Hboot information and downgrading

[Scaryghoul]

Before I start this thread, I should say that all credit goes to otaking71 for finding this crack.
The two original threads are here
http://xdaforums.com/showthread.php?t=1255043
http://xdaforums.com/showthread.php?t=1255360
All of the work was done in the #htc_evo_shift channel on freenode irc.

Table of contents:
1. Hboot information about the exploit.
2. Downgrading
2.1 Notes
3. Full root(Updated 2.2 root)
4. Links
5. Credits/donation links

I will aim to make it so this mod can be ported to other devices to help downgrade bootloaders and software. Please read the entire thread before flashing anything and trying this.

Hboot
Hboot uses a hidden partition to check everything it flashes against, this partition is "misc", or hboot -1, or on the shift mmcblk0p17(hboot itself is at mmcblk0p18).
Some raw dumps of this partition using strings to filter ascii strings brings out this type of dump.
Locked bootloader for the evo shift's dump
"SPCS_001
DeviceWarmBoot
CE Serial InUse
Debug Cable Ena
CE USB InUse
ClearAutoImage
2.76.651.4
FNOC
FNOC"

Unlocked bootloader for the verizon thunderbolt
"VZW__001
DeviceWarmBoot
CE Serial InUse
Debug Cable Ena
CE USB InUse
ClearAutoImage
1.02.605.6
FNOC
FNOC"

Eng spl unlocked evo shift
"FN0C
FN0C
FN0C"

Now the place to focus at is the version numbers, 2.76.651.4. Hboot will check all items you try to flash via hboot or ruu utility against this number and if it is lower than what you are trying to flash, it will allow you to proceed in flashing through hboot, or ruu. If the number is higher, it will reject the flash. If the number doesn't exist(like in the eng spl) it will assume it is able to flash it(ONLY TESTED ON ENG SPL, not locked bootloaders). So by dumping the TB's misc partition into our own, we made it so the locked hboot would accept flashes. Either by RUU or hboot.

We believe the package you flash still needs to be signed though so that only leaves you with official ruu's and extracted ruu zips.

Joeykrim's history(Located on the second page of this thread)

for those curious, a lil bit of history:
same method as used on the evo part 2 thread by toastcfh at xda.
only diff is shift is emmc and evo was mtd. shift emmc partitions are a bit more in number and named differnetly when compared to the evo mtd partitions. on the evo this partition was labeled as "misc" in /proc/partitions. the misc partition being flashed holds the software version number which hboot checks against to verify whether or not it will allow an RUU to be loaded.

also, i want to recall a web site somewhere which allows users to create a custom misc file with a provided version number.

thought this partition was protected by the internal memory write protection but appears it wasn't. not much of a surprise as the first release of the shift didn't have write protection for the hboot partition turned on.

great this works! sadly, they'll prob patch it next OTA around as they did for the evo.

good job on testing (sorry about the lost shift), publishing and releasing! glad to see the shift has unlocked internal memory write protection again!!!


you're path to the internal partition location is incorrect. as the OP states, use:/dev/block/mmcblk0p17

full command: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17

great article with the history and usage of dd, its a classic unix/linux command. very good to become familiar with: http://en.wikipedia.org/wiki/Dd_(Unix)

How to downgrade your device
For the shift, will be different on other devices with a bit of modding.
1. Temproot(With Fre3vo for the shift) http://xdaforums.com/showthread.php?t=1185243

2. Move the file misc.img to the root of your sdcard, and PG06IMG.zip too if you plan on flashing through hboot.

3. Modify the misc partition to bypass the version check, type the following in an adb shell or a terminal emulator on your phone.

dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17

Note for other devs: misc.img is the image from the TB, could be other images as long as it has a lower version number.

4. This is up to you, you can either use the ruu utility to revert or the PG06IMG.zip in hboot. I'll include links to both. Since both utilities check the misc partition, both are able to flash =)

5. Reboot and then full root like normal on your downgraded device.


Notes
1. When flashing hboot/using this exploit it always flashes twice/stops early and recontinues. Don't worry about it, this is normal(Sometimes it looks like more than 2 but just chill out).

2. Some SDcards are not recognized by hboot, so you will either have to switch cards for this operation or use the ruu utility method.

3. Remove the PG06IMG from your sdcard after flash, or hboot will pick it up next time.


Full root for downgraded 2.2
Flash ENG bootloader

1. Download these files and extract them to the root of your sdcard: www.thebcblends.com/shift/Shift-root.zip
2. Obtain temproot from z4Root, visionary, OR CM's temproot wiki
3. Flash hboot with Engineer SPL:

dd if=/sdcard/Shift/hboot_eng.nb0 of=/dev/block/mmcblk0p18

4. Boot into bootloader and check for S-OFF

Flashing a recovery
1. Grab latest shift recovery from: http://www.koushikdutta.com/2010/02/clockwork-recovery-image.html
2. Make sure you're temprooted(may have to temp root again)
3. Install recovery from rom manager
Alternative install can be done if you grab another recovery's recovery.img and do one of the following below.
a. Okay this is for those with fastboot - flash the recovery with fastboot: fastboot flash recovery recovery.img
b. This is for those where fastboot doesn't work or they don't have it - 1. Place recovery.img on the root of your sdcard, then type the command below.

dd if=/sdcard/recovery.img of=/dev/block/mmcblk0p21

Full root/Rom flashing
Well I know you don't have anything you want to save from the 2.2 ruu since it's just a stock flash, so I am going to leave it off here as flash whatever rom you want over the new system via recovery and you should end up with a fully rooted android.
Just remember to wipe data/factory reset after flash.

Links - MD5Sums aren't terribly important here as the files will not flash if they are not correct due to the signatures.
Fre3vo temp root for GB - http://xdaforums.com/showthread.php?t=1185243
misc.img for the misc partition - http://dl.dropbox.com/u/41040697/misc.img MD5Sum: c88dd947eb3b36eec90503a3525ae0de
Misc.img mirror(You guys took down my second dropbox.....trying a different site now): http://www.box.net/shared/0l8ex73zne0tfr10ob69
Second mics.img mirror: http://dl.dropbox.com/u/15373824/misc.img
Another mirror for misc.img: http://dev-host.org/a9dbnuzgb9qv/misc.zip (Thanks Fdxrider)

Official ruu file for downgrading to 2.2 - http://www.multiupload.com/15N2D30H6C MD5SUM: a4b880954d2ac29d5bdf0dade9dede3c
PG06IMG for hboot downgrading to 2.2 - http://dl.dropbox.com/u/41040697/PG06IMG.zip MD5SUM: d20be478fd860b80f5e800c958f79077
Mirror for PG06IMG(First link went down temporarily due to generating too much traffic on my account, good job guys xD) - http://dl.dropbox.com/u/15373824/PG06IMG.zip
Mirror for PG06IMG: http://dev-host.org/xmlaaco0s2ph/PG06IMG.zip

2.2 root [Bcnice guide]- http://xdaforums.com/showthread.php?t=932153
Cm's rooting method(For those without z4root or visionary) - http://wiki.cyanogenmod.com/wiki/HTC_Evo_Shift_4G:_Full_Update_Guide


Credits
Otaking71 - Discoverer of this exploit for the shift and working throughout the night to establish it as a working downgrade.
Bcnice20 & other 2.2 root devs - I borrowed your root methods for this guide, and linked to them. Just had to update it for recovery basically.
Stuke00 - Fre3vo temp root for 2.3.3
Joeykrim - Donating that history for the curious minds.


Donation links:
Otaking71 - Main driver of this discovery/creator and came up with this theory
http://xdaforums.com/donatetome.php?u=1762836

 

[jesusice]

Should we vote this to the front or try to keep it on the downlow?

^ Shift Faced

 

[totalnub911]

I'm at work now, but am I to understand that there is now a full root for shifts on gb?

Sent from my PC36100 using XDA App

 

[Scaryghoul]

I'm at work now, but am I to understand that there is now a full root for shifts on gb?

Sent from my PC36100 using XDA App

Something of that sort, you can obtain full root through this exploit. Though it's through downgrading the firmware you use old 2.2 rooting methods.

 

[YoungCorruption]

I'm at work now, but am I to understand that there is now a full root for shifts on gb?

Sent from my PC36100 using XDA App

that is correct if you downgrade then root with shiftRR. thats what i'm getting from all this

EDIT: got beat to it

 

[riggsandroid]

that is correct if you downgrade then root with shiftRR. thats what i'm getting from all this

EDIT: got beat to it

sounds like its time to change your siggy there youngcorruption!

 

[halrulez]

Im sorry for the noobish but what does this mean and how do i do this

2. Modify the misc partition: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
misc.img is the image from the TB, could be other images as long as it has a lower version number.

 

[Scaryghoul]

Im sorry for the noobish but what does this mean and how do i do this

2. Modify the misc partition: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
misc.img is the image from the TB, could be other images as long as it has a lower version number.

In more specific directions it means to move the downloaded file misc.img to /sdcard , then to type the command "dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17 misc.img" without quotes. The rest just means it'll be different on other devices.

 

[strapped365]

Nice write up, thanks to otaking and scary you all saved the shifters from a horrible ota update

Sent from my Supreme Shift using Tapatalk

 

[halrulez]

In more specific directions it means to move the downloaded file misc.img to /sdcard , then to type the command "dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17 misc.img" without quotes. The rest just means it'll be different on other devices.

ok can do this in terminal from my phone or do i have to do this in adb from my computer?
and if so what are the full steps to get to the point so i can enter this. I am trying to understand adb hell i am just starting in linux so i am hella noob

 

[Scaryghoul]

ok can do this in terminal from my phone or do i have to do this in adb from my computer?
and if so what are the full steps to get to the point so i can enter this. I am trying to understand adb hell i am just starting in linux so i am hella noob

Either one, you can either mount your phone on usb and move the misc.img to your sdcard then type the command in terminal on your phone.

OR

You can adb push the file to your sdcard then adb shell the command.

I'll make the instructions more detailed in a bit.

 

[blakeatl]

What do you mean by: Modify the misc partition: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p1?

I moved the misc.img to sdcard but I have no mmcblk0pl in dev/block. Do I have to create that folder? And dd and of....lost me there.

 

[TheTitanX]

I just did it and it worked perfectly. Back on 2.2, ready to root. Thanks again to otaking and scary for all your hard work.

 

[halrulez]

ok so i was able to do this from the terminal from my android

bow though when i am trying to run the ruu from my computer is starts to go but keeps says that it is waiting for the booloader. the phone wont boot in to the boot loader

 

[otaking71]

ok so i was able to do this from the terminal from my android

bow though when i am trying to run the ruu from my computer is starts to go but keeps says that it is waiting for the booloader. the phone wont boot in to the boot loader

you might need to install htc sync to run ruu's. http://www.htc.com/managed-assets/support/software/htc-sync/setup_3.0.5557.exe

 

[strapped365]

im just going to put this out there as well because i have had problems with the drivers that came with sync and i was forced to use the modified usb drivers found in the unrevoked evo tool, i dunno its weird but my vista pc didnt like anything but them drivers, and another guy i helped ruu from a major mess up, he couldnt get anything with sync to reconize his shift untill he used the same modified evo drivers . i hope no one has an issue but if it come about this is how to fix a driver issue

 

[sarspants]

Best day ever!!!!!!!!!!!!!!!!!!!!!!!!!

 

[riggsandroid]

im just going to put this out there as well because i have had problems with the drivers that came with sync and i was forced to use the modified usb drivers found in the unrevoked evo tool, i dunno its weird but my vista pc didnt like anything but them drivers, and another guy i helped ruu from a major mess up, he couldnt get anything with sync to reconize his shift untill he used the same modified evo drivers . i hope no one has an issue but if it come about this is how to fix a driver issue

provide link to said drivers?

 

[strapped365]

provide link to said drivers?

kinda cant provide an actual link directly to the drivers because i had to set up unrevoked just like i was rooting an evo, so i just hinted they were in the tool

http://unrevoked.com/recovery/

thats where you can get the tool from to setup your drivers if you have issues with sync not playing well or your pc just dont want to read the drivers right

 

[joeykrim]

for those curious, a lil bit of history:
same method as used on the evo part 2 thread by toastcfh at xda.
only diff is shift is emmc and evo was mtd. shift emmc partitions are a bit more in number and named differnetly when compared to the evo mtd partitions. on the evo this partition was labeled as "misc" in /proc/partitions. the misc partition being flashed holds the software version number which hboot checks against to verify whether or not it will allow an RUU to be loaded.

also, i want to recall a web site somewhere which allows users to create a custom misc file with a provided version number.

thought this partition was protected by the internal memory write protection but appears it wasn't. not much of a surprise as the first release of the shift didn't have write protection for the hboot partition turned on.

great this works! sadly, they'll prob patch it next OTA around as they did for the evo.

good job on testing (sorry about the lost shift), publishing and releasing! glad to see the shift has unlocked internal memory write protection again!!!

What do you mean by: Modify the misc partition: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p1?

I moved the misc.img to sdcard but I have no mmcblk0pl in dev/block. Do I have to create that folder? And dd and of....lost me there.

you're path to the internal partition location is incorrect. as the OP states, use:/dev/block/mmcblk0p17

full command: dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17

great article with the history and usage of dd, its a classic unix/linux command. very good to become familiar with: http://en.wikipedia.org/wiki/Dd_(Unix)