[GUIDE] Downgrade your Desire-Z from 1.72 to 1.34 (and get root and S-OFF)

Search This thread

g4rb4g3

Senior Member
Jul 22, 2009
508
288
First thanks to everybody who made it possible to root our great devices.


THIS WILL WIPE YOUR DEVICE, BACKUP EVERYTHING BEFORE DOING THIS!

Polish translation by trzype

If you don't know how to use adb/fastboot don't do this. Use the search function and google and learn how to use them. If you know everything about them come back. I made a pretty nice tutorial, many people used it already with success. But I won't add anything like "go to startmenu and type..."


If your INFOCID is NOT one of these you need to make a goldcard to downgrade!
  • HTC__001
  • HTC__032
  • HTC__E11
  • HTC__203
  • HTC__Y13
  • HTC__102
  • HTC__405
  • HTC__304
  • HTC__A07
  • HTC__N34
  • HTC__J15

check with:
Code:
adb reboot bootloader
fastboot oem boot
Here is a great guide how to make a goldcard, follow the first part and come back here then.

  1. Get theses 3 files:
    https://github.com/tmzt/g2root-kmod/raw/scotty2/scotty2/psneuter/psneuter (right click > save as...)
    https://rapidshare.com/files/1884723844/PC10IMG.zip
    https://rapidshare.com/files/948281832/root.zip

    Since this uses some security holes to gain root privileges on your phone some antivirus programs on your pc might warn you that this contains a virus. Thats not the case!

    MikeChannon said:
    It might be worth saying in the thread that android/Exploit.ragecage.A is the exploit being used to gain root and Users should not worry about the warning some software will give.
  2. Extract misc_version_01.zip (only misc_version is needed)

  3. Get the PC10IMG.zip from here or download the full RUU from here.
    If you already downloaded the 1.34 RUU somewhere else you can skip this step.

  4. Code:
    adb push psneuter /data/local/tmp
    adb push misc_version /data/local/tmp
    adb  shell chmod 777 /data/local/tmp/psneuter
    adb shell chmod 777 /data/local/tmp/misc_version
    adb shell /data/local/tmp/psneuter
    adb shell
  5. Check if you have the '#' sign instead of the '$'
    If you see the '#' sign you got root!

  6. Code:
    /data/local/tmp/misc_version -s 1.33.405.5
    exit
  7. If you have downloaded the 1.34.405.5_PC10IMG.zip copy it to you SD-Card and rename it to PC10IMG.zip.

    If you downloaded the full RUU or had it already execute the exe file (mine is called RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe), start explorer and type %temp% in the adress bar.
    Look in all the folders starting with a { sign and also in the sub directories if it also starts with a { sign, in one of the subdirectories there should be a rom.zip file with 298.442.206 bytes and the MD5 sum 2ff42897cd27e0db425a2cf36c8bd078.
    Copy this rom.zip to your SD-Card on the phone and rename it to PC10IMG.zip

  8. Code:
    adb reboot bootloader
    (or turn your phone of and on again while holding the trackbad).

  9. Wait till the phone is in bootloader mode (white screen should look like this but with other infos http://www.brutzelstube.de/wp-content/uploads/2010/09/hboot.jpg)

  10. Select bootloader (vol +/- buttons for navigation and power button for select).

  11. Wait for the phone to scan the sdcard, once it's done it will ask you if you want to start the update. Confirm it and wait till it's done. Reboot with powerbutton when asked.

  12. After the reboot check for version informations, it should show this:


  13. Enable USB-Debugging on your phone

  14. Extract root.zip

  15. Code:
    adb install AndroidTerm.apk
    adb push busybox /data/local/tmp/
    adb push gfree /data/local/tmp/
    adb push rage /data/local/tmp
    adb push root /data/local/tmp/
    adb shell chmod 0755 /data/local/tmp/*
    adb push su /sdcard/
    adb push Superuser.apk /sdcard/
  16. Start the Terminal app on your phone and type:
    Code:
    /data/local/tmp/rage
  17. Wait until you see the message "Forked #### childs.", reset Terminal (menu > Reset Term). The Terminal app will close, launch it again. It will force close, launch it again.
    You should see the magic '#' sign again.

  18. Next type in the terminal
    Code:
    /data/local/tmp/gfree -f
    , this will turn Security off (S-OFF), remove SIM Lock and set CID to 11111111.

  19. Last step in terminal app on your phone is to execute these commands.
    Code:
    /data/local/tmp/root
    sync
    This will root your phone. It's possible that you get an error message "mkdir: /system/xbin already exists", don't worry everything should be ok.
    After that restart your phone.

  20. Now get ROM Manager and install the recovery image from there. If you are happy with the 1.34 software everything is done here, if not you can flash anything you want now.
 
Last edited:

waqypaqy

Senior Member
Jan 20, 2010
153
9
Sony Xperia 1 II
I get the following Error when trying to run misc version
Code:
# /data/local/tmp/misc_version -s 1.33.405.5
/data/local/tmp/misc_version -s 1.33.405.5
--set_version set. VERSION will be changed to: 1.33.405.5
Patching and backing up partition 17...
Error opening backup file.
#

Any ideas mate?

Edit: Sorry, forgot to unmount phone from windows when i copied the img over.
 
Last edited:

Darkyy

Retired Recognized Developer
Nov 17, 2009
2,012
2,957
29
Winterthur
www.darkyrom.com
VERY IMPORTANT

The OP made a small mistake in the instructions:

Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit

the dash (-) should be an underline (_)

Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit

Please update the first post ;)
 

g4rb4g3

Senior Member
Jul 22, 2009
508
288
VERY IMPORTANT

The OP made a small mistake in the instructions:

Code:
/data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
exit

the dash (-) should be an underline (_)

Code:
/data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
exit

Please update the first post ;)

Thanks, fixed it.
 

waqypaqy

Senior Member
Jan 20, 2010
153
9
Sony Xperia 1 II
Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."
 

g4rb4g3

Senior Member
Jul 22, 2009
508
288
Another error:
When I reboot into the bootloader, the phone scans PC10IMG.ZIP and then says "CID incorrect! Update Fail! Press <POWER> to reboot."

What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?
 

Darkyy

Retired Recognized Developer
Nov 17, 2009
2,012
2,957
29
Winterthur
www.darkyrom.com
Another error:

Step 15: Extract root.zip
and then do the commands:

Code:
adb chmod 0755 /data/local/tmp/*

should be

Code:
adb [B][COLOR="Red"]shell [/COLOR][/B]chmod 0755 /data/local/tmp/*
 

waqypaqy

Senior Member
Jan 20, 2010
153
9
Sony Xperia 1 II
What phone and software version do you have?
It seems like you use a wrong PC10IMG.zip for your phone. Did you download the zip from here or got it yourself from the full ruu?

I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either :(

What am I doing wrong? :confused: :confused:

Software number: 1.72.161.1
 

g4rb4g3

Senior Member
Jul 22, 2009
508
288
I've got the Desire Z running 1.72. I first tried downloading the PC10IMG.zip from the 1st link in part 3 which didnt work. I then tried the RUU file, found the rom.zip in Temp, renamed it and copied it to SD card, which didnt work either :(

What am I doing wrong? :confused: :confused:

Software number: 1.72.161.1

Did you root your phone before the ota update?

Sent from my HTC Vision using XDA App
 

Top Liked Posts

  • There are no posts matching your filters.
  • 40
    First thanks to everybody who made it possible to root our great devices.


    THIS WILL WIPE YOUR DEVICE, BACKUP EVERYTHING BEFORE DOING THIS!

    Polish translation by trzype

    If you don't know how to use adb/fastboot don't do this. Use the search function and google and learn how to use them. If you know everything about them come back. I made a pretty nice tutorial, many people used it already with success. But I won't add anything like "go to startmenu and type..."


    If your INFOCID is NOT one of these you need to make a goldcard to downgrade!
    • HTC__001
    • HTC__032
    • HTC__E11
    • HTC__203
    • HTC__Y13
    • HTC__102
    • HTC__405
    • HTC__304
    • HTC__A07
    • HTC__N34
    • HTC__J15

    check with:
    Code:
    adb reboot bootloader
    fastboot oem boot
    Here is a great guide how to make a goldcard, follow the first part and come back here then.

    1. Get theses 3 files:
      https://github.com/tmzt/g2root-kmod/raw/scotty2/scotty2/psneuter/psneuter (right click > save as...)
      https://rapidshare.com/files/1884723844/PC10IMG.zip
      https://rapidshare.com/files/948281832/root.zip

      Since this uses some security holes to gain root privileges on your phone some antivirus programs on your pc might warn you that this contains a virus. Thats not the case!

      MikeChannon said:
      It might be worth saying in the thread that android/Exploit.ragecage.A is the exploit being used to gain root and Users should not worry about the warning some software will give.
    2. Extract misc_version_01.zip (only misc_version is needed)

    3. Get the PC10IMG.zip from here or download the full RUU from here.
      If you already downloaded the 1.34 RUU somewhere else you can skip this step.

    4. Code:
      adb push psneuter /data/local/tmp
      adb push misc_version /data/local/tmp
      adb  shell chmod 777 /data/local/tmp/psneuter
      adb shell chmod 777 /data/local/tmp/misc_version
      adb shell /data/local/tmp/psneuter
      adb shell
    5. Check if you have the '#' sign instead of the '$'
      If you see the '#' sign you got root!

    6. Code:
      /data/local/tmp/misc_version -s 1.33.405.5
      exit
    7. If you have downloaded the 1.34.405.5_PC10IMG.zip copy it to you SD-Card and rename it to PC10IMG.zip.

      If you downloaded the full RUU or had it already execute the exe file (mine is called RUU_Vision_HTC_WWE_1.34.405.5_Radio_12.28b.60.140e_26.03.02.26_M_release_155556_signed.exe), start explorer and type %temp% in the adress bar.
      Look in all the folders starting with a { sign and also in the sub directories if it also starts with a { sign, in one of the subdirectories there should be a rom.zip file with 298.442.206 bytes and the MD5 sum 2ff42897cd27e0db425a2cf36c8bd078.
      Copy this rom.zip to your SD-Card on the phone and rename it to PC10IMG.zip

    8. Code:
      adb reboot bootloader
      (or turn your phone of and on again while holding the trackbad).

    9. Wait till the phone is in bootloader mode (white screen should look like this but with other infos http://www.brutzelstube.de/wp-content/uploads/2010/09/hboot.jpg)

    10. Select bootloader (vol +/- buttons for navigation and power button for select).

    11. Wait for the phone to scan the sdcard, once it's done it will ask you if you want to start the update. Confirm it and wait till it's done. Reboot with powerbutton when asked.

    12. After the reboot check for version informations, it should show this:


    13. Enable USB-Debugging on your phone

    14. Extract root.zip

    15. Code:
      adb install AndroidTerm.apk
      adb push busybox /data/local/tmp/
      adb push gfree /data/local/tmp/
      adb push rage /data/local/tmp
      adb push root /data/local/tmp/
      adb shell chmod 0755 /data/local/tmp/*
      adb push su /sdcard/
      adb push Superuser.apk /sdcard/
    16. Start the Terminal app on your phone and type:
      Code:
      /data/local/tmp/rage
    17. Wait until you see the message "Forked #### childs.", reset Terminal (menu > Reset Term). The Terminal app will close, launch it again. It will force close, launch it again.
      You should see the magic '#' sign again.

    18. Next type in the terminal
      Code:
      /data/local/tmp/gfree -f
      , this will turn Security off (S-OFF), remove SIM Lock and set CID to 11111111.

    19. Last step in terminal app on your phone is to execute these commands.
      Code:
      /data/local/tmp/root
      sync
      This will root your phone. It's possible that you get an error message "mkdir: /system/xbin already exists", don't worry everything should be ok.
      After that restart your phone.

    20. Now get ROM Manager and install the recovery image from there. If you are happy with the 1.34 software everything is done here, if not you can flash anything you want now.
    3
    VERY IMPORTANT

    The OP made a small mistake in the instructions:

    Code:
    /data/local/tmp/misc[COLOR="Red"][B]-[/B][/COLOR]version -s 1.33.405.5
    exit

    the dash (-) should be an underline (_)

    Code:
    /data/local/tmp/misc[COLOR="Red"][B]_[/B][/COLOR]version -s 1.33.405.5
    exit

    Please update the first post ;)
    2
    Ninj: If you used gfree to root, you will keep S-OFF flashing an RUU

    knightslay2: try in adb shell 'dd if=/dev/block/mmcblk0p17 bs=1 count=8 2>/dev/null; echo' that should give you your CID

    -Nipqer
    1
    Question:

    Should the psneuter -file be without a suffix?
    Or should it be like psneuter.txt?

    Without the extension... .txt is added by your browser presumably so you'll have to rename it
    1
    No, flashing an RUU will replace radio, hboot and recovery with it.

    -Nipqer