[GUIDE] Radio S-OFF, SuperCID, SimUnlock + Root

Bumble-Bee · Dec 1, 2010

Hi ppl here is a guide on how to gain radio S-OFF, Super CID , SimUnlock

What You Need
-- This File
-- If on OSX / Linux ADB binary (they are not included in the .zip)

-------------------------------------------------------------------------------------------

Bits in red Are Only for people who dont already have perm root

Bits in Blue are for everyone

-------------------------------------------------------------------------------------------

1) Extract the zip file (to your adb directory if on mac / linux)

2) Open a command prompt / shell and navigate to your where you extracted the files

3) run

adb install visionaryplus-r14.apk

4) open visionary on phone

5) tick Run visionary.sh after root" and "set system r/w after root"

6) Now click "temproot now" and wait 30 - 60 sec

7) run line per line

adb push gfree /data/local
adb shell
su
cd /data/local
chmod 777 gfree
./gfree
sync
reboot

Now We Are Radio S-OFF and SuperCID + SimUnlocked

8) If you where not already perma rooted run visionary Temp root, then perm root.

[To Check]

1) run

adb reboot bootloader

ON SHIP HBOOT
Just check the top line if you see
SHIP S-OFF (it worked

)

SHIP S-ON (it didnt

)

ON ENG HBOOT
2) tap bootloder option
3) use vol down to get to system info and tap
4) check CID for CID-11111111 (if you have this all is done 100%)

5) reboot

[PROBLEMS]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IF THIS DOESNT WORK AND U GET

***WARNING***: Did not find brq filter.

Get either a stock kernel CM/SENSE or my buzz-1.0.7 as its confirmed working on those

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

[FAQ]
Does this install the ENG hboot ?

No as that is no longer required, still an opition if you want to gain the extra functions

How can i install custom recovery for roms without ENG hboot ?

Just get rom manger from marked and install with that

What does all this mean ?

Radio S-OFF = we have s-off regardless or hboot we are using so if you update the hboot s-off will stay
Super CID = Allow to install RRU's from ANYONE

[CREDITS]
Paul O'Brien for visionary
scotty2 and others who found the method to patch P7

everyone else who has worked on the G2 root and wpthis

emx_o · Dec 1, 2010 at 3:54 PM

hey there, thanks for the guide but something didnt work while running ./gfree

Code:

./gfree
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
 - Section[16]: .modinfo
 -- offset: 0x00000a14 (2580)
 -- size: 0x000000cc (204)
Kernel release: 2.6.32.25-Buzz-1.0.6-OCUV
New .modinfo section size: 212
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
 - Address: c02ccc70, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02cc000
Kernel memory mapped to 0x40001000
Searching for brq filter...
 - ***WARNING***: Did not find brq filter.
Patching and backing up partition 7...

after some seconds it rebooted on its own but nothing happened to my cid. any ideas?

starbase64 · Dec 1, 2010 at 3:56 PM

same here

Bumble-Bee · Dec 1, 2010 at 4:03 PM

That will be the live kernel patching failing as it cant find where to patch .... try running with my 1.0.7 kernel and then restore back (shuld run on stock kernels)... as i know that works ill relay this info to scotty2 and see if he can fix for these kernels.

Can you post your kernel info from the about phone menu ?

emx_o · Dec 1, 2010 at 4:08 PM

Apache14 said:
Can you post your kernel info from the about phone menu ?

here it is

2.6.32.25-Buzz-1.0.6-OCUV
[email protected] #66
Sat Nov 27 18:38:35 GMT2010

nintendolinky · Dec 1, 2010 at 4:09 PM

Worked great
To verify all went well, do this:
Plug in your phone to your computer
In the Terminal/command line, type this:

PHP:

 adb shell

this puts you in the phone's shell. now it's a simple matter of the following:
(note the # is your prompt. Don't type the "#". The lines without the # are returned by the phone.)

PHP:

# stop ril-daemon
# cat /dev/smd0 &
# echo -e 'ATE1\r' > /dev/smd0
0
#
# echo -e 'ATV1\r' > /dev/smd0
OK
# echo -e '[email protected]?\r' > /dev/smd0
@CID: 11111111

OK
echo -e '[email protected]?40\r' > /dev/smd0
# [email protected]?40
@SIMLOCK= 00

OK
#echo -e '[email protected]?AA\r' > /dev/smd0
 [email protected]?AA
@secu_flag: 0

OK

It should look something like that anyway. It may look slightly different if you were typing while the computer was sending you back information.
Did it work? Here's what you're looking for:
@CID: 11111111 <--- this response means you have superCID! Congrats!
@SIMLOCK= 00 <--- this means your simlock is off. Mazel Tov!
@secu_flag: 0 <--- this means your radio is S-OFF. Hurrah!

starbase64 · Dec 1, 2010 at 4:20 PM

Hi,

not work for me.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Users\Administrator>d:

D:\>cd D:\Handy\HTC Desire HD\SuperCID

D:\Handy\HTC Desire HD\SuperCID>adb push gfree /data/local
adb server is out of date.  killing...
* daemon started successfully *
1939 KB/s (683255 bytes in 0.344s)

D:\Handy\HTC Desire HD\SuperCID>adb shell
# su
su
# cd /data/local
cd /data/local
# chmod 777 gfree
chmod 777 gfree
# ./gfree
./gfree
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
 - Section[16]: .modinfo
 -- offset: 0x00000a14 (2580)
 -- size: 0x000000cc (204)
Kernel release: 2.6.32.25-Buzz-1.0.6-OCUV
New .modinfo section size: 212
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
 - Address: c02ccc70, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02cc000
Kernel memory mapped to 0x40001000
Searching for brq filter...
 - ***WARNING***: Did not find brq filter.
Patching and backing up partition 7...

D:\Handy\HTC Desire HD\SuperCID>

with friendly greet

starbase64

Bumble-Bee · Dec 1, 2010 at 4:34 PM

For the moment

IF THIS DOESNT WORK AND U GET

***WARNING***: Did not find brq filter.

Get either a stock kernel CM/SENSE or my buzz-1.0.7 as its confirmed working on those

starbase64 · Dec 1, 2010 at 4:36 PM

Hi,

now works (or not

), but system info is no longer available on bootloader

with friendly greet

starbase64

Bumble-Bee · Dec 1, 2010 at 4:40 PM

Yep it worked

Look at the top SHIP S-OFF

starbase64 · Dec 1, 2010 at 4:41 PM

Hi,

but how i can see the SuperCID? System info?

with friendly greet

starbase64

broncogr · Dec 1, 2010 at 4:44 PM

starbase64 said:

Hi,

not work for me.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.
 
C:\Users\Administrator>d:
 
D:\>cd D:\Handy\HTC Desire HD\SuperCID
 
D:\Handy\HTC Desire HD\SuperCID>adb push gfree /data/local
adb server is out of date.  killing...
* daemon started successfully *
1939 KB/s (683255 bytes in 0.344s)
 
D:\Handy\HTC Desire HD\SuperCID>adb shell
# su
su
# cd /data/local
cd /data/local
# chmod 777 gfree
chmod 777 gfree
# ./gfree
./gfree
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
 - Section[16]: .modinfo
 -- offset: 0x00000a14 (2580)
 -- size: 0x000000cc (204)
Kernel release: 2.6.32.25-Buzz-1.0.6-OCUV
New .modinfo section size: 212
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
 - Address: c02ccc70, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02cc000
Kernel memory mapped to 0x40001000
Searching for brq filter...
 - ***WARNING***: Did not find brq filter.
Patching and backing up partition 7...
 
D:\Handy\HTC Desire HD\SuperCID>

with friendly greet

starbase64

Try with 1.07 kernel.
If it doesnt work try with stock kernel which works fine
I think only the ENG Hboot shows system info...

afrcom15 · Dec 1, 2010 at 4:57 PM

Flawless, cheers

Bumble-Bee · Dec 1, 2010 at 5:01 PM

starbase64 said:
Hi,

but how i can see the SuperCID? System info?

with friendly greet

starbase64

fastboot getvar all

Doktaphex · Dec 1, 2010 at 5:04 PM

So can we now flash radio's without fear of being locked down again?

xmoo · Dec 1, 2010 at 5:06 PM

Apache14 said:
fastboot getvar all

I love ur 1.0.6 kernell.

Can I flash 1.0.7, S-OFF radio, and then back 1.06??

Bumble-Bee · Dec 1, 2010 at 5:07 PM

yep u can flash official HTC RUUS / RADIO / HBOOT without any fear of loosing root

Bumble-Bee · Dec 1, 2010 at 5:07 PM

xmoo said:
I love ur 1.0.6 kernell.

Can I flash 1.0.7, S-OFF radio, and then back 1.06??

yep yep

thats fine

dubstepshurda · Dec 1, 2010 at 5:13 PM

Is there anyway to undo this? Incase of garanty issues?

xmoo · Dec 1, 2010

dubstepshurda said:
Is there anyway to undo this? Incase of garanty issues?

S-OFF has nothing to do with legal or illigal.
In somecases when you send your phone for repair, they S-off it, and forget to remove it.
So just remove superuser, install stock rom. And don't matter S-ON or s-OFF

"ON ENG HBOOT
2) tap bootloder option
3) use vol down to get to system info and tap
4) check CID for CID-11111111 (if you have this all is done 100%)
5) reboot"

2) tap bootloader option You fotgot the A.

[GUIDE] Radio S-OFF, SuperCID, SimUnlock + Root

Senior Recognized Developer & Original Autobot

Senior Member

Senior Member

Senior Recognized Developer & Original Autobot

Senior Member

Senior Member

Senior Member

Senior Recognized Developer & Original Autobot

Senior Member

Attachments

Senior Recognized Developer & Original Autobot

Senior Member

Retired Senior Moderator

Senior Member

Senior Recognized Developer & Original Autobot

Senior Member

Retired Recognized Developer

Senior Recognized Developer & Original Autobot

Senior Recognized Developer & Original Autobot

Member

Retired Recognized Developer