• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[TOOL] Ultimate Recovery Tool 3.1 (Unbrick, Downgrade, VM Radio Fix/Reset)

Search This thread

Unknownforce

Retired Recognized Developer
Nov 18, 2008
2,044
4,268
First, Thanks to everyone that helped me along the way here... The thanks list is in Post #2 :)

Second, The risk obviously here is your own. This tool is provided AS IS, and I am not providing any warranty or guarantee. So it doesn't cover hail damage to your home, Tornado's taking your dog away, or your phone not working properly after using it... (or anything else that you might try to pin on me ;) )

For all of the processes, linux is required... use your own flavor of linux and use the following to set it up:

  1. Extract the files to somewhere (home folder works best)
  2. Gain a root command prompt (# instead of $) (sudo -s works for most)
  3. Set permissions via "chmod 755 ultimate" (possibly 0755 depending on linux flavor)
  4. Then run the tool using ./ultimate
Code:
 /=================================================================\
|*******************************************************************|
|****************** EVO 3D Ultimate Recovery Tool ******************|
|*************************** Version 3.1 ***************************|
|*******************************************************************|
|                                                                   |
|                     Please Select an Option                       |
|                                                                   |
| 1. Create a backup partition from a bricked device                |
| 2. Flash a custom partition to a bricked device                   |
| 3. Downgrade HBOOT                                                |
| 4. Unbrick                                                        |
| 5. VM Radio Fix (CDMA ONLY!)                                      |
| 6. Fix radio partition (Manual Radio Fix only) (CDMA ONLY!)       |
| 7. Exit                                                           |
|                                                                   |
|                                                                   |
|*******************************************************************|
|**************** Copyright (C) 2013, Unknownforce *****************|
|*******************************************************************|
 \=================================================================/

Latest version is Here.

(3/14/13) - URTLiveCD 1.0 is available Here -> http://d-h.st/blY

Recent Updates:

3.1
  • Added additional check for the misc partition detection
3.0
  • Fixed and re-implemented VM Radio Fix
3.0 ALPHA
  • Completely Redesigned and Re-Written
  • New menu interface
  • Removed the need for hboot/misc image files to be present, they are now embedded in the program and used as necessary
  • CID issue fixed for GSM devices
  • Misc detection implemented
  • GSM/CDMA detection implemented
  • Fixed a few missing things from the VM Radio Fix (CDMA Only)
  • Many minor bug fixes
2.5.1
  • Mistakenly used an older source of URT when coding 2.5, so I re-applied changes from 2.5 to the correct source and re-compiled. (No Difference for GSM, only radio fix was affected.)
2.5
  • Added support for GSM EVO 3D's! (add -g or --gsm)
  • No longer beta or RC or alpha or whatever!
  • Minor cleanup/optimization.
2.3 RC1
  • Fixed the ghost MEID issues. (This will not fix devices that got it from the first test, please contact me and I'll work with you to fix that)
  • Fixed some delays and timing in switching between fastboot and adb
  • Corrected some wording.
2.2 RC4
  • Second attempt at fixing output errors... Sorry :/
2.2 RC3
  • Attempt to fix "sh: 1: Syntax error: Bad fd number" error.
  • Add -f switch to attempt to fix I/O errors on possibly bad sectored emmc's (This will require being in a temp bricked state before using, if this successfully recovers them, I can add this into the process of the radio fix, for now I want to see if it's going to work at all, so it's a manual process for now, to brick device, Be S-OFF, flash custom hboot(anything but stock) and do fastboot oem writesecureflag 3, done) This is ONLY for those having I/O errors when trying to flash radio config. The usage is ./ultimate -f 19 (19 is partition 19/radio_config)
2.2 RC2
  • Fixed device detection at first step
  • Logging to log.txt
  • Fixed device "wait" after rebooting to system, it will now check properly that there is a device to reboot before issuing the command, rather than just rely on time.
2.2 RC1
  • Initial release to public



Radio Fix


Requirements:
  1. 1.13 (or 2.08) Stock Unrooted Rom. (MUST be stock, signed, unrooted, yadda yadda, RUU, or otherwise) - 1.13 Link - Mirror
  2. S-OFF
  3. ENG Hboot - Link
  4. VM Firmware (duh) - Link
  5. 2.17 Firmware - Link
  6. Ultimate Recovery Tool (Listed above, also included on the URTLiveCD)
  7. Very basic Linux Experience (Helps, but not necessary if you use the URTLiveCD)
  8. A PC (duh)
  9. Functional device (The device does not have to be on an active plan, but it must currently have a functional radio/signal, Just keep in mind if it doesn't have a plan to it, it will continually try to Hands Free Activate after this process)

Instructions:

1.) First, Backup your current Partition 19, to do this, use the following commands (root required, or do from custom recovery):

Code:
adb shell dd if=/dev/block/mmcblk0p19 of=/sdcard/current19.img
adb pull /sdcard/current19.img

2.) Flash ALL of the following, IN THE ORDER LISTED... There are several Flashes here, After each flash you will need to let it boot all the way to the home screen, every flash, other than hboot, will wipe the data on the device, so it will take some time for each one, and you'll have to go through the normal device setup each time as well. Just get it to the home screen each time.

First - Flash 1.13 Stock
Second - Flash VM Firmware
Third - Flash 2.17 Firmware
Fourth - Flash ENG Hboot

3.) After this you're ready for the tool. Enable USB Debugging on the device. (Applications, Development, USB Debugging) and then boot up to linux and start ultimate or boot to the URTLiveCD, select the option for VM Radio Fix.

Follow the onscreen instructions to the letter, Plug in device when asked, unplug when asked, etc etc. Here is an example output, there are a couple other possibilities, but this is a standard output.

When it starts up, you will see it list out the device type, bootloader version, MEID, and ROM version, make sure these show up correctly.

It will then root the device and pull some more information it needs and then prompt with a message about whether or not you would like to fix rfg_1 (if it finds that it's invalid, it will not ask this and just go right into rebuilding it) if it asks, just tell it not to rebuild, as most of the time it does correctly read that rfg_1 is valid or not.

After it does this, it will reboot the device into bootloader, erase the current RFG_1, flash the fixed RFG_1, erase rfg_5 and flash rcdata.

It then reboots to fastboot once more and writes the secure flag to brick the device. After this it will ask you to unplug the device and remove the battery. Do exactly that, tell it yes to continue, and then plug it in when asked. (without the battery in)

It will reflash the partition and then do the unbrick process.

After it finishes everything properly. You will boot up, it will reboot once while booting up the first time (Normal, security flag toggling causes this) The second time it boots up it will do a Hands Free Activation. Let it go through and do this and the PRL update as well. (if you're on a plan, if not, just press cancel)

Then you will want to re-S-OFF of course so, revolutionary it. This will break activation again. But no matter, let it activate once more.

After that you should be good to go!


Downgrade/Unbrick


DO NOT BRICK YOUR DEVICE IF YOU ARE S-OFF, THE DEVICE WILL NOT GO INTO EMMC MODE AS EXPECTED, AND YOU WILL HAVE A TRUE BRICK IN YOUR HANDS!!!

If you're already S-OFF, but on 1.50, you can do one of two things... I have attached the PG86IMG.zip with the 1.40 bootloader on it, download it copy to sd card and flash via bootloader.

The other option is to simply re-run 1.13 RUU, this will downgrade it as well, but this will also erase all data in the process.

For S-ON... Things you'll need...

  • Linux and basic linux knowledge (not necessary if you use the URTLiveCD)
  • This PG86IMG file -> http://d-h.st/3p8 (the bootloader update package)
  • You'll also need the 1.13 RUU EXE (All the RUU's can be found here -> http://www.filefactory.com/f/4ef0ef536face67a/)
  • Download the ultimate3.0.zip in the link above or the URTLiveCD
  • Backup your apps/data if you need to, this process will wipe EVERYTHING

(If you're already bricked, start from Step 2)

First Step

VIDEO OF STEP 1 (video says Step 2, but just start here)


VIDEO OF THE WHOLE PROCESS: (Using Battery Pull method)


BRICK (Yes, I said brick) your device. BUT in a CERTAIN way.

You need to brick your device by corrupting the HBOOT during the HBOOT Update.

(MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)
(MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)
(MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)

(If you are HTC Unlocked, you MUST RELOCK BEFORE starting)

1.) Take your PG86IMG file from above, put it on the root of your SDCard.

2.) With the phone on Battery power alone, Reboot to BootLoader, let it detect the zip and read and get to the point where it wants you to press Vol-Up to update. Do not press Update yet.

3.) Here you can do one of two things, the first being a little more easier than that second... (See Videos for examples)

3A.) The battery pull. You can interrupt the flash by pulling the battery at the right time. Tell the device to update, Pull off the battery cover (careful not to let the battery fall out) and then watch the screen and pull the battery out during or just before the orange bar shows up during the BOOTLOADER Updating.

3B.) The power pull. You can also do this by using the power cord to kill the power. Pull off the battery cover (again careful not to drop the battery out right away) then plug the device into AC power. Now pull the battery out. Tell it to update and pull the power cord at the right time.

The "right time" is different for all devices. The idea here is to completely interrupt the hboot flash so that it's corrupt. The best thing to do is to watch for the bar in the upper right hand corner, it will only show for a second (or even shorter)

If done correctly, you can plug in the device (to power or USB) and see the charge light very dim. It will need to be SOLID dim, NOT blinking dim.

The main indications that it worked correctly:
  • The device no longer turns on at all, no bootloader, no boot screen, nothing.
  • The SOLID, not blinking, dim light mentioned above.
  • The charge light no longer lights up when plugged in with a battery.
  • The device, when plugged into a windows PC, shows up as QHSUSB_DLOAD. (And MMC Storage Controller for the first 5 seconds)

The device is now bricked and ready for the next part.

Second Step

Video above shows this as well.

The next step is the linux part. Do not plug your phone in to the linux box until you are told to do so.

1.) Boot up to Linux (if you use URTLiveCD, skip to step 6)

2.) Extract your ultimate.zip file to the linux PC, Home folder is the best spot and is the easiest to work with.

3.) Open up Terminal, gain root, (su, or sudo -s)(give it your password)

4.) Run the command chmod 755 ultimate (if it's not in your home folder, add the full path to it)

5.) Type ./ultimate and press Enter.

6.) Select option for Downgrade HBOOT.

You will see the below output:

Code:
IMPORTANT: Do not plug in device until TOLD to do so.

Downgrade selected.

Ready to begin? (y/n):

Type y and press Enter.

Then you will see:

Code:
Plug in your device now.
Waiting for device...
[/CODE]

Now... plug the phone in and leave it plugged in, you should see something similar to the below:

Code:
Device Found!
Locating misc partition...
Misc found at partition 34.
Changing misc version...
Writing image file...
SUCCESS!

Flashing hboot and unbricking...
Writing image file...
SUCCESS!

All tasks Completed Successfully! Put your battery back in and boot up!

Press Enter to return to the main menu.

From there, pull your SD Card out (so it doesn't try to update from the PG86IMG.zip...) throw your battery back in, boot up to bootloader. 1.40.0000 :)

(Some people have said that they needed to "let the device sit" for a few minutes here, mine works immediately every time, YMMV)

To get back to a bootable rom and revolutionary, select FASTBOOT, connect it to the PC and run the 1.13 RUU EXE all the way through, (NOT the zip) then just revolutionary (a few times) and have a beer. :)

A few side notes:
When you run Revolutionary, you might have to do it a few times... I also didn't get to the point where it asked to flash a recovery... so I did this via fastboot, and simply used TWRP 2.0 .img file.

DISCLAIMER This is NOT a guarantee... because I'm sure it could come back... But in basic terms... I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR DEVICE, I have given you a method that worked for me, and SHOULD work for you, but if your house burns down, your car gets a flat tire, or your phone stops working... You are responsible for any and all of those things.
 
Last edited:

Unknownforce

Retired Recognized Developer
Nov 18, 2008
2,044
4,268
The Thanks List!

MOVZX
RussianBear
Fuses
Dexter93
TrevE
Crackanug
closeone
USSENTERNCC1701E
jcase
agrabren
chad.goodman
wwjoshdew
The Fer-Shiz-Nizzle
jlechner
The entire Revolutionary team

FAQ's

Can I do this on Windows?

Currently there is no way to do this on Windows. It's unlikely that there will be a way to do it on windows, Windows USB is too slow and doesn't detect the device the same as Linux does.

Can I do this in (Insert virtual PC software)?

The only one I've heard that works is VMWare, however You're again relying on Windows to pass the device to a virtual machine, which isn't ideal. I know for a fact that VirtualBox does not work, and Cygwin also does not work.

Common Errors

I can't get my phone to brick, I've tried a million times!

Patience is a virtue. This step is the hardest part of all, HTC Designed their phone to be brick proof for a reason. I believe the trick here is to let the device sit on the update screen for a minute or two, then do the update and count out 5 seconds. Also there's the update bar that appears in the upper right hand corner, much like the bar that is there when it's checking the zip file before the update prompt. The INSTANT you see that, pull the power. This is typically 5-6 seconds after it says updating, but only after it's been sitting for a bit... I believe the trick is to let it sit for a bit before pressing Volume up to update.

My PG86IMG.zip is not detected or the phone checks it and it doesn't prompt me to update it

There are several possibilities:

  • The phone is HTC Unlocked - You must re-lock.
  • The phone is S-OFF - Don't even try to brick it because you'll permanently brick it.
  • The phone is Re-locked, but still has a custom rom/recovery on it. - This will show a security warning and not allow the PG86IMG.zip to be flashed. - You must put the phone in FASTBOOT USB and run the RUU exe that matches your software version.
  • The File is not named correctly, it's PG86IMG.zip (Make sure it's not PG86IMG.zip.zip)
  • The PG86IMG.zip is either corrupt, not signed properly, or modified in some way. - Download another one.

I press Volume up to Update, and my phone shuts off

  • First make sure you're using a standard HTC A/C Adapter and cable. These are designed to charge at 1000 mA, other manufacturer's chargers typically only hit 900 mA. The phone needs it all to stay on and update properly without the battery in.
  • Second, make sure you're not using a higher end SD Card. This will draw too much power and not let the phone update when it comes to that time because the power drain to have the screen on, the sd card powered and the update running is more than what the A/C adapter can output. - My 16GB Class 10, shuts the phone off, my Class 4, 2 GB, does not. YMMV.
  • Third, if you're stuck with the high end SD card, or think it could be the cause, simply pull it after you pull the battery and BEFORE you press volume Up to update. The phone will still update. However, I don't know if this affects the speed of the update at all... so just watch it the first time and time it, then time your pull accordingly.

I'm getting Permission Denied when trying to run the linux commands

You don't have root, either type su or sudo -s, your prompt should have a # at the end and not a $.
Or, you didn't set the chmod correctly on the ultimate file. This is again chmod 755 ultimate (or /path/to/ultimate)

I get Misc image is missing!!! or HBOOT image is missing!!! or Recovery image is missing!!!

The hboot.img and misc.img and recovery.img files must be in the same location as the ultimate file, they are hard coded into the ultimate tool to be in the same location, their names are also hard coded, so don't rename them.

I'm getting Error 16 after running the radio fix.

This can happen, there are two things, most likely it goes away after attempting to place a few calls. If it doesn't, just remain on the line, and they can fix the problem for you.
 
Last edited:

closeone

Senior Member
Jan 11, 2012
1,098
1,463
Ultimate Recovery Tool[Box]

Here is the latest Ultimate Recovery Tool[Box] (Live CD/USB)

LATEST VERSION (of the live environment) - 2.3 RC1
Download

Windows Users:
This a bootable ISO for users who don't have a Linux distro installed, or do, and want a little more simplified interface.
This will not do anything to your currently installed OS.
_____

If you wish to use it on a USB flash drive, you must use Core2USB to make it bootable.

You can get that here.

A couple of modified guides from the HBOOT Downgrade Toolkit thread.

Burning the Ultimate Recovery Tool[Box] to a CD
Windows Vista/7
1. Download the latest version of the Ultimate Recovery Tool[Box] from above.
2. Insert your CD-R
3. Navigate to the location of the Ultimate Recovery Tool[Box] on your hard drive.
4. Right-click on the .iso file. Hover over 'Open with' and select 'Windows Disc Image Burner'
5. Select your CD burner from the drop-down menu
6. (recommended) Tick 'Verify disc after burning'
7. Click Burn

Other Windows Method
PoorCollegeGuy's guide to Burning an ISO to a CD

Mac OS X - Thanks MikeC84!
Open disk utility, drag the ISO to disk utility. Make sure "make disk bootable" is checked, Click burn....

Check out lpjzfan2005's Mac OS X tutorial for running the CD!

Note: Mac support is limited. It's been confirmed the [HBOOT Downgrade Toolkit] CD will run on a Mac though. [No tests have been done with the Ultimate Recovery Tool[Box] yet]

How to run the Ultimate Recovery Tool[Box] from a Flash Drive
I've realized that there is enough demand for being able to run the Ultimate Recovery Tool[Box] from something other than a CD-ROM drive.
Thanks to Disturb3d1/wwjoshdew and Mpgrimm2 for the suggestion!
What you'll need:
A 256MB USB Flash Drive (Almost any flash drive you have laying around)
Ultimate Recovery Tool[Box]
Core2USB

Step 1. Simply download Core2USB from here.
Step 2. Choose your USB Flash Drive and format it (This will delete all files from it, so back them up).
Step 3. Run the Core2USB software. It won't install anything on your computer.
Step 4. Browse to the Ultimate Recovery Tool[Box] ISO.
Step 5. Double-click on the letter of your USB Flash Drive. Make sure that this is the correct drive.
Step 6. Click Install
Step 7. Reboot your computer with the USB Flash Drive inserted.

Don't pull the flash drive out while you are booted into the Ultimate Recovery Tool[Box] Environment!

Obligatory Disclaimer - This software is distributed in the hope that it will be useful, but without any warranty. You take full responsibility for the usage of the software. I am not liable for anything that goes wrong with this Live CD, including, but not limited to, "bricked" (otherwise unusable) phones, or anything else that happens to your phone(s), computer(s), or anything else. You take full responsibility for your use of these tools.
 
Last edited:

spirithandler

Senior Member
Feb 5, 2012
373
124
Yes we are one step closer to the end! I am excited cant wait until the link to the CD is posted!
Thank you Unknownforce and closeone and the rest for your hard work you put into this it is very much appreciated.

If your phone's S/N starts with SH 18 then you might want to hold off until Unknownforce fixes the issue with the CD not recognizing the phones.
 
Last edited:

cniels01

Senior Member
May 23, 2008
84
28
Boise
I really appreciate closeone and Unknownforce for your work on this!! I am excited to try it out and get rid of the VM stuff.
 

closeone

Senior Member
Jan 11, 2012
1,098
1,463
Just a minute, and hopefully a CD will be in your direction. Just waiting for a quick nod of approval from Unknownforce.

Edit: It's up. Check post #3!

~co~
 
Last edited:
  • Like
Reactions: Will32

genstukov

Senior Member
May 12, 2011
91
17
Your not unknownforce you are THE FORCE we use you for our Android Jedi skills

Sent from my EVO3D using Tapatalk 2
 

cniels01

Senior Member
May 23, 2008
84
28
Boise
It worked like a charm. I have the correct PRI and all. I just did revolutionary and am back in business!!!
 

Sturos

Senior Member
Nov 17, 2010
118
52
I'm doing Hands Free Activation at the moment and it appears to have worked!

Success :)

EDIT: Re-did it. Took out my SD Card and kept it out when prompted to unplug device for bricking process. No buffer error this time.
 
Last edited:

jayseersts

Senior Member
Sep 13, 2011
59
1
One question if i do not do the downgrade part of this...my phone would just be a stock phone without the vm virus we wanted to get fixed? only reason i ask is because i do not use my 3d anymore because i have the evo 4g lte and just want to sell the 3d. i just want all the vm **** out of it so i can get rid of my phone...
 

jlechner

Senior Member
Jan 23, 2008
1,316
251
Kansas City
One question if i do not do the downgrade part of this...my phone would just be a stock phone without the vm virus we wanted to get fixed? only reason i ask is because i do not use my 3d anymore because i have the evo 4g lte and just want to sell the 3d. i just want all the vm **** out of it so i can get rid of my phone...

Unless you do the downgrade, there will still be vm stuff in there. This is the only way to delete it. It's easy man, it was made that way on purpose.

Sent from my EVO LTE.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 122
    First, Thanks to everyone that helped me along the way here... The thanks list is in Post #2 :)

    Second, The risk obviously here is your own. This tool is provided AS IS, and I am not providing any warranty or guarantee. So it doesn't cover hail damage to your home, Tornado's taking your dog away, or your phone not working properly after using it... (or anything else that you might try to pin on me ;) )

    For all of the processes, linux is required... use your own flavor of linux and use the following to set it up:

    1. Extract the files to somewhere (home folder works best)
    2. Gain a root command prompt (# instead of $) (sudo -s works for most)
    3. Set permissions via "chmod 755 ultimate" (possibly 0755 depending on linux flavor)
    4. Then run the tool using ./ultimate
    Code:
     /=================================================================\
    |*******************************************************************|
    |****************** EVO 3D Ultimate Recovery Tool ******************|
    |*************************** Version 3.1 ***************************|
    |*******************************************************************|
    |                                                                   |
    |                     Please Select an Option                       |
    |                                                                   |
    | 1. Create a backup partition from a bricked device                |
    | 2. Flash a custom partition to a bricked device                   |
    | 3. Downgrade HBOOT                                                |
    | 4. Unbrick                                                        |
    | 5. VM Radio Fix (CDMA ONLY!)                                      |
    | 6. Fix radio partition (Manual Radio Fix only) (CDMA ONLY!)       |
    | 7. Exit                                                           |
    |                                                                   |
    |                                                                   |
    |*******************************************************************|
    |**************** Copyright (C) 2013, Unknownforce *****************|
    |*******************************************************************|
     \=================================================================/

    Latest version is Here.

    (3/14/13) - URTLiveCD 1.0 is available Here -> http://d-h.st/blY

    Recent Updates:

    3.1
    • Added additional check for the misc partition detection
    3.0
    • Fixed and re-implemented VM Radio Fix
    3.0 ALPHA
    • Completely Redesigned and Re-Written
    • New menu interface
    • Removed the need for hboot/misc image files to be present, they are now embedded in the program and used as necessary
    • CID issue fixed for GSM devices
    • Misc detection implemented
    • GSM/CDMA detection implemented
    • Fixed a few missing things from the VM Radio Fix (CDMA Only)
    • Many minor bug fixes
    2.5.1
    • Mistakenly used an older source of URT when coding 2.5, so I re-applied changes from 2.5 to the correct source and re-compiled. (No Difference for GSM, only radio fix was affected.)
    2.5
    • Added support for GSM EVO 3D's! (add -g or --gsm)
    • No longer beta or RC or alpha or whatever!
    • Minor cleanup/optimization.
    2.3 RC1
    • Fixed the ghost MEID issues. (This will not fix devices that got it from the first test, please contact me and I'll work with you to fix that)
    • Fixed some delays and timing in switching between fastboot and adb
    • Corrected some wording.
    2.2 RC4
    • Second attempt at fixing output errors... Sorry :/
    2.2 RC3
    • Attempt to fix "sh: 1: Syntax error: Bad fd number" error.
    • Add -f switch to attempt to fix I/O errors on possibly bad sectored emmc's (This will require being in a temp bricked state before using, if this successfully recovers them, I can add this into the process of the radio fix, for now I want to see if it's going to work at all, so it's a manual process for now, to brick device, Be S-OFF, flash custom hboot(anything but stock) and do fastboot oem writesecureflag 3, done) This is ONLY for those having I/O errors when trying to flash radio config. The usage is ./ultimate -f 19 (19 is partition 19/radio_config)
    2.2 RC2
    • Fixed device detection at first step
    • Logging to log.txt
    • Fixed device "wait" after rebooting to system, it will now check properly that there is a device to reboot before issuing the command, rather than just rely on time.
    2.2 RC1
    • Initial release to public



    Radio Fix


    Requirements:
    1. 1.13 (or 2.08) Stock Unrooted Rom. (MUST be stock, signed, unrooted, yadda yadda, RUU, or otherwise) - 1.13 Link - Mirror
    2. S-OFF
    3. ENG Hboot - Link
    4. VM Firmware (duh) - Link
    5. 2.17 Firmware - Link
    6. Ultimate Recovery Tool (Listed above, also included on the URTLiveCD)
    7. Very basic Linux Experience (Helps, but not necessary if you use the URTLiveCD)
    8. A PC (duh)
    9. Functional device (The device does not have to be on an active plan, but it must currently have a functional radio/signal, Just keep in mind if it doesn't have a plan to it, it will continually try to Hands Free Activate after this process)

    Instructions:

    1.) First, Backup your current Partition 19, to do this, use the following commands (root required, or do from custom recovery):

    Code:
    adb shell dd if=/dev/block/mmcblk0p19 of=/sdcard/current19.img
    adb pull /sdcard/current19.img

    2.) Flash ALL of the following, IN THE ORDER LISTED... There are several Flashes here, After each flash you will need to let it boot all the way to the home screen, every flash, other than hboot, will wipe the data on the device, so it will take some time for each one, and you'll have to go through the normal device setup each time as well. Just get it to the home screen each time.

    First - Flash 1.13 Stock
    Second - Flash VM Firmware
    Third - Flash 2.17 Firmware
    Fourth - Flash ENG Hboot

    3.) After this you're ready for the tool. Enable USB Debugging on the device. (Applications, Development, USB Debugging) and then boot up to linux and start ultimate or boot to the URTLiveCD, select the option for VM Radio Fix.

    Follow the onscreen instructions to the letter, Plug in device when asked, unplug when asked, etc etc. Here is an example output, there are a couple other possibilities, but this is a standard output.

    When it starts up, you will see it list out the device type, bootloader version, MEID, and ROM version, make sure these show up correctly.

    It will then root the device and pull some more information it needs and then prompt with a message about whether or not you would like to fix rfg_1 (if it finds that it's invalid, it will not ask this and just go right into rebuilding it) if it asks, just tell it not to rebuild, as most of the time it does correctly read that rfg_1 is valid or not.

    After it does this, it will reboot the device into bootloader, erase the current RFG_1, flash the fixed RFG_1, erase rfg_5 and flash rcdata.

    It then reboots to fastboot once more and writes the secure flag to brick the device. After this it will ask you to unplug the device and remove the battery. Do exactly that, tell it yes to continue, and then plug it in when asked. (without the battery in)

    It will reflash the partition and then do the unbrick process.

    After it finishes everything properly. You will boot up, it will reboot once while booting up the first time (Normal, security flag toggling causes this) The second time it boots up it will do a Hands Free Activation. Let it go through and do this and the PRL update as well. (if you're on a plan, if not, just press cancel)

    Then you will want to re-S-OFF of course so, revolutionary it. This will break activation again. But no matter, let it activate once more.

    After that you should be good to go!


    Downgrade/Unbrick


    DO NOT BRICK YOUR DEVICE IF YOU ARE S-OFF, THE DEVICE WILL NOT GO INTO EMMC MODE AS EXPECTED, AND YOU WILL HAVE A TRUE BRICK IN YOUR HANDS!!!

    If you're already S-OFF, but on 1.50, you can do one of two things... I have attached the PG86IMG.zip with the 1.40 bootloader on it, download it copy to sd card and flash via bootloader.

    The other option is to simply re-run 1.13 RUU, this will downgrade it as well, but this will also erase all data in the process.

    For S-ON... Things you'll need...

    • Linux and basic linux knowledge (not necessary if you use the URTLiveCD)
    • This PG86IMG file -> http://d-h.st/3p8 (the bootloader update package)
    • You'll also need the 1.13 RUU EXE (All the RUU's can be found here -> http://www.filefactory.com/f/4ef0ef536face67a/)
    • Download the ultimate3.0.zip in the link above or the URTLiveCD
    • Backup your apps/data if you need to, this process will wipe EVERYTHING

    (If you're already bricked, start from Step 2)

    First Step

    VIDEO OF STEP 1 (video says Step 2, but just start here)


    VIDEO OF THE WHOLE PROCESS: (Using Battery Pull method)


    BRICK (Yes, I said brick) your device. BUT in a CERTAIN way.

    You need to brick your device by corrupting the HBOOT during the HBOOT Update.

    (MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)
    (MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)
    (MAKE SURE YOU ARE TRULY S-ON, IF YOU BRICK YOUR DEVICE WHILE S-OFF, THIS IS PERMANENT and CANNOT BE RECOVERED FROM)

    (If you are HTC Unlocked, you MUST RELOCK BEFORE starting)

    1.) Take your PG86IMG file from above, put it on the root of your SDCard.

    2.) With the phone on Battery power alone, Reboot to BootLoader, let it detect the zip and read and get to the point where it wants you to press Vol-Up to update. Do not press Update yet.

    3.) Here you can do one of two things, the first being a little more easier than that second... (See Videos for examples)

    3A.) The battery pull. You can interrupt the flash by pulling the battery at the right time. Tell the device to update, Pull off the battery cover (careful not to let the battery fall out) and then watch the screen and pull the battery out during or just before the orange bar shows up during the BOOTLOADER Updating.

    3B.) The power pull. You can also do this by using the power cord to kill the power. Pull off the battery cover (again careful not to drop the battery out right away) then plug the device into AC power. Now pull the battery out. Tell it to update and pull the power cord at the right time.

    The "right time" is different for all devices. The idea here is to completely interrupt the hboot flash so that it's corrupt. The best thing to do is to watch for the bar in the upper right hand corner, it will only show for a second (or even shorter)

    If done correctly, you can plug in the device (to power or USB) and see the charge light very dim. It will need to be SOLID dim, NOT blinking dim.

    The main indications that it worked correctly:
    • The device no longer turns on at all, no bootloader, no boot screen, nothing.
    • The SOLID, not blinking, dim light mentioned above.
    • The charge light no longer lights up when plugged in with a battery.
    • The device, when plugged into a windows PC, shows up as QHSUSB_DLOAD. (And MMC Storage Controller for the first 5 seconds)

    The device is now bricked and ready for the next part.

    Second Step

    Video above shows this as well.

    The next step is the linux part. Do not plug your phone in to the linux box until you are told to do so.

    1.) Boot up to Linux (if you use URTLiveCD, skip to step 6)

    2.) Extract your ultimate.zip file to the linux PC, Home folder is the best spot and is the easiest to work with.

    3.) Open up Terminal, gain root, (su, or sudo -s)(give it your password)

    4.) Run the command chmod 755 ultimate (if it's not in your home folder, add the full path to it)

    5.) Type ./ultimate and press Enter.

    6.) Select option for Downgrade HBOOT.

    You will see the below output:

    Code:
    IMPORTANT: Do not plug in device until TOLD to do so.
    
    Downgrade selected.
    
    Ready to begin? (y/n):

    Type y and press Enter.

    Then you will see:

    Code:
    Plug in your device now.
    Waiting for device...
    [/CODE]

    Now... plug the phone in and leave it plugged in, you should see something similar to the below:

    Code:
    Device Found!
    Locating misc partition...
    Misc found at partition 34.
    Changing misc version...
    Writing image file...
    SUCCESS!
    
    Flashing hboot and unbricking...
    Writing image file...
    SUCCESS!
    
    All tasks Completed Successfully! Put your battery back in and boot up!
    
    Press Enter to return to the main menu.

    From there, pull your SD Card out (so it doesn't try to update from the PG86IMG.zip...) throw your battery back in, boot up to bootloader. 1.40.0000 :)

    (Some people have said that they needed to "let the device sit" for a few minutes here, mine works immediately every time, YMMV)

    To get back to a bootable rom and revolutionary, select FASTBOOT, connect it to the PC and run the 1.13 RUU EXE all the way through, (NOT the zip) then just revolutionary (a few times) and have a beer. :)

    A few side notes:
    When you run Revolutionary, you might have to do it a few times... I also didn't get to the point where it asked to flash a recovery... so I did this via fastboot, and simply used TWRP 2.0 .img file.

    DISCLAIMER This is NOT a guarantee... because I'm sure it could come back... But in basic terms... I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR DEVICE, I have given you a method that worked for me, and SHOULD work for you, but if your house burns down, your car gets a flat tire, or your phone stops working... You are responsible for any and all of those things.
    62
    Ultimate Recovery Tool[Box]

    Here is the latest Ultimate Recovery Tool[Box] (Live CD/USB)

    LATEST VERSION (of the live environment) - 2.3 RC1
    Download

    Windows Users:
    This a bootable ISO for users who don't have a Linux distro installed, or do, and want a little more simplified interface.
    This will not do anything to your currently installed OS.
    _____

    If you wish to use it on a USB flash drive, you must use Core2USB to make it bootable.

    You can get that here.

    A couple of modified guides from the HBOOT Downgrade Toolkit thread.

    Burning the Ultimate Recovery Tool[Box] to a CD
    Windows Vista/7
    1. Download the latest version of the Ultimate Recovery Tool[Box] from above.
    2. Insert your CD-R
    3. Navigate to the location of the Ultimate Recovery Tool[Box] on your hard drive.
    4. Right-click on the .iso file. Hover over 'Open with' and select 'Windows Disc Image Burner'
    5. Select your CD burner from the drop-down menu
    6. (recommended) Tick 'Verify disc after burning'
    7. Click Burn

    Other Windows Method
    PoorCollegeGuy's guide to Burning an ISO to a CD

    Mac OS X - Thanks MikeC84!
    Open disk utility, drag the ISO to disk utility. Make sure "make disk bootable" is checked, Click burn....

    Check out lpjzfan2005's Mac OS X tutorial for running the CD!

    Note: Mac support is limited. It's been confirmed the [HBOOT Downgrade Toolkit] CD will run on a Mac though. [No tests have been done with the Ultimate Recovery Tool[Box] yet]

    How to run the Ultimate Recovery Tool[Box] from a Flash Drive
    I've realized that there is enough demand for being able to run the Ultimate Recovery Tool[Box] from something other than a CD-ROM drive.
    Thanks to Disturb3d1/wwjoshdew and Mpgrimm2 for the suggestion!
    What you'll need:
    A 256MB USB Flash Drive (Almost any flash drive you have laying around)
    Ultimate Recovery Tool[Box]
    Core2USB

    Step 1. Simply download Core2USB from here.
    Step 2. Choose your USB Flash Drive and format it (This will delete all files from it, so back them up).
    Step 3. Run the Core2USB software. It won't install anything on your computer.
    Step 4. Browse to the Ultimate Recovery Tool[Box] ISO.
    Step 5. Double-click on the letter of your USB Flash Drive. Make sure that this is the correct drive.
    Step 6. Click Install
    Step 7. Reboot your computer with the USB Flash Drive inserted.

    Don't pull the flash drive out while you are booted into the Ultimate Recovery Tool[Box] Environment!

    Obligatory Disclaimer - This software is distributed in the hope that it will be useful, but without any warranty. You take full responsibility for the usage of the software. I am not liable for anything that goes wrong with this Live CD, including, but not limited to, "bricked" (otherwise unusable) phones, or anything else that happens to your phone(s), computer(s), or anything else. You take full responsibility for your use of these tools.
    58
    The Thanks List!

    MOVZX
    RussianBear
    Fuses
    Dexter93
    TrevE
    Crackanug
    closeone
    USSENTERNCC1701E
    jcase
    agrabren
    chad.goodman
    wwjoshdew
    The Fer-Shiz-Nizzle
    jlechner
    The entire Revolutionary team

    FAQ's

    Can I do this on Windows?

    Currently there is no way to do this on Windows. It's unlikely that there will be a way to do it on windows, Windows USB is too slow and doesn't detect the device the same as Linux does.

    Can I do this in (Insert virtual PC software)?

    The only one I've heard that works is VMWare, however You're again relying on Windows to pass the device to a virtual machine, which isn't ideal. I know for a fact that VirtualBox does not work, and Cygwin also does not work.

    Common Errors

    I can't get my phone to brick, I've tried a million times!

    Patience is a virtue. This step is the hardest part of all, HTC Designed their phone to be brick proof for a reason. I believe the trick here is to let the device sit on the update screen for a minute or two, then do the update and count out 5 seconds. Also there's the update bar that appears in the upper right hand corner, much like the bar that is there when it's checking the zip file before the update prompt. The INSTANT you see that, pull the power. This is typically 5-6 seconds after it says updating, but only after it's been sitting for a bit... I believe the trick is to let it sit for a bit before pressing Volume up to update.

    My PG86IMG.zip is not detected or the phone checks it and it doesn't prompt me to update it

    There are several possibilities:

    • The phone is HTC Unlocked - You must re-lock.
    • The phone is S-OFF - Don't even try to brick it because you'll permanently brick it.
    • The phone is Re-locked, but still has a custom rom/recovery on it. - This will show a security warning and not allow the PG86IMG.zip to be flashed. - You must put the phone in FASTBOOT USB and run the RUU exe that matches your software version.
    • The File is not named correctly, it's PG86IMG.zip (Make sure it's not PG86IMG.zip.zip)
    • The PG86IMG.zip is either corrupt, not signed properly, or modified in some way. - Download another one.

    I press Volume up to Update, and my phone shuts off

    • First make sure you're using a standard HTC A/C Adapter and cable. These are designed to charge at 1000 mA, other manufacturer's chargers typically only hit 900 mA. The phone needs it all to stay on and update properly without the battery in.
    • Second, make sure you're not using a higher end SD Card. This will draw too much power and not let the phone update when it comes to that time because the power drain to have the screen on, the sd card powered and the update running is more than what the A/C adapter can output. - My 16GB Class 10, shuts the phone off, my Class 4, 2 GB, does not. YMMV.
    • Third, if you're stuck with the high end SD card, or think it could be the cause, simply pull it after you pull the battery and BEFORE you press volume Up to update. The phone will still update. However, I don't know if this affects the speed of the update at all... so just watch it the first time and time it, then time your pull accordingly.

    I'm getting Permission Denied when trying to run the linux commands

    You don't have root, either type su or sudo -s, your prompt should have a # at the end and not a $.
    Or, you didn't set the chmod correctly on the ultimate file. This is again chmod 755 ultimate (or /path/to/ultimate)

    I get Misc image is missing!!! or HBOOT image is missing!!! or Recovery image is missing!!!

    The hboot.img and misc.img and recovery.img files must be in the same location as the ultimate file, they are hard coded into the ultimate tool to be in the same location, their names are also hard coded, so don't rename them.

    I'm getting Error 16 after running the radio fix.

    This can happen, there are two things, most likely it goes away after attempting to place a few calls. If it doesn't, just remain on the line, and they can fix the problem for you.
    12
    Fixed Mike's phone. Have what I need to fix the tool as well. Will be updating that shortly.
    10
    To those that have the bad MEID, send me a PM with your backup of partition 19. and your Gtalk info, I will work with you to get you back to your own phone's meid.