[HBOOT 1.19/1.15 S-OFF] Downgrade HBOOT 1.19 and lower on HTC EVO 4G LTE

Did you use this method (includes yarr's tool) to downgrade and how did it go?

  • Yes, it was easy

    Votes: 22 26.2%

  • Yes, but I had some trouble

    Votes: 21 25.0%

  • Yes, it was miserable

    Votes: 12 14.3%

  • No, was already S-OFF

    Votes: 19 22.6%

  • Arghhh!!!1! You suck! I have polls!!! >:-{

    Votes: 10 11.9%
  • Total voters
    84
Search This thread
By:
Advanced…
Mac_Gyver

Mac_Gyver

Member
Oct 11, 2012
39
170
Boston
~ ~ ~ CREDITS ~ ~ ~
HUGE thanks to everyone whose research and work aided us in discovering a way for downgrading from HBOOT 1.19/1.15 down to HBOOT 1.12!

I will do my best to mention all of the sources that were used here but please do forgive and let me know if I failed to mention you for your work. :eek:


  • Fuses and the rest of Team Unlimited for their awesome original work on emmc_recover!
  • closeone for starting work on the LiveCD HBOOT Downgrade Toolkit as soon as he heard the news! We're all looking forward to using this. :laugh:
  • yarrimapirate for narrowing down the list of action steps that needed to be taken and proving for this method to work on HBOOT 1.19! He also did an awesome job consolidating and documenting the steps that needed to be taken, and posting an updated downgrade package.
  • 18th.abn and niceppl for their work on HTC One X methods which inspired this.
  • The great community of like-minded Android fans who posted thought provoking questions, suggestions, and their daring results. Thank you, everyone!!
WARNINGS AND DISCLAIMERS:​

  • UNTIL FURTHER NOTICE, I'M WARNING EVERYONE THAT IS *ALREADY S-OFF* TO NOT TRY THIS METHOD!!!
  • You are solely responsible for your own actions and the potential for permanently BRICKING your device.
  • Do NOT attempt to hold anyone liable for the damages caused by your decision to use this information.
  • RISK! RISK! RISK! THIS MAY NOT WORK AS EXPECTED RESULTING IN A BRICKED PHONE!
  • Doing a soft-brick is part of this procedure; however, you run the risk of actually killing your phone if you don't have enough patience, time, and attention to detail.
  • I can not stress enough how important it is to be very careful and read this whole post in order to see what the procedure entails and to gage your confidence in yourself and weigh the risks.
  • Before you modify anything on your phone: BACKUP! You will not regret it.:good:
  • Finally, only those brave and experienced enough should attempt these steps! Please understand that you could turn your phone into A PERMANENT BRICK.
  • STOP and WAIT if you have any reservations on this, an easy-to-use solution is on the way. You've waited perhaps months, you can probably wait another week for a safer solution!

SOME EXPERIENCE NECESSARY

  • THIS POST ASSUMES THAT YOU HAVE SOME PREVIOUS EXPERIENCE AND MODERATE UNDERSTANDING OF THE TERMS, TOOLS, METHODS, AND CONSEQUENCES OF INTENTIONALLY CORRUPTING AN eMMC PARTITION AND PUTTING YOUR PHONE IN QC DOWNLOAD MODE.
  • THIS IS NOT A N00B-FRIENDLY GUIDE, SORRY!
  • If you are new here, WELCOME!
Please DO NOT go onto Team Unlimited IRC for help with the downgrade!​
They can only assist you with the tools that they directly created and advertised as supported via Team Unlimited IRC. If you have questions regarding the downgrade method, please post here or on yarrimapirate's thread.
​
NOT ON SPRINT?
If you are NOT USING SPRINT, flashing HTC STOCK RUUs mentioned in this guide will revert you to the stock Sprint programming!​
~ ~ ~ U P D A T E S ~ ~ ~
October 31, 2012

NO-DOWNGRADE S-OFF for 1.19 and 1.15!
Team Unlimited has just given a word that they are about to release a NO-DOWNGRADE S-OFF for 1.19 and below.

:good::good::good:

Please see their post here.
​

HBOOT 1.15/1.19 downgrade tool (Linux)
yarrimapirate has created a dedicated thread for his new Linux-based downgrade tool. This is in beta testing as of October 21 but it appears to be very stable and successful.

Be careful and follow his instructions!

:good: :good: :good:

Please see his post HERE.
​
Hands-on downgrade for the tech savvy

yarrimapirate has proven for this to work on HBOOT 1.19. So now this means that both 1.15 and 1.19 can be downgraded! yarrimapirate also narrowed down the eMMC partition list to just one for the QC Download Mode. He kindly rewrote the directions and tweaked them to work with the newer discoveries.

:good: :good: :good:

Please see his post HERE.
​

HBOOT LiveCD Downgrade Toolkit
closeone has kindly taken on the task of making a Downgrade LiveCD and posted an update on his HBoot Downgrade Toolkit. It's still in private testing stage but we expect to see the testing come to a closing and the Toolkit maturing into an easy-to-use solution.

:good: :good: :good:

Check it out here.​
~ ~ ~ ARCHIVE ~ ~ ~
ORIGINAL DOWNGRADE INSTRUCTIONS
Press SHOW CONTENT button to view the OP from October 11, 2012.​


SUMMARY:
  • My immediate goal here is to get this information out regarding my successful downgrade from HBOOT 1.15/1.19 to 1.12 followed by LazyPanda S-OFF.

  • This post will be initially rough. Check back in often.

  • Do note that this was all done in Linux on Ubuntu 12.04.1 32-bit VM and Fedora 16 32-bit physical host. There is no reason that I used two different distros other than what was at hand. If you got skillz, you can do this all in a VM but beware of the pains when you are dealing with a device that changes USB modes very frequently during the flashing of eMMC




REQUIREMENTS:


STRONG RECOMMENDATIONS:

  • Prior to starting this, a factory RUU restore to an HTC ROM that comes with and supports HBOOT 1.15. Some users chose to not bother with this and it seemed to work for them.
  • After you do all of the steps and you get your device to boot from the softbrick on HBOOT 1.12, you will need to do another factory RUU restore to an HTC ROM with the version of the HBOOT that you are downgrading to. So since we are going to 1.12 HBOOT you need an HTC STOCK ROM with HBOOT 1.12 to flash all the other partitions into compliance. You don't want to have HBOOT 1.12 and all else that runs on 1.15! Plus, LazyPanda requires you to use a STOCK 1.13 ROM. Otherwise, you're gonna have a bad time...

ACTUAL REQUIREMENTS:
  • HTCDev unlock OR a temp root method. This is needed to mess with eMMC.
  • Install TWRP 2.+ recovery once you root.


OVERVIEW OF HOW THIS WORKS:


  • Qualcomm Download [QHUSB-DLOAD] mode is what we need

This QHUSB-DLOAD mode is significant because it gives us a chance to flash to mmcblk0p12 (HBOOT partition) and restore the backed up mmcblk0p5 partition that came from YOUR EVO. The only partition that actually needs to be corrupt is mmcblk0p5 (alternatively p4 but that is not recommended by Fuses).



~~~ STUFF HERE IS A LITTLE OUT OF DATE AND ASKS YOU TO DO SOME UNNECESSARY STEPS. I WILL BE UPDATING THIS IN A BIT. IF YOU ABSOLUTELY CAN NOT WAIT FOR A LIVECD, YOU MAY WISH TO FOLLOW WHAT yarrimapirate MADE AT THE LINK TOWARD THE TOP. DO BEWARE ALL OF THE CONSEQUENCES! ~~~
​



Make sure to follow the instructions of the script closely and for the sake of you succeeding *** BACKUP *** the partition that you are about to corrupt! You will not be able to get your phone working again (a strong hunch here :cowboy:) without the correct partitions!

Brick your phone by corrupting p5. Then go to the emmc_recover steps below to fix the brick from your backed up partitions and flash a signed HTC HBOOT 1.12.

Basically, you want to run emmc_recover and tell it to use a specific byte chunk size of 24576 (so far I had the best results with that chunk size) to flash all of the needed partitions. Be patient, this will be slow as the tool only has 7-8 seconds at a time to write to eMMC. Then the device acts as a USB modem. This is the chance to recover the intentionally corrupt partitions AND put a new, lower version HTC HBOOT! The greatest usability of this tool, thoughtfully written by Fuses, takes the painstaking calculations and memorizations for sector offsets out and just does it for you. Slowly but surely.​



Thanks to Fuses (got the latest source code from his Git repo), emmc_recover compiled on my Fedora box supports loading code to eMMC in increments, resuming at a sector at which the task was left off. I found that setting the chunk size to 24576 worked best at a cost of more time needed. I tried setting the value higher but that did not get the phone to post even after all partitions and HBOOT were flashed back, even HBOOT 1.15 did not POST. So stick with the 24576 byte chunk.




Commands to recover from the brick and downgrade hboot:

This is the order that I went by but theoretically it does not matter as long as you end with the HBOOT flash to sdb12 or sdc12 (maybe even sdd12 depending on your box).

The order I flashed in:
hboot_1.12.0000_signedbyaa.nb0, mmcblk0p5.






  1. Plug in your phone already in Qualcomm Download Mode aka brick and in the terminal type
    Code: 
    sudo dmesg
    to see if qcserial ttyUSB0: Qualcomm USB modem converter now connected to ttyUSB0 comes up. If you see it, good. If not, run
    Code: 
    sudo modprobe qcserial
    and check
    Code: 
    dmesg
    again.
  2. Make sure that all of your files are ready, backups specifically, binaries, and a . Open up 2 or more terminal tabs and run
    Code: 
    sudo modprobe -r qcserial
    in tab 2.
  3. Now make a placeholder ttyUSB0 with
    Code: 
    sudo mknod /dev/ttyUSB0 c 188 0
    still in tab 2.
  4. In tab 1, run but don't press enter too many times just yet, else the tool will complain.
    Code: 
    sudo ./emmc_recover_new -f hboot_1.12.0000_signedbyaa.nb0 -d /dev/sdb12 -c 24576
    in tab 2, after you are at the second 'press enter' prompt -- wait and jump into tab 2 to enable qcserial again with
    Code: 
    sudo modprobe qcserial
    .
  5. Now you can hit enter in tab 1 to kick off the procedure and sit back. Once the HBOOT is done, do the magic partition 5 and cross your fingers :fingers-crossed:
    Code: 
    sudo ./emmc_recover_new -fmmcblk0p5 -d /dev/sdb5 -c 24576
  6. By the time you flashed the mmcblk0p5 image file to sdb5 or sdc5, you will get a pleasant surprise when your phone does yet another reset and this time you will see the HTC logo on your phone :) Don't let the ROM fully load (but it shouldn't be too bad if you do) and reboot into the bootloader (Vol - & Power) and check out your hboot version!
  7. Do the RUU restore to the ROM which contains HBOOT 1.12. As mentioned above, you don't want to be running HBOOT 1.12 with all the other bits of your phone expecting HBOOT 1.12.
    1. In the fastboot-usb, use your fastboot binary and run
      Code: 
      fastboot oem rebootRUU
      .
    2. Once you see the plain HTC logo on your phone, do the
      Code: 
      fastboot flash zip [ROM zip name here]
      . If you have a SuperCID you will see a warning about that, then you flash again and pre-ROM checks and flashed get done. You really know the rest for here.... I hope :p

From here on, the rest is up to you, my friends!
Report back if you decide to try this method and let us know if you get stumped.
​
FREQUENTLY ASKED QUESTIONS​
I am going to comb through the posts here and pick out relevant Q&A's to post here. Feel free to PM me anything that you think should be here.
​

If you did understand the risks of doing this and now you find yourself stuck, please post and let people know. Don't freak out and try not to call up your carrier for a replacement. Chances are there's a simple way out. Practice patience and give yourself plenty of time when doing complex things such as this.

If you find yourself waiting for LazyPanda to reboot and it has been more than the 30 second average, wait a couple of minutes and then you will have to do one of the things below.
  1. The easiest is to just reboot your phone by hand and that should take care of it, <http://forum.xda-developers.com/showpost.php?p=32773482&postcount=159>.
  2. Use the official LP unbricker tool, <http://unlimited.io/lteunbricker.htm>.
  3. Could be simpler than #2 but I haven't tried it for this purpose, <http://unlimited.io/qhsusbdload.htm>.
  4. Also, check out post #2 in this <http://forum.xda-developers.com/showpost.php?p=27974032&postcount=2>. Thanks to lowetax for the link.
For a more complete FAQ, please check out yarrimapirate's FAQ here.

​
 
Last edited:
  • Like
Reactions: icefiregx, frdd, hb17 and 94 others
Mac_Gyver

Mac_Gyver

Member
Oct 11, 2012
39
170
Boston

RESERVED

qUJ1awJws0usoyWeXrmtaw2.jpg
 
Last edited:
  • Like
Reactions: BradBrugger, stang04, Active_Matrix and 6 others
om4

om4

Senior Member
Mar 29, 2008
2,531
907
In recovery waiting to be flashed
Finally someone has successfully downgraded. Now I owe my gf $200, this is roughly the process she had thought of but wanted to use my phone instead of hers. She is bricked both our 3d's so I was completely against her even trying. Whoops... She's never gonna let this go
 
  • Like
Reactions: EVOMIKE025 and mrrogers1
William

William

Senior Member
Jun 30, 2012
151
49
Looks like you took some risks Mac. Way to go soldier!

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
The U.S government wouldn't lie to us....would they?
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=

---------- Post added at 04:31 AM ---------- Previous post was at 04:30 AM ----------
om4 said:
Finally someone has successfully downgraded. Now I owe my gf $200, this is roughly the process she had thought of but wanted to use my phone instead of hers. She is bricked both our 3d's so I was completely against her even trying. Whoops... She's never gonna let this go
Click to expand...
Click to collapse

Lol!

*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
The U.S government wouldn't lie to us....would they?
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
 
  • Like
Reactions: Mac_Gyver
Mac_Gyver

Mac_Gyver

Member
Oct 11, 2012
39
170
Boston
om4 said:
Finally someone has successfully downgraded. Now I owe my gf $200, this is roughly the process she had thought of but wanted to use my phone instead of hers. She is bricked both our 3d's so I was completely against her even trying. Whoops... She's never gonna let this go
Click to expand...
Click to collapse

I thought I was screwed too because I could not do anything with QXDM or QPST to get the phone into any sort of a boot cycle. This is where emmc_recover saved the day :) Since I knew that I screwed up by flashing the 4,5,6,13,26 partitions that belonged to One X, I knew that I just needed to get the originals back to fix the brick. What I got was a bit better :p
 
  • Like
Reactions: BradBrugger and jre1981
Mac_Gyver

Mac_Gyver

Member
Oct 11, 2012
39
170
Boston
om4 said:
You intentionally bricked the phone and rebuild the partitions? Elaborate, this could cost me $200
Click to expand...
Click to collapse


I was actually intending to see if I could get the unlock method from One X to work on Evo LTE, since they are pretty similar. I haven't had the inclination to put my phone through the whole cycle again now that I finally got S-OFF but I might :)
 
Last edited:
  • Like
Reactions: Active_Matrix
om4

om4

Senior Member
Mar 29, 2008
2,531
907
In recovery waiting to be flashed
Yeah this is exactly what she told me had to be done to downgrade but she was missing how to brick and destroy all the partitions, I bet her $200 that she was wrong, she even hijacked my account to try and talk devs into doing it. I'd say she came close to convincing xhausx to do it. She couldn't use my phone and didn't want to use hers so she was willing to use other people, and she can be pretty evil. Now if everyone will excuse me I must bend over for her.... This is gonna hurt considering I'm broke as it is
 
  • Like
Reactions: EVOMIKE025
Mac_Gyver

Mac_Gyver

Member
Oct 11, 2012
39
170
Boston
om4 said:
Yeah this is exactly what she told me had to be done to downgrade but she was missing how to brick and destroy all the partitions, I bet her $200 that she was wrong, she even hijacked my account to try and talk devs into doing it. I'd say she came close to convincing xhausx to do it. She couldn't use my phone and didn't want to use hers so she was willing to use other people, and she can be pretty evil. Now if everyone will excuse me I must bend over for her.... This is gonna hurt considering I'm broke as it is
Click to expand...
Click to collapse

haha, sucks man. But technically we are only messing up EMMC partitions 4,5,6,13,26 :) Does that keep you your bet? :p

It might be that only 26 or 13 and 26 need to be messed up then cryptographic checks fail and hboot is not executed. I do think that the SBL1-3 gets loaded and yet it will accept a bootloader that is lower version as long as HTC RSA keys check out. Just a theory.
 
P

pspunderground

Senior Member
Oct 6, 2010
841
1,028
Dallas
Oh ****, haven't seen something so elaborate in years. I'm on 1.15, and if something easier (or Windoze compatible) comes up, I'm jumping on it.I need the new radios!
 
Ladicx

Ladicx

Senior Member
Aug 14, 2011
464
58
SoCal
AWESOME way to have balls bro lol. :thumbup: def gonna let this dev a bit. I know some genius is going to turn this into a program, script, noob friendly version.

Super pumped and glad I stayed on 1.15 :D

Sent from my EVO using Xparent Blue Tapatalk 2
 
om4

om4

Senior Member
Mar 29, 2008
2,531
907
In recovery waiting to be flashed
Her reaction is oh it counts m**********r pay me, I'm going over how she didn't quite actually figure out how to purposely brick it and she says it's because I wouldn't let her try but her overall theory was sound
 
Last edited:
S

ScottHW

Senior Member
Sep 23, 2010
181
44
This is brilliant. 5* rated and Thanks'd

From what I am reading, it was a lucky accident?!? Regardless, it's great to hear that HBOOT can be downgraded.

One thing I wasn't clear about: are you
1) forcing the LazyPanda HBOOT 1.12.2222 directly onto the phone, or
2) downgrading to stock HBOOT 1.12.0000 and then running through the FeedPanda process?
 
sslbaron

sslbaron

Senior Member
Nov 18, 2010
713
285
Powder Springs, GA
Rxpert said:
Sucks for people who didnt listen and took the OTA to 1.19....
Click to expand...
Click to collapse

I'd be one of those. I didn't take the OTA, but I did ruu it to the latest update on Monday. I figured since no exploit had been found yet, that it was safe to assume that none was going to be found. Well, who's the ass now! lol :eek:

It figures. I am glad that progress has been made though. Good work :thumbup:

Sent from my EVO LTE using xda app
 
You must log in or register to reply here.

Similar threads

mikeyxda
[ROM] Dec-4 MeanROM ICS v6.5 | 2.13.651.1 | Mods | Batt saver | OC 1.7 Ghz
Replies
19K
Views
2M
ricardod1
ricardod1
F
  • Locked
[S-OFF] LazyPanda S-OFF - Sprint HTC EVO 4G LTE (HBOOT 1.12)
Replies
3K
Views
398K
P.Mobile
P.Mobile
LadyX
  • Poll
[S-OFF] DirtyRacun S-OFF - Sprint HTC EVO 4G LTE (HBOOT - 1.15 & 1.19)
Replies
798
Views
190K
Captain_Throwback
Captain_Throwback
zedomax
How to Root/Unroot HTC Evo 4G LTE! [Windows/Mac/Linux][One-Click][<=1.22.651.1]
Replies
709
Views
428K
liz.beth
liz.beth
regaw_leinad
[ROOT] RegawMOD EVO 4G LTE Rooter | Updated 01.26.13
Replies
2K
Views
424K
wwjoshdew
wwjoshdew

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 113
    yarrimapirate
    yarrimapirate
    Update 10/19/2012: There is now an automated package available:
    http://forum.xda-developers.com/showthread.php?t=1940512


    Confirmed working for 1.19

    I just downgraded successfully again. Mac_Gyver, you may want to add this to the OP for easy reference... and THANKS for getting the ball rolling on this. You gave me enough information to take this and run with very little experience messing with low-level Android (but a little bit of Linux under my belt) :p

    Here are some highlights:

    • SU/Root is not needed for this to work. TWRP Recovery is needed however, so you need to unlock your bootloader.
    • You will get the *** TAMPERED *** flag when you load the bootloader after doing this.

    What I did before repeating this process:
    • Relocked my bootloader (fastboot oem relock)
    • Flashed Sprint 2.13 RUU with 1.12 Radio and 1.19 HBoot (and verified that it did indeed update HBoot again)

    None of this is required, as I originally downgraded with Fresh 5.3.1 loaded. I just wanted to see if root was needed, and it isn't.

    This was done on Kubuntu Precise (12.04) x64 but should work on any flavor of *buntu, Fedora, Debian, etc.

    You will need:

    • EDIT: I've attached a file to this post with everything needed.
      EDIT 2: I've attached a bakp4 file with the MEID removed. If you lose your bakp4 file, unzip this one and open the bak4p file in a hex editor. At offset 0x21C you need to enter your HEX MEID (found under the back cover of your phone). It is 14 digits long and should start with 99. Save the file and you can try flashing it to pull your phone out of Qualcomm Loader (AKA brick).

    Standard disclaimers about this procedure possibly wiping out your entire extended family apply.

    What to do:

    Preparation: Unzip all the attachment files into a folder in your home directory. Open xterm/konsole/your favorite shell. CD to the folder you dumped everything into. Then:
    Code: 
    $ chmod +x adb
$ chmod +x fastboot
$ chmod +x emmc_recover
$ chmod +x getbrickdrive.sh


    1. Unlock your bootloader with HTCDev Unlock (If you haven't already, So we can load TWRP)

    2. Reboot to Bootloader (power+vol dn). Enter Fastboot. Plug your phone into the computer. (Duh)

    3. Flash the TWRP Recovery image. This gives us ADB Shell ability before the ROM loads. (Maybe there's another way to do this?)
    Code: 
    $ ./fastboot flash recovery openrecovery-twrp-2.1.8-jewel.img

    4. Reboot the phone again. Enter Recovery. Just leave it at the main screen of TWRP.

    5. Now we need to push the broken block 4 file onto the phones internal storage.
    Code: 
    $ ./adb push ./killp4 /sdcard/killp4

    5. Enter ADB shell.
    Code: 
    $ ./adb shell

    6. Now we backup our current block 4 to internal storage so we can restore it later.
    Code: 
    shell> dd if=/dev/block/mmcblk0p4 of=/sdcard/bakp4

    7. Then we flash the broken block 4 in its place.
    Code: 
    shell> dd if=/sdcard/killp4 of=/dev/block/mmcblk0p4

    8. Now we EXIT shell. It is VITALLY IMPORTANT not to reboot the phone yet! You are kinda boned if you do.
    Code: 
    shell> exit

    9. Grab the backup block 4 from internal storage.
    Code: 
    $ ./adb pull /sdcard/bakp4 ./bakp4

    10. NOW we reboot.
    Code: 
    $ ./adb reboot

    *POOF* Your phone is now a brick. Hooray!
    It won't even appear to turn on, nor will you have a charging light. This is normal.

    11. Let's see if Linux sees the phone.
    Code: 
    $ sudo dmesg | grep "qcserial"

    You should see "Qualcomm USB modem converter detected" as the last line of the output. If not, you can unplug and replug the USB cable or run...
    Code: 
    $ sudo modprobe qcserial
    ...to reload the driver.

    12. Reset the driver, which removes any old block devices associated.
    Code: 
    $ sudo modprobe -r qcserial

    13. Now create the block device that emmc_recovery needs.
    Code: 
    $ sudo mknod /dev/ttyUSB0 c 188 0

    14. Emmc_recovery needs to know what disk to write to. An easy way to find this out is to run
    Code: 
    $ ./getbrickdrive.sh
    Which will tell you if it sees your bricked phone, and also give the proper disk. Mine was /dev/sdc and so I use that in the following instructions. Replace /dev/sdc* with /dev/sdb* or /dev/sdd* or whatever yours is.

    15. Now we load the 1.12 HBoot (how exciting!)
    Code: 
    $ sudo ./emmc_recover -f ./hboot_1.12.0000_signedbyaa.nb0 -d /dev/sdc12 -c 24576

    You can hit enter at all of the prompts here. If it stalls at "Waiting for /dev/sdc12, hold the power button down on your phone for more than 30 seconds, then release it. 10 seconds or less after you do this, emmc_recovery will see your phone and proceed. Flashing Hboot will take several minutes, as it has to load data in ~23K chunks followed by a reset after each.

    16. Once that is finished. We have to reset the qcserial driver again.
    Code: 
    $ sudo modprobe -r qcserial

    17. And then recreate the block device.
    Code: 
    $ sudo mknod /dev/ttyUSB0 c 188 0

    18. Now we restore our original block 4.
    Code: 
    $ sudo ./emmc_recover -f ./bakp4 -d /dev/sdc4 -c 24576
    Again, if it hangs, hold your phone's power button for more than 30 seconds then release. This file will flash very quickly (it's only 1K) and once it completes, you'll immediately notice that your chargin light turns back on.

    19. Unplug your USB cable and hold the power button to hard reset the phone. In a few seconds you'll be greeted by the familiar HTC screen. Enter bootloader and check out your HBoot version. 1.12!

    20. Look for some pandas to feed.

    I['m sure someone will boil this process down even further or script it. Hopefully this lets folks willing to brave a Linux shell accomplish this now though.
    View
    97
    Mac_Gyver
    Mac_Gyver
    ~ ~ ~ CREDITS ~ ~ ~
    HUGE thanks to everyone whose research and work aided us in discovering a way for downgrading from HBOOT 1.19/1.15 down to HBOOT 1.12!

    I will do my best to mention all of the sources that were used here but please do forgive and let me know if I failed to mention you for your work. :eek:


    • Fuses and the rest of Team Unlimited for their awesome original work on emmc_recover!
    • closeone for starting work on the LiveCD HBOOT Downgrade Toolkit as soon as he heard the news! We're all looking forward to using this. :laugh:
    • yarrimapirate for narrowing down the list of action steps that needed to be taken and proving for this method to work on HBOOT 1.19! He also did an awesome job consolidating and documenting the steps that needed to be taken, and posting an updated downgrade package.
    • 18th.abn and niceppl for their work on HTC One X methods which inspired this.
    • The great community of like-minded Android fans who posted thought provoking questions, suggestions, and their daring results. Thank you, everyone!!
    WARNINGS AND DISCLAIMERS:​

    • UNTIL FURTHER NOTICE, I'M WARNING EVERYONE THAT IS *ALREADY S-OFF* TO NOT TRY THIS METHOD!!!
    • You are solely responsible for your own actions and the potential for permanently BRICKING your device.
    • Do NOT attempt to hold anyone liable for the damages caused by your decision to use this information.
    • RISK! RISK! RISK! THIS MAY NOT WORK AS EXPECTED RESULTING IN A BRICKED PHONE!
    • Doing a soft-brick is part of this procedure; however, you run the risk of actually killing your phone if you don't have enough patience, time, and attention to detail.
    • I can not stress enough how important it is to be very careful and read this whole post in order to see what the procedure entails and to gage your confidence in yourself and weigh the risks.
    • Before you modify anything on your phone: BACKUP! You will not regret it.:good:
    • Finally, only those brave and experienced enough should attempt these steps! Please understand that you could turn your phone into A PERMANENT BRICK.
    • STOP and WAIT if you have any reservations on this, an easy-to-use solution is on the way. You've waited perhaps months, you can probably wait another week for a safer solution!

    SOME EXPERIENCE NECESSARY

    • THIS POST ASSUMES THAT YOU HAVE SOME PREVIOUS EXPERIENCE AND MODERATE UNDERSTANDING OF THE TERMS, TOOLS, METHODS, AND CONSEQUENCES OF INTENTIONALLY CORRUPTING AN eMMC PARTITION AND PUTTING YOUR PHONE IN QC DOWNLOAD MODE.
    • THIS IS NOT A N00B-FRIENDLY GUIDE, SORRY!
    • If you are new here, WELCOME!
    Please DO NOT go onto Team Unlimited IRC for help with the downgrade!​
    They can only assist you with the tools that they directly created and advertised as supported via Team Unlimited IRC. If you have questions regarding the downgrade method, please post here or on yarrimapirate's thread.
    ​
    NOT ON SPRINT?
    If you are NOT USING SPRINT, flashing HTC STOCK RUUs mentioned in this guide will revert you to the stock Sprint programming!    ​
    ~ ~ ~ U P D A T E S ~ ~ ~
    October 31, 2012

    NO-DOWNGRADE S-OFF for 1.19 and 1.15!
    Team Unlimited has just given a word that they are about to release a NO-DOWNGRADE S-OFF for 1.19 and below.

    :good::good::good:

    Please see their post here.
    ​

    HBOOT 1.15/1.19 downgrade tool (Linux)
    yarrimapirate has created a dedicated thread for his new Linux-based downgrade tool. This is in beta testing as of October 21 but it appears to be very stable and successful.

    Be careful and follow his instructions!

    :good: :good: :good:

    Please see his post HERE.
    ​
    Hands-on downgrade for the tech savvy

    yarrimapirate has proven for this to work on HBOOT 1.19. So now this means that both 1.15 and 1.19 can be downgraded! yarrimapirate also narrowed down the eMMC partition list to just one for the QC Download Mode. He kindly rewrote the directions and tweaked them to work with the newer discoveries.

    :good: :good: :good:

    Please see his post HERE.
    ​

    HBOOT LiveCD Downgrade Toolkit
    closeone has kindly taken on the task of making a Downgrade LiveCD and posted an update on his HBoot Downgrade Toolkit. It's still in private testing stage but we expect to see the testing come to a closing and the Toolkit maturing into an easy-to-use solution.

    :good: :good: :good:

    Check it out here.    ​
    ~ ~ ~ ARCHIVE ~ ~ ~
    ORIGINAL DOWNGRADE INSTRUCTIONS
    Press SHOW CONTENT button to view the OP from October 11, 2012.​


    SUMMARY:
    • My immediate goal here is to get this information out regarding my successful downgrade from HBOOT 1.15/1.19 to 1.12 followed by LazyPanda S-OFF.

    • This post will be initially rough. Check back in often.

    • Do note that this was all done in Linux on Ubuntu 12.04.1 32-bit VM and Fedora 16 32-bit physical host. There is no reason that I used two different distros other than what was at hand. If you got skillz, you can do this all in a VM but beware of the pains when you are dealing with a device that changes USB modes very frequently during the flashing of eMMC




    REQUIREMENTS:


    STRONG RECOMMENDATIONS:

    • Prior to starting this, a factory RUU restore to an HTC ROM that comes with and supports HBOOT 1.15. Some users chose to not bother with this and it seemed to work for them.
    • After you do all of the steps and you get your device to boot from the softbrick on HBOOT 1.12, you will need to do another factory RUU restore to an HTC ROM with the version of the HBOOT that you are downgrading to. So since we are going to 1.12 HBOOT you need an HTC STOCK ROM with HBOOT 1.12 to flash all the other partitions into compliance. You don't want to have HBOOT 1.12 and all else that runs on 1.15! Plus, LazyPanda requires you to use a STOCK 1.13 ROM. Otherwise, you're gonna have a bad time...

    ACTUAL REQUIREMENTS:
    • HTCDev unlock OR a temp root method. This is needed to mess with eMMC.
    • Install TWRP 2.+ recovery once you root.


    OVERVIEW OF HOW THIS WORKS:


    • Qualcomm Download [QHUSB-DLOAD] mode is what we need

    This QHUSB-DLOAD mode is significant because it gives us a chance to flash to mmcblk0p12 (HBOOT partition) and restore the backed up mmcblk0p5 partition that came from YOUR EVO. The only partition that actually needs to be corrupt is mmcblk0p5 (alternatively p4 but that is not recommended by Fuses).



    ~~~ STUFF HERE IS A LITTLE OUT OF DATE AND ASKS YOU TO DO SOME UNNECESSARY STEPS. I WILL BE UPDATING THIS IN A BIT. IF YOU ABSOLUTELY CAN NOT WAIT FOR A LIVECD, YOU MAY WISH TO FOLLOW WHAT yarrimapirate MADE AT THE LINK TOWARD THE TOP. DO BEWARE ALL OF THE CONSEQUENCES! ~~~
    ​



    Make sure to follow the instructions of the script closely and for the sake of you succeeding *** BACKUP *** the partition that you are about to corrupt! You will not be able to get your phone working again (a strong hunch here :cowboy:) without the correct partitions!

    Brick your phone by corrupting p5. Then go to the emmc_recover steps below to fix the brick from your backed up partitions and flash a signed HTC HBOOT 1.12.

    Basically, you want to run emmc_recover and tell it to use a specific byte chunk size of 24576 (so far I had the best results with that chunk size) to flash all of the needed partitions. Be patient, this will be slow as the tool only has 7-8 seconds at a time to write to eMMC. Then the device acts as a USB modem. This is the chance to recover the intentionally corrupt partitions AND put a new, lower version HTC HBOOT! The greatest usability of this tool, thoughtfully written by Fuses, takes the painstaking calculations and memorizations for sector offsets out and just does it for you. Slowly but surely.​



    Thanks to Fuses (got the latest source code from his Git repo), emmc_recover compiled on my Fedora box supports loading code to eMMC in increments, resuming at a sector at which the task was left off. I found that setting the chunk size to 24576 worked best at a cost of more time needed. I tried setting the value higher but that did not get the phone to post even after all partitions and HBOOT were flashed back, even HBOOT 1.15 did not POST. So stick with the 24576 byte chunk.




    Commands to recover from the brick and downgrade hboot:

    This is the order that I went by but theoretically it does not matter as long as you end with the HBOOT flash to sdb12 or sdc12 (maybe even sdd12 depending on your box).

    The order I flashed in:
    hboot_1.12.0000_signedbyaa.nb0,     mmcblk0p5.






    1. Plug in your phone already in Qualcomm Download Mode aka brick and in the terminal type
      Code: 
      sudo dmesg
      to see if qcserial ttyUSB0: Qualcomm USB modem converter now connected to ttyUSB0 comes up. If you see it, good. If not, run
      Code: 
      sudo modprobe qcserial
      and check
      Code: 
      dmesg
      again.
    2. Make sure that all of your files are ready, backups specifically, binaries, and a . Open up 2 or more terminal tabs and run
      Code: 
      sudo modprobe -r qcserial
      in tab 2.
    3. Now make a placeholder ttyUSB0 with
      Code: 
      sudo mknod /dev/ttyUSB0 c 188 0
      still in tab 2.
    4. In tab 1, run but don't press enter too many times just yet, else the tool will complain.
      Code: 
      sudo ./emmc_recover_new -f hboot_1.12.0000_signedbyaa.nb0 -d /dev/sdb12 -c 24576
      in tab 2, after you are at the second 'press enter' prompt -- wait and jump into tab 2 to enable qcserial again with
      Code: 
      sudo modprobe qcserial
      .
    5. Now you can hit enter in tab 1 to kick off the procedure and sit back. Once the HBOOT is done, do the magic partition 5 and cross your fingers :fingers-crossed:
      Code: 
      sudo ./emmc_recover_new -fmmcblk0p5 -d /dev/sdb5 -c 24576
    6. By the time you flashed the mmcblk0p5 image file to sdb5 or sdc5, you will get a pleasant surprise when your phone does yet another reset and this time you will see the HTC logo on your phone :) Don't let the ROM fully load (but it shouldn't be too bad if you do) and reboot into the bootloader (Vol - & Power) and check out your hboot version!
    7. Do the RUU restore to the ROM which contains HBOOT 1.12. As mentioned above, you don't want to be running HBOOT 1.12 with all the other bits of your phone expecting HBOOT 1.12.
      1. In the fastboot-usb, use your fastboot binary and run
        Code: 
        fastboot oem rebootRUU
        .
      2. Once you see the plain HTC logo on your phone, do the
        Code: 
        fastboot flash zip [ROM zip name here]
        . If you have a SuperCID you will see a warning about that, then you flash again and pre-ROM checks and flashed get done. You really know the rest for here.... I hope :p

    From here on, the rest is up to you, my friends!
    Report back if you decide to try this method and let us know if you get stumped.
    ​
    FREQUENTLY ASKED QUESTIONS​
    I am going to comb through the posts here and pick out relevant Q&A's to post here. Feel free to PM me anything that you think should be here.
    ​

    If you did understand the risks of doing this and now you find yourself stuck, please post and let people know. Don't freak out and try not to call up your carrier for a replacement. Chances are there's a simple way out. Practice patience and give yourself plenty of time when doing complex things such as this.

    If you find yourself waiting for LazyPanda to reboot and it has been more than the 30 second average, wait a couple of minutes and then you will have to do one of the things below.
    1. The easiest is to just reboot your phone by hand and that should take care of it, <http://forum.xda-developers.com/showpost.php?p=32773482&postcount=159>.
    2. Use the official LP unbricker tool, <http://unlimited.io/lteunbricker.htm>.
    3. Could be simpler than #2 but I haven't tried it for this purpose, <http://unlimited.io/qhsusbdload.htm>.
    4. Also, check out post #2 in this <http://forum.xda-developers.com/showpost.php?p=27974032&postcount=2>. Thanks to lowetax for the link.
    For a more complete FAQ, please check out yarrimapirate's FAQ here.

    ​
    View
    55
    closeone
    closeone
    stanglifemike said:
    I have hboot 1.15 still and would love, and donate, if closeone or even some one else can make this into a simplified tool!! Thanks to everyone involved!!!
    Click to expand...
    Click to collapse

    stanglifemike, I'm working on it as we speak, but I'm doing this, not for donations or compensation or anything of the sort, but rather because I enjoy helping, and putting my own creations out there for people to use. I just wanted to get that out there. ;)

    ~co~
    View
    25
    closeone
    closeone
    I should post an update for those waiting on the Live CD (then I'm sleeping).

    It is being worked on. It will be released as soon possible. That's not an empty promise. It will. yarr and I (mostly him :eek:) have been, and are working on keeping the process as safe and painless as possible. That means, no accidental wiping out of your partition 4, complete recovery if something does go wrong (we're working on computers; they're great, but they aren't error-free... nor are we). I think that the extra time to go over the underlying code and procedures will be well worth the wait. Already, we've moved away from a two-step process (brick, unbrick), to a single "about-the-closest-we'll-get-to-one-click" process. That alone has helped.

    I am working on improving the "user-friendliness" (anything that you will see, interact with, etc.) of the CD. It's basically a process of making things pretty, understandable, and functional.

    I'm really hoping to have something prepped and ready to go soon (I don't know when).

    Thanks for your patience everyone,
    ~co~

    BTW: yarr has been awesome here. His code is amazing (I can't/won't/don't take credit for it). A lot of it will be used in the live CD.
    View
    25
    closeone
    closeone
    This is what happens when I sleep though a lot of the day. Oops.

    Thanks to yarrimapirate for the confirmation of partitions that have to be "zapped," you can expect a release of the new HBOOT Downgrade Toolkit by the end of the day (or soon thereafter). ;)

    ~co~
    View

New posts