[GUIDE] Downgrade from 3.13 (Sense 3.0) roms

petarpLab

Senior Member
Jan 6, 2011
167
57
0
NOTE: This guide is for phones shipped with froyo and updated to the 3.x firmware! For phones shipped with gingerbread (even the lower versions) please read attn1's posts in this thread!

With the Sense 3.0 upgrade HTC patched against fre3vo, so we can no longer temproot to use misc_version on that firmware. Lucky us, a new exploit was issued @rootzwiki. This exploit was tested at #g2root (freenode) and was able to temproot a 3.13.161.3 firmware version.
The usual disclaimer applies: Everything you do is your responsibility, No one outside of you can be held accountable for any state you put yourself and/or your phone into. If you did not donate to EFF and rooting is illegal in you country, you should read this guide for intellectual purposes only (sorry dude/dudette).
If you meet troubles search for help at IRC: freenode, #g2root

make sure your phone is in 'charge only' mode and the 'fast boot' feature is turned off.

What you need:

tacoroot
misc_version NOTE: you need THAT version of misc_version. Earlier versions would not work.
flashgc for a goldcard
1.32 PD98IMG.zip

put all files in your platform-tools directory (unzip misc_version and tacoroot.sh)

Code:
adb push tacoroot.sh /data/local/tmp/tacoroot
adb push misc_version /data/local/tmp/
adb push flashgc /data/local/tmp/
adb push PD98IMG.zip /sdcard/
NOTE: the last command will take a long time

After all files are pushed you have to run tacoroot:
Code:
adb shell 
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup
This command will reboot the phone to recovery. Once it is done, use vol up/power then choose 'reboot' to reboot the phone. After it boots (it will bootloop, that's expected):
Code:
adb shell
/data/local/tmp/tacoroot --root
this command will kick you out of adb shell, so we need to return there and see the # sign of root access, after which we can change the main version, create a goldcard and undo tacoroot to boot he phone normally:
Code:
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
./flashgc
./tacoroot --undo
After these commands are done, the phone should get rebooted by tacoroot. After it boots, boot to bootloader to flash the 1.32 firmware:
Code:
adb reboot bootloader
Once in bootloader, use the vol buttons to go to 'bootloader' and the power button to execute. The rom will flash. Enjoy!

Credits:
Guhl and Scotty2 - they made all this possible. Guhl created and coded misc_version and lots of other good stuff to make unlocking our phones doable and safe.
the tacoroot team
skorgon for flashgc
Donate to EFF!!!!!! and RevSkills -
EFF has the power to keep rooting/unlocking legal.
revskills provides the goldcard solution and online goldcard creation.

Anti-credits:
paul for visionary - among the worst things that happened to the vision community over the years.
 
Last edited:

attn1

Inactive Recognized Developer
Mar 18, 2010
2,554
1,816
0
With the Sense 3.0 upgrade HTC patched against fre3vo, so we can no longer temproot to use misc_version on that firmware. Lucky us, a new exploit was issued @rootzwiki. This exploit was tested at #g2root (freenode) and was able to temproot a 3.13.161.3 firmware version.
The usual disclaimer applies: Everything you do is your responsibility, no one can be held accountable for the state you put your phone into.
If you meet troubles search for help at IRC: freenode, #g2root

What you need:

tacoroot
misc_version NOTE: you need THAT version of misc_version. Earlier versions would not work.
flashgc for a goldcard
1.32 PD98IMG.zip

put all files in your platform-tools directory (unzip misc_version)

Code:
adb push tacoroot.bin /data/local/tmp/tacoroot
adb push misc_version /data/local/tmp/
adb push flashgc /data/local/tmp/
adb push PD98IMG.zip /sdcard/
NOTE: the last command will take a long time

After all files are pushed you have to run tacoroot:
Code:
adb shell 
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup
This command will reboot the phone to recovery. Once it is done, press vol up then power then choose 'rebot' to bot the phone normally. After it boots:
Code:
adb shell
/data/local/tmp/tacoroot --root
this command will kick you out of adb shell, so we need to return there and see the # sign of root access, after which we can change the main version and create a goldcard:
Code:
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
./flashgc
./tacoroot --undo
After these commands are done, the phone should get rebooted by tacoroot. After it boots, boot to bootloader to flash the 1.32 firmware:
Code:
adb reboot bootloader
Once in bootloader, use the vol buttons to go to 'bootloader' and the power button to execute. The rom will flash. Enjoy!

Credits:
the tacoroot team
skorgon for flashgc
Donate to RevSkills and EFF!
Good stuff, but that RUU can jam up newer GB-shipped ACES miserably.

Drop back to a 2.x based RUU instead of a 1.x.
 

attn1

Inactive Recognized Developer
Mar 18, 2010
2,554
1,816
0
attn1, can you please elaborate further on that? The reason I link to the 1.32 rom is that it is perfectly and safely unlockable by gfree.

Devices shipped with later gingerbread hboots don't boot properly when downgrading to the Froyo hboots. It can take up to 1/2 hour for a normal boot, and flashing RUUs generally fails. We first noticed this on Inspires. Note: This problem only seems to be occurring on devices SHIPPED with GB, not on any of those upgraded to GB.

You can fix if you can temproot, gfree to cycle emmc (even if you can't s-off yet) and dd a current hboot back to the phone. It's a pain in the ass, and I've seen a lot of them - now on some original DHDs and not just Inspires. We've been fixing hboots from downgrades from virtually every older method, including my own.

Since then, we've not done full downgrades - I flash the signed firmware.zip from a very early OTA. This downgrades radio, boot and recovery only - no hboot.

upon reboot:

  • There is usb debugging support working
  • There is no video support for current GB roms - this is okay - we fix that later
  • The GB rom combined with the early froyo kernel will not allow gfree to set s-off, but it will allow emmc cycling, so I flash cwm with an early version kernel.
  • Reboot to recovery, and from there, mount system and data, run gfree to set s-off, supercid and sim unlock.
  • Once that's done, push a proper boot image, root files and correct wifi module back to the phone - again from recovery.

Here's the firmware.zip I have been using - no HBOOT - fortunately. http://tau.shadowchild.nl:/files/firmware.zip

So the GB ROM is never downgraded with an HBOOT that can do harm, gfree has done it's thing successfully, and no data is lost on most runs.

Sense 3 changes the picture entirely, as the downgrade firmware is incompatible. Those ROMS must be downgraded. But instead of going to Froyo for those shipped with GB, I strongly recommend downgrading to a 2.x Sense version of GB to avoid those booting issues.

I do not know WHY the newer devices don't work correctly with older hboots, but they don't. I suspect it's some firmware hook not impacted when we flash RUUs.

The WWE 2.50.405.2 RUU is perfectly rootable/s-off-able with the right custom recovery and the above firmware package. It's a popular build, so if we are using goldcard anyway, it's safest to just have everyone downgrade to that, or a comparable GB RUU supporting their own CID.
 
Last edited:

fuinhu

Senior Member
Jul 12, 2008
147
10
0
Devices shipped with later gingerbread hboots don't boot properly when downgrading to the Froyo hboots. It can take up to 1/2 hour for a normal boot, and flashing RUUs generally fails. We first noticed this on Inspires. Note: This problem only seems to be occurring on devices SHIPPED with GB, not on any of those upgraded to GB.

You can fix if you can temproot, gfree to cycle emmc (even if you can't s-off yet) and dd a current hboot back to the phone. It's a pain in the ass, and I've seen a lot of them - now on some original DHDs and not just Inspires. We've been fixing hboots from downgrades from virtually every older method, including my own.

Since then, we've not done full downgrades - I flash the signed firmware.zip from a very early OTA. This downgrades radio, boot and recovery only - no hboot.

upon reboot:

  • There is usb debugging support working
  • There is no video support for current GB roms - this is okay - we fix that later
  • The GB rom combined with the early froyo kernel will not allow gfree to set s-off, but it will allow emmc cycling, so I flash cwm with an early version kernel.
  • Reboot to recovery, and from there, mount system and data, run gfree to set s-off, supercid and sim unlock.
  • Once that's done, push a proper boot image, root files and correct wifi module back to the phone - again from recovery.

Here's the firmware.zip I have been using - no HBOOT - fortunately. http://tau.shadowchild.nl:/files/firmware.zip

So the GB ROM is never downgraded with an HBOOT that can do harm, gfree has done it's thing successfully, and no data is lost on most runs.

Sense 3 changes the picture entirely, as the downgrade firmware is incompatible. Those ROMS must be downgraded. But instead of going to Froyo for those shipped with GB, I strongly recommend downgrading to a 2.x Sense version of GB to avoid those booting issues.

I do not know WHY the newer devices don't work correctly with older hboots, but they don't. I suspect it's some firmware hook not impacted when we flash RUUs.

The WWE 2.50.405.2 RUU is perfectly rootable/s-off-able with the right custom recovery and the above firmware package. It's a popular build, so if we are using goldcard anyway, it's safest to just have everyone downgrade to that, or a comparable GB RUU supporting their own CID.
my desire hd just got a new mainboard from the repair center and it came with sense 3.0 vodafone branded ROM, in this case i should downgrade to sense 2.1 and then root/s-off with "hack ace"?
 

attn1

Inactive Recognized Developer
Mar 18, 2010
2,554
1,816
0
my desire hd just got a new mainboard from the repair center and it came with sense 3.0 vodafone branded ROM, in this case i should downgrade to sense 2.1 and then root/s-off with "hack ace"?
That's what I'd do, unless you care to confirm that your new mainboard shipped with GB has the issue.
 

kiretocin

Senior Member
Aug 27, 2009
372
28
58
Veles
With the Sense 3.0 upgrade HTC patched against fre3vo, so we can no longer temproot to use misc_version on that firmware. Lucky us, a new exploit was issued @rootzwiki. This exploit was tested at #g2root (freenode) and was able to temproot a 3.13.161.3 firmware version.
The usual disclaimer applies: Everything you do is your responsibility, no one can be held accountable for the state you put your phone into.
If you meet troubles search for help at IRC: freenode, #g2root

What you need:

tacoroot
misc_version NOTE: you need THAT version of misc_version. Earlier versions would not work.
flashgc for a goldcard
1.32 PD98IMG.zip

put all files in your platform-tools directory (unzip misc_version)

Code:
adb push tacoroot.bin /data/local/tmp/tacoroot
adb push misc_version /data/local/tmp/
adb push flashgc /data/local/tmp/
adb push PD98IMG.zip /sdcard/
NOTE: the last command will take a long time

After all files are pushed you have to run tacoroot:
Code:
adb shell 
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup
This command will reboot the phone to recovery. Once it is done, press vol up then power then choose 'rebot' to bot the phone normally. After it boots:
Code:
adb shell
/data/local/tmp/tacoroot --root
this command will kick you out of adb shell, so we need to return there and see the # sign of root access, after which we can change the main version and create a goldcard:
Code:
adb shell
cd /data/local/tmp
./misc_version -s 1.00.000.0
./flashgc
./tacoroot --undo
After these commands are done, the phone should get rebooted by tacoroot. After it boots, boot to bootloader to flash the 1.32 firmware:
Code:
adb reboot bootloader
Once in bootloader, use the vol buttons to go to 'bootloader' and the power button to execute. The rom will flash. Enjoy!

Credits:
the tacoroot team
skorgon for flashgc
Donate to RevSkills and EFF!
can you explain me better, becouse I am new in this, I just got my desire HD, where is platform-tools directory?
 

aqblood

Senior Member
Feb 6, 2011
78
2
0
i only able to reach until the step where the phone shows a phone with triangle in middle.. afterwards im stucked there already.. it happends after i typed:

adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup

current software number is : 3.13.707.4
 

petarpLab

Senior Member
Jan 6, 2011
167
57
0
i only able to reach until the step where the phone shows a phone with triangle in middle.. afterwards im stucked there already.. it happends after i typed:

adb shell
chmod 755 /data/local/tmp/*
/data/local/tmp/tacoroot --setup

current software number is : 3.13.707.4
that's ok, press vol up, then navigate to reboot and continue with the guide.
 

salman saso

Senior Member
Sep 21, 2008
159
23
0
Good day all

I have some Question
Can I root this using new firmware If I go to HTCDEV.COM

I have a sensation and it works for me also if you go back
old ROMs WITH the new firmware the device become more solid in signal and Power Usage
I want to update the firmware for my friend device do you recommend that.
Also is it possible to make it S-OFF in HTCDEV site.