HOW TO: downgrade, root and upgrade ANY G1/Dream (even Continental European)

[moneytoo]

Ok, so you have firmware v. 123099 and wanna have root access... no problem.
I have just succesfully downgraded mine, 123099 to RC7, and then loaded ADP1.1h.

QMAT public (free) version used to succesfully downgrade with WM device: qmat_424.zip, md5: 7f0ccd1b52072bc2a6d594393f2ce348.

Newer QMAT can create Goldcard only in paid version. Buy it or get the old one somewhere else (giyf). You won't get it here or from me.


Requirements:
- Micro SD card formated FAT32 (128 MB to 2 GB), Sandisc cards may not work (but worked for me).
and
- Connected Windows Mobile device (application unlocked)


SD Card:
- Format recommended

format F: /FS:FAT32 /A:4096

(Replace F: with your SD card reader drive letter.)


TESTED, WORKING
1. Insret SD card to WM device and connect it do desktop. WM has to be application unlocked.
2. Download QMAT (http://revskills.de/pages/download.html)
3. Start QMAT and select Hardware Forensics -> Generate HTC Goldcard
4. Select Dream from the list of devices, Click "Get SD Card Serial from WINCE Device" and then "Save Goldcard Image to WINCE SD".
5. Copy DREAIMG.NBH to the root of sd (UK - RC7 recommended for our DREA110)
6. Power off the G1, put the card inside, hold camera button and press power button
7. Press power button to start flashing
8. To apply HardSPL, root & upgrade: http://forum.xda-developers.com/showthread.php?t=442480
9. You don't need the GoldCard any more (HardSPL fixes it, you should be able to flash any image now). So format the SD once again or borrow to a friend to downgrade his G1.


Other way: No WM device needed, just Linux (or Cygwin, to use dd) and paid version of QMAT. However this may not work (incorrect sd card serial number read from G1).
http://forum.xda-developers.com/showthread.php?p=3368673#post3368673
http://forum.xda-developers.com/showpost.php?p=3387344#post3387344


Other way: Generate image for free and dd it to sd
http://forum.xda-developers.com/showthread.php?p=3542745#post3542745


Proof:

Thanks DeToX for the GoldCard idea.
http://androidforum.cz/hacking-rooting-českého-kontinentálního-htc-dream-vyřešeno!--t428.html

 

[eldorado2705]

nice ooone thank you very much for this helppp i hope it will work, i will write in a few minutes wheater its working, or my g1 is bricked .

 

[schizox]

good to know
ive got a friend in CZ that has been waiting for a way to root his phone
will let him know,
thnx for this

 

[infl00p]

This is great news, moneytoo you are the king !

I did some reading at the links you gave and I believe in theory instead of using a windows mobile phone for QMAT, you can create a HTC goldcard and distribute that image for any HTC Dream downgrade.
Nope that doesn't work

 

[scorpio16v]

Can anyone confirm, that this methode is working ?

 

[finran]

Hi,
Because of i dont have a windows mobile device i would be glad if someone could give a little more detailed version of the "hardcore" way... im not sure how to accomplish that way ... anyone ideas or more detailed howtos for patching withour the ability of creating a goldcard?

 

[htcorbit]

Hi,
Because of i dont have a windows mobile device i would be glad if someone could give a little more detailed version of the "hardcore" way... im not sure how to accomplish that way ... anyone ideas or more detailed howtos for patching withour the ability of creating a goldcard?

Hi, read again.
Requirements:
- Micro SD card formated FAT32 (up to 2 GB), Sandisc cards may not work (but worked for me)
and
- Connected Windows Mobile device (application unlocked)
or
- SD card reader and other way of getting SD card serial number

2 way to do. first or second -- connect WMD or card reader to get serial no of card.

 

[Tuxguevara]

I have a Windows Mobile Device but only with SD Card support but no micro SD.

But as i read so far, the only thing you need the WM Device for is to dump the micro SD serial number. So we just need to find another way to read out the number from the G1 directly... ?!

 

[infl00p]

I have a Windows Mobile Device but only with SD Card support but no micro SD.

But as i read so far, the only thing you need the WM Device for is to dump the micro SD serial number. So we just need to find another way to read out the number from the G1 directly... ?!

Get a microsd adapter. MicroSD cards are 100% compatible with SD hardware.

 

[Rembold91]

Yes it Works

I have downgrades my German RC33 to UK RTC7 with this method, It was very easy to create this HTC Gold Card. Next Step ist a custom Firmware.

 

[infl00p]

In a linux enviroment, you can get the card id by looking at the /sys fs.
For example in android it's on path /sys/class/mmc_host/mmc1/mmc1:XXXX/cid
The same applies for every recent linux kernel.

My perl skills are a bit rusty but I'll try and port the perl goldcard image utility to official unix perl versions.

 

[eldorado2705]

Hi all,
if i try it with QMAT, i get the info goldcard for newer device isn't implemented in this new version after clicking on save goldcard image to file

 

[kingzero90]

In a linux enviroment, you can get the card id by looking at the /sys fs.
For example in android it's on path /sys/class/mmc_host/mmc1/mmc1:XXXX/cid
The same applies for every recent linux kernel.

My perl skills are a bit rusty but I'll try and port the perl goldcard image utility to official unix perl versions.

It seems it works even with android. But what do you do after you got the serial number?

 

[infl00p]

It seems it works even with android. But what do you do after you got the serial number?

you need it for the goldcard.img generation.
Well I'm trying a linux-only version now, let's see what happens.

 

[sebimaurer]

i followed the 'hardcore way' (using the dream-keys in the pearl-script of course) but without success .... still getting 'not allow' at the bootloader.
i've used the sd cid from '/sys/class/mmc_host/mmc1/mmc1:aaaa/cid' and replaced the first byte with '00' (also tried it without replacing the first byte).

does anyone had success with the 'hardcore way' or is there any other way if you don't have a windows mobile device??? (qmat isn't working as mentioned earlier)

 

[htcorbit]

problems solving

If you have any problem with downgrade EU G1 try jabber conf

address: [email protected] ask for htcorbit,detox,pedro

or live enter http://live.jabbim.cz/muckl/muckl.html?conf_room=android-google

 

[infl00p]

I tried the hardcore way in linux with the help of wine to run ActiveState Perl and generate goldcard.img. Used a card reader.
Formated with "mkfs.vfat -F 32 -S 4096 /dev/sde1"
Then run "dd if=goldcard.img of=/dev/sde bs=1 count=288"
Unfortunately it doesn't work also.

Can anyone verify that the /sys/class/mmc_host/mmc1/mmc1:XXXX/cid (csd?) holds the same card serial as the qmat method.

 

[JesusFreke]

I tried the hardcore way in linux with the help of wine to run ActiveState Perl and generate goldcard.img. Used a card reader.
Formated with "mkfs.vfat -F 32 -S 4096 /dev/sde1"
Then run "dd if=goldcard.img of=/dev/sde bs=1 count=288"
Unfortunately it doesn't work also.

Can anyone verify that the /sys/class/mmc_host/mmc1/mmc1:XXXX/cid (csd?) holds the same card serial as the qmat method.

edit: I *think* serial is the number you need, but I'm not positive about that. I recall from previous conversations I've had that the value that you read (cid/serial? don't remember which) from that location is actually backwards. You may try flipping it around and trying that. Worth a shot at least

 

[Maldune]

Can anyone verify that the /sys/class/mmc_host/mmc1/mmc1:XXXX/cid (csd?) holds the same card serial as the qmat method.

Just checked and those numbers are not the same, even when reversed.

 

[sebimaurer]

Just checked and those numbers are not the same, even when reversed.

could you please check if the id from qmat contains the number found under /sys/class/mmc_host/mmc1/mmc1:XXXX/serial ? thx!!

maybe we need to put together serial + oemid + manid or something like that ...