC in the middle. Once that happens, then you can fastboot flash zip rom.zip. Remember, it MUST be the rom from the RUU 3.29 or 3.30 -- it doesn't matter as long as it is signed...
-- Brian
EDIT: I thought you were on of the people that didn't even have adb access. You can ignore the part about spamming adb reboot oem-78 and just type it as long as adb can talk to your device. The rest still stands...
This tool is now deprecated. To root your Evo 4G running Gingerbread you will need to use the Revolutionary tool that can be found at http://www.revolutionary.io.
I'm sorry to do it but due to the ridiculous amount of people who are still asking for help rooting gingerbread, I will no longer be supporting this tool what so ever. Any further emails I receive about it will be deleted.
You Will Need:
- A windows machine
- HTC Sync that can be found on Sprint's website. HTC Sync 2.0.35.exe
- At least 1 GB of free space on your SD card
- A full or close to full battery (your phone will not charge during part of this and if it dies you will be SOL, aka Bricked)
- ADB debugging enabled (Settings > Applications > Development > ADB Debugging)
- Your phone connected to your computer as Charge Only and HTC's Evo drivers / HTC Sync installed.
- The AutoRoot.zip File that can be found in this post
[*]I highly recommend you have the appropriate RUU, or PC36IMG, downloaded before you start. It is always good to have and if something does not go as planned it can get your phone back up and running with minimal down time.
Instructions:
- This will try to back up your apps but it's not always able to, you will also lose all of your settings. Titanium Backup works well to save your apps however you will need to use z4root to temporarily root before you will be able to use it.
- Download HTC Sync from Sprint's website here and install it. You may need to use the 'Repair' option for it to replace any old drivers.
- Extract AutoRoot.zip into a folder that is easy to find and then open the folder.
- Right click on 'AutoRoot.bat' and run it as Administrator.
- Once it finds your phone it will start by checking out what kind of setup it uses and then attempt to get root access. If it fails usually it's from too many active apps or the phone being used, if so you will need to restart it before trying again. If you are using 3.70 it will let you know when it is running by blurring the screen.
- When it is ready it will reboot your phone into the boot loader. Then, depending on your phones setup, it will either enter RUU mode and automatically flash the debugging firmware or give you instructions on how to flash it from the hBoot.
- If you have to flash it manually just push Power to select "BOOTLOADER" and say Yes when it asks to flash the PC36IMG.zip. It will complain part of the way through about Boot Loader and/or radio errors and then skip them, this is normal. Once it finishes say No when asked to reboot and use the Vol Down button to highlight Recovery. Then press Power to select it.
- If you are entering the Recovery your phone will show a Red Triangle with an Exclamation mark inside, at this point the script will take back over and attempt to flash Unrevoked Forever.
- After it finishes flashing the engineering bootloader, or Unrevoked Forever, it will reboot into the bootloader and see if your NAND is unlocked. If so it will flash the Sprint Lovers ROM along with the Recovery and updated Radios. Afterward it may boot into the ROM and attempt to restore your Apps before finishing, try not to interrupt it until it tells you it has finished.
- Once it's fully rooted and you have your phone set back up it's a good idea to make one more NANDroid with everything up to date. Then make one more backup of your WiMAX partition in case something happens to the first one.
Instructions for Quick method:
- This will completely wipe your phone. If you would like to back up your apps you can use Titanium backup to save them. It also has an option to save the system files but this can result in a buggy ROM afterward.
- Extract AutoRoot.zip into a folder that is easy to find.
- Open a DOS prompt by running the OpenShell file.
- Type 'autoroot quick' and press Enter
- It will then flash the engineering bootloader and the recovery through fastboot. Once it is finished you can use the bootloader menu to boot into the recovery and make a NANDroid, flash a ROM, radios, etc.
Links:
Downloads
AutoRoot v2.5 - Full Root Zip (MD5: 5E1BF365F3B5479329896BD55C33678E)
AutoRoot v2.5 - Tools Only (MD5: 5DBA70A8CDD052A9908E4F43D6BBC669)
The following are the ROMs pulled out of the RUUs, you can flash them by renaming and putting it on your sd card or from your computer with fastboot using the included FlashZip script.
Sprint Evos (USA):
3.29.651.5_PC36IMG.zip (MD5: 2F5046C0FC6FE61114EBC53D5997B485)
3.30.651.2_PC36IMG.zip (MD5: 4A2CAB264244C79B2E2BE9E3CFE2B503)
3.70.651.1_PC36IMG.zip (MD5: 7056D42812AA5DF03FCC8DDDC2B64E85)
KDDI Evos (Japan):
1.05.970.1_PC36IMG.zip (MD5: 78F9E8BFEE705F34790A46C258268F02)
Sources
How to unlock Nand Protection ~ Part-2
RA-evo-v1.8.0 (a modified version is included)
RUU to restore 3.29.651.5
RUU to restore 3.30.651.2
RUU to restore 3.70.651.1 (Thanks to 911Sniper for the original mirror)
Sprint Lovers ROM (a modified version is included)
Changes for v2.5
- Script now checks for Admin Priveledges and kills HTC Sync Services for Sync 3.05
- Fixed issue recognizing build numbers
- It will attempt to back up Apps now
- Checks branding in order to recognize KDDI Evos
- Unrevoked forever will now be retried if it doesn't get run the first try
- Changed it so it will leave the phones in Fastboot mode if it fails
- Recognizes ADB issues easier now
Changes for v2.4
- Updated the ROM and Recovery
- The working directory is now saved correctly when the path has a space in it
- Fixed an error checking the firmware version that would cause the script to close
- Made it more capable of recovering when the phone is in an unknown state
- Fixed the SD card not being recognized with Eclair
- Some parts will check for the 'daemon' error messages and will call to fix it
- Made it so the MTD data is not saved unless it is recognized
- The script will continue if it times out while waiting on Unrevoked Forever
- The WiMAX partition is backed up through the ROM at the very beginning instead of through the Recovery
Changes for v2.3:
- Updated the ROM, Recovery and Radios
- The script will now recognize your phone at any point in the process and will continue where it left off
- Fixed the FlashRecovery script and made it so you can choose what to flash, just put your PC36IMG of choice in the folder with it and let it do the work
- Fixed the version checker so it doesn't get confused with custom ROMs anymore
- Quick mode checks your hboot version from the ROM now so it won't even try if you have a new bootloader
- It is much more tenacious going into the recovery, hopefully fixing the issue with ADB dropping out there
- Fixed a bug where the MTD block sizes were not always being remembered correctly
- Added more checks to make sure the phone is where it's supposed to be throughout the process
- Made it try harder to get the recovery log so it doesn't get missed as much
- Tweaked the timing some so it moves a little bit quicker and you only have to hit a button twice to exit instead of three times
- Fixed the infinite loops so they are now 95% shorter
Changes for v2.2:
- Updated the recovery to Amon RA's version 2.2.1
- MTD information for each phone is saved in case it is restarted and unable to find out.
- Fixed a bug where pre 3.xx ROMs were not being recognized correctly.
- Phones are explicitly called by their serial number to prevent confusion if an emulator starts or another phone gets plugged in.
- Unresponsive ADB daemons are killed to help prevent them for hanging or randomly restarting.
- Changed autoroot.log to autorootlog.txt to make it easier to attach
- Minor bug fixes.
Changes for v2.1:
- Updated the recovery to Amon RA's version 2.2
- Minor bug fixes
Changes for v2.0:
- Added an app to give ADB root and keep it active in 3.70
- Updated Sprint Lovers and Amon RA
- Removed the two separate kernels/recoveries for new and old phones
- Added a battery life check before flashing
- Checks Firmware versions in both the ROM and hBoot
- Checks that the Misc partition was flashed properly
- Fixed all of the bugs with Quick root, it no longer flashes Sprint Lovers if you run it with S-OFF
- It automatically restarts adbd where it would occasionally reset itself and get hung up
- It also kills adbd when it finishes so you can move/delete it
- Changed the bat that restarted adbd so it kills it instead
- Added a bat to flash AmonRA through Fastboot with non-Eng hBoots
- Added a bat to open a Cmd prompt already in the autoroot folder
- Rewrote a good portion of the script and cleaned it up a lot
- Made it more flexible so it doesn't get lost as easily
- Plus more I forgot
Contents of v2.5 Include:
adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
AutoRoot.bat
check.bat
fastboot.exe
fastboot-linux
fastboot-mac
FindPhone.bat
FlashZip.bat
OpenShell.bat
StartRecovery.bat
amon_ra_1.8-mod/
res/
....AutoRoot.apk
....autoroot.ini
....dump_image
....Escalate.vbs
....Escalater.bat
....EscSC.lnk
....exploid.com
....FindPhone.bat
....flash_image
....ini.cmd
....mtd-eng.img
....PC36IMG_UD.zip
....PC36IMG_AmonRA-v2.3-hausmod_revA.zip
....PC36IMG-SprintLovers-AmonRA_2.3-hausmod_revA.zip
....radios.zip
....rageagainstthecage-arm5.bin
....recovery-RA-v2.3-hausmod_revA.img
....URFSOff.zip
....URFSOn.zip
....WatchPhone.bat
Notes:
Recovery is recovery-RA-supersonic-v2.3 with Netarchy's 4.3.2 CFS NoHAVS NoSBC NoUV
radios.zip is EVO_Radio_2.15.00.11.19_WiMAX_27167_R01_PRI_NV_1.90_003
URFSOff.zip is the Unrevoked Forever S-OFF tool
URFSOn.zip is the Unrevoked Forever S-ON tool
As always, this will void your warranty and may possibly damage your phone. You and you alone are responsible for anything that you do. Everything contained in this thread is for informational purposes only.
You Will Need:
- A windows machine and basic knowledge of DOS or a Linux/Mac box with a little bit of determination
- At least 1 GB of free space on your SD card
- A full or close to full battery
- ADB debugging enabled (Settings > Applications > Development > ADB Debugging)
- Your phone connected to your computer as Charge Only
- The EVORoot.zip File that can be found in this post
Instructions:
- Extract EVORoot.zip into a folder that is easy to find and go to that folder. Then copy the 'moveme' folder out of that one and on to your sdcard. Once it finishes copying unmount/eject the SD card through windows and change your phone back to Charge Only.
- Double click on 'runexploit' and let it run. When it asks if you want to flash the hBoot push 'y' and then {enter}. If there are any errors follow the instructions given to try and resolve them. It will automatically reboot your phone once it is ready for it. If all you see is the prompt flashing press Ctrl+C or close the window to exit and re-run it as Administrator.
- When the bootloader comes up push the Power button and you should see it start searching for updates. When it gets to PC36IMG.zip it will ask if you want to update with it, push Volume Up to say yes.
*DO NOT TURN OFF THE PHONE OR LET THE BATTERY DIE WHILE UPDATING*
When it's finished push the power button to select 'fastboot' and use the volume buttons to select the yellow 'reboot' button. Push power one more time to select it and reboot your phone. It should start up rooted and ready to go, however you will still need a custom Recovery so you can make NANDroid back-ups and flash an up to date ROM.
- Once the phone starts back up run 'flashrecovery' through explorer. It will automatically flash and then reboot your phone into Amon_RA's recovery. When it reboots you should see green text on a black background, if you see a triangle with an exclamation mark then you still have the stock recovery and need to reboot and try again.
- Use the volume buttons to select Backup/Restore then push Power to select it.
- Select Nand backup and push power. This will make an exact copy of your phone as it is. If you get an error that says 'run mobile-nandroid...." make sure you have at least 3 or 400MB free on your memory card. You can use USB-MS toggle to mount your SD card if you need to make room or copy a ROM to your phone. The moveme folder can also be deleted from your SD card at this point and you can make copies or move the backup once it is complete. Just make sure you have one good backup before continuing.
The NANDroids are saved under 'nandroid/??????????/backupfolder-date-time/'. The folders need to be moved whole.
- Return to previous menu, select Wipe, then have it Wipe data/factory reset, Wipe cache & Wipe dalvik-cache. If you get stuck in a bootloop try these steps again and try wiping the SD:ext partition as well.
- Return, then go in Flash zip from sdcard. Once there flash the Radios. It is again very important not to interrupt or reset the phone while the radios are being flashed, although it will probably want to reboot before flashing can be finalized, just follow the instructions.
- Once it is finished Return to the previous menu and select Power Off. Then hold down the vol down button while turning the phone back on.
- It will boot back up into the bootloader, select No if it asks to update or reboot. From here select Recovery and it should go back to the black background with green text.
- Select Flash zip from sdcard and Flash ROM-Supersonic_3.30....zip. If you have a different ROM you want to use you can flash another one instead.
- Once it is finished Return to the main menu and have it Reboot system. Your phone should start up normally and ask to be set up, complete the set up like normal.
- When you have it set up and are sure everything is working properly I would make one more NANDroid so you have a copy with the updated radios. At this point you can also flash another recovery and do anything else you would normally do. Just be sure to use unrevoked forever if you plan on using a different hBoot.
Links:
Downloads
EVORoot.zip
EVORoot.zip - No bootloader, ROM or Radio updates
eng-PC36IMG.zip mirror 1, mirror 2
The following are the ROMs pulled out of the RUUs and renamed, make sure you use the correct version for your phone but if you aren't able to find out start with the 3.29.
3.29.651.5_PC36IMG.zip
3.30.651.2_PC36IMG.zip
If you are having trouble flashing custom ROMs try using this kernel (Thanks to xxbabiboi228xx)
Stock kernel #17
Sources
How to unlock Nand Protection ~ Part-2
All EVO Radio, WiMAX, PRI & NV versions
RA-evo-v1.8.0
RUU to restore 3.29.651.5
RUU to restore 3.30.651.2
Contents Include:
adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
exploid.com
flashboot.bat
flashrecovery.bat
runexploit.bat
moveme/
.....eng-PC36IMG.zip
.....evo_radios_wimax_pri_nv_3.30.zip
.....flash_image
.....mtd-eng.img
.....rageagainstthecage-arm5.bin
.....recovery-RA-evo-v1.8.0.img
.....SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip
Instructions:
- Extract EVORoot.zip into a folder that is easy to find such as C:\EVORoot. Then copy the 'moveme' folder out of that one and on to your sdcard.
- Open up a DOS prompt and go to the EVORoot directory. eg. 'cd C:\EVORoot'.
- type: runexploit {enter}
It will scroll a few lines saying that the ADB server will be reset and to run it on the desktop, this is normal. If it says Permission Denied check to make sure your phone is set to charge only and your sd card is not mounted as a hard disk.
- type: adb shell {enter}
If you see '$' then type: "./data/local/tmp/rageagainstthecage-arm5.bin", without the quotation marks, and push enter. After a few seconds it should kick you out to the \> prompt.
If you see '#' then type: exit {enter}
- type: flashboot {enter}
If you don't see any errors let it continue, if you do see an error push Ctrl+X to stop
- Your phone will then reboot, when it comes back up the bootloader option should be highlight. Press the power button to select it. It should then search for a second and ask if you want to install the pc36img.zip, push Volume Up for Yes.
*DO NOT TURN OFF THE PHONE OR LET THE BATTERY DIE WHILE UPDATING*
When it's finished go into fastboot and select the yellow 'reboot' through the menu, it should start up rooted and ready to go however you will still need a custom Recovery so you can make NANDroid back-ups and flash an up to date ROM.
- Once the phone starts up do step #4 to check for root (# prompt), if it is a '$' try typing 'su {enter}'. If that does not work use runexploit and then check again. Return to the DOS prompt once finished.
- type: flashrecovery {enter}
Let it continue as long as there are no errors, otherwise Ctrl+X will stop it. If you run this more than once you can ignore the file not found errors from when it first starts. When the phone reboots you should see green text on a black background, if you see a triangle with an exclamation mark then you still have the stock recovery.
- Use the volume buttons to select Backup/Restore then push Power to select it.
- Select Nand backup and push power. This will make an exact copy of your phone as it is. If you get an error that says 'run mobile-nandroid...." make sure you have at least 3 or 400MB free on your memory card. You can use USB-MS toggle to mount your SD card if you need to make room or copy a ROM to your phone. The moveme folder can also be deleted from your SD card at this point and you can make copies or move the backup once it is complete. Just make sure you have one good backup before continuing.
The NANDroids are saved under 'nandroid/??????????/backupfolder-date-time/'. The folders need to be moved whole.
- Return to previous menu, select Wipe, then have it Wipe data/factory reset, Wipe cache & Wipe dalvik-cache. If you get stuck in a bootloop try these steps again and try wiping the SD:ext partition as well.
- Return, then go in Flash zip from sdcard. Select and Flash ROM-Supersonic_3.30....zip. If you have a different ROM you want to use you can flash that one instead.
- Flash the Radios, it is again very important not to interrupt or reset the phone while the radios are being flashed. It will probably want to reboot itself afterward, just follow the instructions.
- Once it is finished Return to the main menu and have it Reboot system. Your phone should start up normally and ask to be set up, complete the set up like normal.
- Once you have it set up and are sure everything is working properly I would make one more NANDroid so you have a copy with the updated radios. At this point you can also flash another recovery and do anything else you would normally do. Just be sure to use unrevoked forever if you plan on using a different hBoot.
Contents Include:
adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
flashboot.bat
flashrecovery.bat
runexploit.bat
moveme/
.....eng-PC36IMG.zip
.....evo_radios_wimax_pri_nv_3.30.zip
.....flash_image
.....mtd-eng.img
.....rageagainstthecage-arm5.bin
.....recovery-RA-evo-v1.8.0.img
.....SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip
Batch Files
runexploit.bat
Code:adb shell "cat /sdcard/moveme/rageagainstthecage-arm5.bin > /data/local/tmp/rageagainstthecage-arm5.bin" adb shell "chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin" adb shell "./data/local/tmp/rageagainstthecage-arm5.bin"
flashboot.bat
Code:adb shell "cat /sdcard/moveme/flash_image > /data/flash_image" adb shell "chmod 755 /data/flash_image" adb shell "/data/flash_image misc /sdcard/moveme/mtd-eng.img" adb shell "mv /sdcard/moveme/eng-pc36img.zip /sdcard/pc36img.zip" adb shell sync adb reboot bootloader
flashrecovery.bat
Code:adb shell "mv /sdcard/PC36IMG.zip /sdcard/moveme/eng-PC36IMG.zip" adb shell "mv /sdcard/moveme/evo_radio_wimax_pri_nv_3.30.zip /sdcard/evo_radio_wimax_pri_nv_3.30.zip" adb shell "mv /sdcard/moveme/SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip /sdcard/ROM-SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip" adb shell "cat /sdcard/moveme/flash_image > /data/flash_image" adb shell "chmod 755 /data/flash_image" adb shell "/data/flash_image recovery /sdcard/moveme/recovery-RA-evo-v1.8.0.img" adb shell sync adb reboot recovery
This uses HTC's eng hBoot to unlock NAND protection so it is relatively safe, but, as always, this will void your warranty and may possibly damage your phone. You and you alone are responsible for anything that you do. This is for informational purposes only.