wiki:back_to_stock

Version 3 (modified by anonymous, 11 years ago) (diff)

--

Back to Stock

Prerequisites:

You need to have radio S-OFF to follow this steps Please make sure that gfree_verify returns secu_flag = 0 before following this steps.

Install the stock image

In case of the original T-Mobile G2 the stock rom is called PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b_26.02.01.15_M2_release_149459_signed.zip

adb push /PC10IMG_Vision_TMOUS_1.19.531.1_Radio_12.21.60.09b_26.02.01.15_M2_release_149459_signed.zip /sdcard/PC10IMG.zip

Disconnect the phone from USB and shutdown the phone.

Boot into hboot by holding <Vol-Down> while powering on.

hboot should load the PC10IMG.zip automatically and the ask you if you want to update. Press <Vol Up> to start the update.

After updating the radio hboot will start again (screen will get dark for some seconds)

If you had the fake S-OFF engineering hboot installed it will be replaced by this process

radio S-ON and original CID

There are 2 ways to get radio S-ON and the original CID.

You can either restore the backup of your partition 7 or you can use gfree to set secu_flag = 1 and CID = T-MOB010 (or your corresponding original CID).

Restoring the backup will also bring back the SIM-lock data, while using gfree will keep the phone SIM-unlocked.

In both cases you need to first use rage to gain temporary root.

temporary root

Before you can adb as described below you need to enable debugging in the settings on the phone. In Settings go to "Applications -> Development" and check the "USB debugging" option.

You will need the Android Terminal Emulator, get it from the market!

In the commands to run below, $ or # represent the prompt and should NOT be entered as part of the commands.

Get the gfree_temp-root.zip that is attached to this page and unzip the gfree_temp-root.zip files to a folder. From a cmd window or terminal, navigate to that folder and execute these commands:

$ adb push su /sdcard/su
$ adb push Superuser.apk /sdcard/Superuser.apk
$ adb push rage /data/local/tmp/rage
$ adb push busybox /data/local/tmp/busybox
$ adb push root /data/local/tmp/root
$ adb shell chmod 0755 /data/local/tmp/*

ON YOUR PHONE:

  1. Launch Terminal Emulator
  1. $ /data/local/tmp/rage
  1. Wait for the message: "Forked #### childs."
  1. Menu > Reset Term - Terminal Emulator will exit.
  1. Launch Terminal Emulator, it Force Closes. Launch a second time, and you'll have a root shell

using gfree to get radio S-ON and the original CID

ON YOUR PC:

Get gfree_03.zip that is attached to this page http://www.thinkthinkdo.com/trac/project1/wiki/gfree.

Unzip gfree_03.zip to a place on your computer. Navigate to where the files are on your computer, and type:

$ adb push gfree /data/local/tmp/

Gfree should now be in your phone at /data/local/tmp

ON YOUR PHONE:

You should still have terminal emulator up, at a root prompt from earlier.

Now run:

# cd /data/local/tmp
# ./gfree -s on -c T-MOB010
# sync

Remove the PC10IMG.zip from the sdcard:

# rm /sdcard/PC10IMG.zip

Disconnect your phone from USB and power it down.

Boot into hboot by holding <Vol-Down> while powering on.

The heading should now read: "VISION PVT SHIP S-ON"

restoring the backup of partition 7

Alternatively to setting the S-ON and CID by using gfree you can also install the backup of you partition 7.

You will still need gfree to remove the write protection from the emmc and the kernel. To to so you can use the "-w" option of gfree.

ON YOUR PC:

Get gfree_03.zip that is attached to this page http://www.thinkthinkdo.com/trac/project1/wiki/gfree.

Unzip gfree_03.zip to a place on your computer. Navigate to where the files are on your computer, and type:

$ adb push gfree /data/local/tmp/

Gfree should now be in your phone at /data/local/tmp

ON YOUR PHONE:

You should still have terminal emulator up, at a root prompt from earlier. We assume that the backup of your partition 7 in in /sdcard and is called part7backup-<time>.bin (replace <time> with the time string of your backup).

Now run:

# cd /data/local/tmp
# gfree -w
# dd if=/sdcard/part7backup-<time>.bin of=/dev/block/mmcblk0p7
# sync

Remove the PC10IMG.zip from the sdcard:

# rm /sdcard/PC10IMG.zip

Disconnect your phone from USB and power it down.

Boot into hboot by holding <Vol-Down> while powering on.

The heading should now read: "VISION PVT SHIP S-ON"