[DEPRECATED] Universal HTC RUU/ROM Decryption Tool (v2.0.0) - new link inside

[Captain_Throwback]

UPDATE: This version of the tool is now deprecated. Please use the updated version!
(and thank @nkk71 while you're at it!!)

[TOOL][LINUX|WINDOWS][64bit][20-MAY-2016]Universal HTC RUU/ROM Decryption Tool 3.0.0​

----------------------------------------------------
Original Post:

First of all, I want to state that I deserve credit for none of this - all I did was aggregate some of the great work done by the fantastic devs here on XDA.

BIG Thanks @nkk71, for his idea to make this work universally on all encrypted HTC RUUs and all his hard work to make it happen! All I really did was post the thread.

Prerequisites:
- A system running a 64-bit Linux distro (tested on Ubuntu 15.10 & 16.04 LTS)
- At least 5GB of available disk space (ROMs are big)

readme.txt:

*** Captain_Throwback & nkk71's RUU decryption scripts for HTC Devices ***

INSTALLATION STEPS:
Extract files into folder of your choice, being sure to preserve the folder structure. The decrypt-htc binary and this readme file should be the only files in the root folder.

Download the encrypted RUU or encrypted rom zip of your choice from HTC (or wherever).

Place RUU.exe in the "place_ruu_here" folder or the ROM.zip in the "place_rom_zip_here" folder.

Run ./decrypt-htc and wait for script to complete (you may be prompted for input if there are issues).

The script will output 3 files (to the "out" folder): boot.img, system.img & the encrypted rom zip you started with (or was extracted from the RUU), named for SD card flashing on your device (if your device has an SD card). There will also be a folder with the extracted firmware for your device that can be used however you see fit :).
NOTE: For the A9, for example, the rom.zip will be named 2PQ9IMG.zip. Each device has a specific filename which will be reflected.

Below is a script of the expected output of the script when processing a RUU.exe.

Welcome to the RUU extraction and decryption script!

Extracting temporary files...
Extracting rom zip files...
Extracting rom.zip...done.
Extracting android-info.txt...done.
Cleaning up...
Done!

Extracting ZIP files
    LargeZip format detected, using ruuveal
ruuveal
-------

Large zip format detected containing 7 zipfile(s)
Dumped (copied) zip file to: 01_dmp.zip
Dumped (copied) zip file to: 02_dmp.zip
Dumped (copied) zip file to: 03_dmp.zip
Dumped (copied) zip file to: 04_dmp.zip
Dumped (copied) zip file to: 05_dmp.zip
Dumped (copied) zip file to: 06_dmp.zip
Dumped (copied) zip file to: 07_dmp.zip
Finished: Successfully extracted zip files to '/home/throwback/android/decrypt/tool/working/extract'

Model ID found by extracting android-info.txt from RUU. Model ID identified as: 0PJA

Looking for keyfile: 0PJA_keyfile_2.bin
Found matching keyfile! Using keyfile: 0PJA_keyfile_2.bin

Decrypting ZIP files

Decrypting 01_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_01_dmp.zip

Decrypting 02_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_02_dmp.zip

Decrypting 03_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_03_dmp.zip

Decrypting 04_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_04_dmp.zip

Decrypting 05_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_05_dmp.zip

Decrypting 06_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_06_dmp.zip

Decrypting 07_dmp.zip
    Encrypted zip detected, running ruuveal...
ruuveal
-------

Decrypted RUU (zip) written to: /home/throwback/android/decrypt/tool/working/decrypt/decrypted_zips/dec_07_dmp.zip

Unzipping decrypted zips
Archive:  decrypted_zips/dec_01_dmp.zip
  inflating: decrypted_all/android-info.txt  
  inflating: decrypted_all/aboot_signed.img  
  inflating: decrypted_all/radio.img  
  inflating: decrypted_all/splash1.nb0  
  inflating: decrypted_all/adsp.img  
  inflating: decrypted_all/rfg_1.img  
  inflating: decrypted_all/rfg_2.img  
  inflating: decrypted_all/ramdisk.img  
  inflating: decrypted_all/android-info2.txt  
  inflating: decrypted_all/sensor_hub.img  
  inflating: decrypted_all/emmc_appsboot.mbn  
  inflating: decrypted_all/persist.img  
  inflating: decrypted_all/dt.img    
  inflating: decrypted_all/bootloader  
  inflating: decrypted_all/gpt_main_32g.img  
  inflating: decrypted_all/pg2fs_ship_signkey.img  
  inflating: decrypted_all/apppreload.img  
  inflating: decrypted_all/cota.img  
  inflating: decrypted_all/gpt_main_64g.img  
  inflating: decrypted_all/sbl1-8994-1.img  
  inflating: decrypted_all/sdi.img   
  inflating: decrypted_all/hosd_signed.img  
  inflating: decrypted_all/rpm-8994-1.img  
  inflating: decrypted_all/pmic-8994-1.img  
  inflating: decrypted_all/boot_signed.img  
  inflating: decrypted_all/recovery_signed.img  
  inflating: decrypted_all/cpe.img   
  inflating: decrypted_all/tz-8994-1.img  
  inflating: decrypted_all/hyp-8994-1.img  
  inflating: decrypted_all/tp_SYN3351.img  
  inflating: decrypted_all/tp_MXM11876.img  
  inflating: decrypted_all/cir.img   
  inflating: decrypted_all/backup_android-info.txt  

Archive:  decrypted_zips/dec_04_dmp.zip
  inflating: decrypted_all/system.img_02  

Archive:  decrypted_zips/dec_03_dmp.zip
  inflating: decrypted_all/system.img_01  

Archive:  decrypted_zips/dec_07_dmp.zip
  inflating: decrypted_all/dzdata_16g.img  
  inflating: decrypted_all/dzdata_32g.img  
  inflating: decrypted_all/dzdata_16g.hdr  
  inflating: decrypted_all/dzdata_32g.hdr  
  inflating: decrypted_all/dzdata_64g.hdr  
  inflating: decrypted_all/dzdata_64g.img  

Archive:  decrypted_zips/dec_06_dmp.zip
  inflating: decrypted_all/system.img_04  

Archive:  decrypted_zips/dec_02_dmp.zip
  inflating: decrypted_all/system.img_00  

Archive:  decrypted_zips/dec_05_dmp.zip
  inflating: decrypted_all/system.img_03  

7 archives were successfully processed.

Move system img files to system folder
‘decrypted_all/system.img_00’ -> ‘decrypted_system/system.img_00’
‘decrypted_all/system.img_01’ -> ‘decrypted_system/system.img_01’
‘decrypted_all/system.img_02’ -> ‘decrypted_system/system.img_02’
‘decrypted_all/system.img_03’ -> ‘decrypted_system/system.img_03’
‘decrypted_all/system.img_04’ -> ‘decrypted_system/system.img_04’
Finished: Successfully decrypted RUU to '/home/throwback/android/decrypt/tool/working/decrypt'

/home/throwback/android/decrypt/tool/working/decrypt/decrypted_system
/home/throwback/android/decrypt/tool/out

Attempting to create system.img
    Multi-part system images
    Sparse Image detected, using simg2img
        Please be patient, this can take several minutes...finished.
Testing system.img...
e2fsck 1.42.12 (29-Aug-2014)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/home/throwback/android/decrypt/tool/out/system.img: 4685/286720 files (0.0% non-contiguous), 1041188/1146880 blocks
Finished: Successfully created system.img in '/home/throwback/android/decrypt/tool/out'

Renaming and moving files...

Rom.zip has been renamed for your device.

Boot image extracted from firmware.zip. boot.img & system.img can be used as base for building a new ROM.

Script complete! Files can be found in the 'out' folder. Enjoy your decrypted system!

(above output is from M9 RUU)

Important Notes:

• If decrypting a rom.zip that is "combined" (meaning the first zip isn't encrypted), you will see the following error message at the top of the ruuveal section:

  • invalid htc aes encrypted zip file!

  This just indicates that the first zip file isn't encrypted. The script will continue and complete with no issues, so this isn't a concern.
• You may also see these messages:

  • caution: filename not matched:  system.img*

  • 1 archive had fatal errors.

  These errors indicate that the first zip doesn't contain a system image to be extracted, which is fine (that's the zip that contains the firmware). This isn't a concern either.
• The last issue you might notice is this:

  • warning [../out/firmware.zip]:  256 extra bytes at beginning or within zipfile
      (attempting to process anyway)

  The extra 256 bytes is HTC's signature on the unencrypted firmware zip. This also is nothing to worry about.

As long as you have all of the output files at the end of the script, everything should be fine.

Thanks:
twogood for unshield
@kmdm for unruu & ruuveal
@Flemmard for bruutveal
@osm0sis for Android Image Kitchen
@A.S._id for ANDROID_IMG_REPACK_TOOLS

 

[Captain_Throwback]

Additional Info

Change Log:
January 11, 2016 - v2.0.0

• Complete overhaul of existing script and process
• Now works on any encrypted RUU/ROM for any HTC device with a known decryption key
• For devices with unknown keyfile, user can provide hboot or hosd image (based on same software version is preferable) and a new keyfile will be created. You can share the new keyfile so that it can be added to our database.
• Improved script output and error handling

January 1, 2016 - v1.5.3

• Fixed the binary problem - should now work on PCs other than mine

January 1, 2016 - v1.5.2

• Back to bash script (for now) to ensure compatibility with other PCs

January 1, 2016 - v1.5.1

• Some script and binary cleanup (back end stuffs)

December 31, 2015 - v1.5

• Compile script into binary format (back end stuffs)

December 31, 2015 - v1.4.1

• Back-end cleanup to use "working" folder for zip processing

December 31, 2015 - v1.4

• Added code to handle "combined" zips where first zip file is already decrypted

December 31, 2015 - v1.3

• Can now handle encrypted rom zips!
• Kill script if no files found
• Script renamed from decrypt.sh to decrypt-htc.sh
• Renames rom.zip from ruu (or provided rom.zip) to 2PQ9IMG.zip (or whatever corresponds to that for other applicable devices) automatically and puts in "out" folder

December 31, 2015 - v1.2

• Added unshield and libunshield to zip so manual compilation is no longer necessary (thanks @nkk71)

December 30, 2015 - v1.1

• Added version number
• Modified script to allow for usage on multiple HTC devices

December 30, 2015

• Initial version

 

[nkk71]

Mine [emoji6]

Sent from my HTC One M9 using Tapatalk

 

[Captain_Throwback]

Updated this (just now) to allow for handling of other devices which use the same type of encrypted RUU (like the Desire 626s, for example).

 

[Captain_Throwback]

v1.2 is up! No more compilation of libunshield is necessary, thanks to @nkk71's help! Seriously, give that guy some love!

 

[Captain_Throwback]

v1.3 is up!

Now there are provisions for handling encrypted ROMs that are zipped, and not just those from an RUU.

Can someone please try this thing out and provide feedback!!!!

 

[Captain_Throwback]

v1.4 added.

Now "combined" zips can be extracted/decrypted as well.

 

[AntikerTa]

Hello. Have tried it. I get the three files. But in Terminal i get the Message

"21 archives were successfully processed"
"2 archives had fatal errors"

Can i ignore the 2 archives fatal errors?

 

[bl4ckluna]

comibined zip first not encrypt

 

[nkk71]

Hello. Have tried it. I get the three files. But in Terminal i get the Message

"21 archives were successfully processed"
"2 archives had fatal errors"

Can i ignore the 2 archives fatal errors?

Yes you can, the error is not really an error, it just doesn't find a system.img_xx in 2 zip files, that's all

Sent from my HTC One M9 using Tapatalk

 

[Captain_Throwback]

Hello. Have tried it. I get the three files. But in Terminal i get the Message

"21 archives were successfully processed"
"2 archives had fatal errors"

Can i ignore the 2 archives fatal errors?

If you look in the "expected script output" in the OP, you'll see the same message (which is why I posted it there).

Though with the latest version, there will only be one archive with a "fatal" error.

If you have good files in the "out" folder, then assume everything went fine.

 

[Captain_Throwback]

comibined zip first not encrypt

Was there a point to this post?

 

[techlogik]

Followed instructions...

~/ruudecrypt$ ./decrypt-htc
./decrypt-htc: }u2n��ɢ

No worky, that is the output. Took the HTC RUU from their site. renamed ruu_a9.exe put it in the folder. Nothing else in root. Run decrypt script and that is what it does above.

Also, extracted the rom.zip out of the RUU, placed it in the folder ruu_a9.zip same error.

 

[Captain_Throwback]

Followed instructions...

~/ruudecrypt$ ./decrypt-htc
./decrypt-htc: }u2n��ɢ

No worky, that is the output. Took the HTC RUU from their site. renamed ruu_a9.exe put it in the folder. Nothing else in root. Run decrypt script and that is what it does above.

Also, extracted the rom.zip out of the RUU, placed it in the folder ruu_a9.zip same error.

What are you running this on? Where are the details to help troubleshoot? "No worky"? Really?

 

[Captain_Throwback]

Is anyone else having issues with the latest version? I can go back to the previous format, but as long as the Linux distro can handle a bash script, it shouldn't matter whether the script is used or the binary is.

 

[techlogik]

Followed your instructions, not much more to explain. For kicks, installed VMWorkstation Pro 12, installed a fresh Ubuntu 15.10, updates etc. Java/ADB and the usual basic stuff. Nothing special going on here, plain vanilla Ubuntu.

Again, downloaded your script in a folder. Copied ruu over to the working folder, renamed it to ruu_a9.exe

Ran the ./decrypt-htc script

Now, it gives this message, but similar:

./decrypt-htc: 8��������y����Y'��w������W�+Ɣ?�has expired!
Please contact your provider [email protected]

What more do you want for diagnosis?

 

[Captain_Throwback]

Followed your instructions, not much more to explain. For kicks, installed VMWorkstation Pro 12, installed a fresh Ubuntu 15.10, updates etc. Java/ADB and the usual basic stuff. Nothing special going on here, plain vanilla Ubuntu.

Again, downloaded your script in a folder. Copied ruu over to the working folder, renamed it to ruu_a9.exe

Ran the ./decrypt-htc script

Now, it gives this message, but similar:

./decrypt-htc: 8��������y����Y'��w������W�+Ɣ?�has expired!
Please contact your provider [email protected]

What more do you want for diagnosis?

Try the version I just uploaded and see if that works any better.

 

[techlogik]

Tried that one, more of the same:

[email protected]:~/decrypt$ ls
bin decrypt-htc keyfile lib place_rom_zip_here place_ruu_here readme.txt

[email protected]:~/decrypt$ ./decrypt-htc

�N��<Z"��@i�?|�w��
�U>I�t��k�*��TN�8'B��8�m?�"w$�[email protected]�['��
bF��
#��

[email protected]:~/decrypt$

 

[Captain_Throwback]

Tried that one, more of the same:

[email protected]:~/decrypt$ ls
bin decrypt-htc keyfile lib place_rom_zip_here place_ruu_here readme.txt

[email protected]:~/decrypt$ ./decrypt-htc

�N��<Z"��@i�?|�w��
�U>I�t��k�*��TN�8'B��8�m?�"w$�[email protected]�['��
bF��
#��

[email protected]:~/decrypt$

Alright, 1.5.2 should take care of it. I'll have to figure out why only I can run the binary. But until then, might as well have a usable version available .

 

[techlogik]

Alright, 1.5.2 should take care of it. I'll have to figure out why only I can run the binary. But until then, might as well have a usable version available .

That worked. Thanks.