[GUIDE] [11/06/14] HTCDev Unlock and Root/Return to Stock

3,261 posts

Thanks Meter: 1,443

By , Inactive Recognized Developer on 11th August 2014, 06:48 AM

Page 1 of 38 1 2 3 11 Last

Here are instructions on how to unlock and root your htc desire 610. These work for both models, but the files are for the AT&T version.

BEFORE WE BEGIN, SOME TERMINOLOGY:
Unlocked Bootloader: HTCDev website will help us do this. It's free. It allows you to flash a recovery and signed boot image, which we have. It does not allow you to flash unsigned images.

S-On: Security on. This is how our phones come stock. Htc will not allow us to flash unsigned images because of this.

S-off: once someone achieves this for us, it will allow us to modify anything and everything, signed or not. We can flash new boot image and radios without worry of version number or signature.

Root: Allows you "administrative access" to your device, to move files and do certain things. However, our phone also has...

System Write Protection: HTC included this in the kernel, and it basically means that unless you have a kernel or boot image that gets around it, any changes you make to the system partition (aside from flashing in recovery) won't stick through a reboot. Essentially they will be temporary in an effort to preserve the phone. We don't like this.

Now then, with that out of the way...

1) HTCDev Bootloader Unlock: Under "Select Your Device", scroll ALL THE WAY TO THE BOTTOM, and choose "All Other Supported Models". I know it works, because I just did it. IT WILL WIPE YOUR DEVICE DATA. If you want the data backed up beforehand, turn on USB Debugging and use this command through adb to make a backup:

Code:

adb backup -apk -shared -all -f C:\desirebackup.ab

2)~~Download ClearD's Root Tool V3~~(USE VERSION 2.1 BELOW, VERSION 3 DOESN'T WORK FOR MOST PEOPLE): After you have drivers installed for your desire (install htc sync, plug in your phone, then let them load, then uninstall htc sync), fastboot turned off in the battery options in settings, and USB debugging turned on through the hidden developers menu, read the disclaimer in red below, and download and run this exe on your Windows machine with your phone plugged in. It'll install twrp recovery 2.8.0.1, install the engineering boot image, install SuperSU and root, and then install jmz's system-unlocked kernel to make root work like it should. I'm still working out kinks, so if it doesn't work right the first time, run it a second time! Thanks go to jmz, deez_troy, AdriVelazquez, and chainfire for the pieces to make this work.

DISCLAIMER: ONCE YOU USE THIS TOOL, YOUR DEVICE WILL HAVE THE ROOTED ENGINEERING BOOT IMAGE, WHICH CANNOT BE REVERSED. THERE ARE NO SIDE EFFECTS TO THIS IMAGE EXCEPT THAT IT SHOWS A DISCLAIMER ON YOUR SPLASH SCREEN WHEN YOU BOOT THE PHONE. THIS CANNOT BE CHANGED UNTIL WE GAIN S-OFF, WHICH HAS BEEN ACCOMPLISHED, BUT IS NOT YET PUBLICLY AVAILABLE. IF YOU ARE OK WITH THIS, PROCEED.

IF V3 DOESN'T WORK, HERE IS VERSION 2.1: Download ClearD's Root Tool V2.1. THIS VERSION INSTALLS ENGINEERING BOOT IMAGE AND JMZ KERNEL.

Return to Stock (AT&T ONLY) :http://dl3.htc.com/application/RUU_A...6_signed_2.exe
This ruu will bring you back to complete stock, version 1.50.502.7. It has to be run through Windows, and you have to have a locked bootloader to run it. If you're unlocked, you can relock it in fastboot with the command:

Code:

fastboot oem lock

. Feel free to unlock it again after updating through the RUU.

You can use your original unlock token or get it again through htcdev.

Older root tool version 1:

Quote:

Download ClearD's Desire 610 Root Tool V1. This version does not contain the engineering boot image, and needs it to work fully, thus is buggy and probably won't root you with one click. It will fail to adb remount, which will fail to auto install the zip files in recovery. If you've already flashed the engineering boot image, then it will work properly without issue. Otherwise, it'll place the root zip files on your phone, but you'll have to flash them manually in recovery.

Old manual method:

Quote:

2) Recovery: After you're unlocked, download TWRP recovery from this thread, rename the image file to "recovery.img", and flash through fastboot with the command:

Code:

fastboot flash recovery recovery.img

This will give you the official Team Win Recovery Project recovery for our device, which will allow you to root.

3) Insecure Boot Image and Root: Once you have recovery installed, the rest is easy. In recovery, if you try to reboot back into the rom, it will ask you if you wish to root. Select yes. It will do the rest I believe, and install SuperSU when you boot back into the rom. You'll also want to download and flash JMZ's insecure kernel, which unlocks the system file lock that htc places on their newer devices. Once flashed, you can then change system files and the changes will stick through reboots.

HTC Engineering Boot Image:

Quote:

Once unlocked, download the root zip provided in this thread, then open it. We can't just flash the zip file because most of us have an updated rom version than the one it was intended for, and I'm not sure how to fix that. But no bother. Pull out the boot image file, and place it somewhere you can find it. I put it right in my MiniADB/Fastboot folder for easy access. Then, you need to flash it. Here's how:

Code:

fastboot flash boot boot_root.img

You'll then have an insecure boot image, and it will say so on your splash screen. Trust me, the words are pretty ominous.

To restore your backup you made before unlocking, use this in adb:

Code:

adb restore C:\desirebackup.ab

A few superstars are currently working on s-off, and this will be updated once that occurs.

Special thanks to:
-JMZ (Recovery and Kernel)
-Deez_Troy (officiating recovery)
-AdriVelazquez (Insecure boot image)
-Chainfire (SuperSu)

Submit to XDA Portal Quick Reply Reply

The Following 21 Users Say Thank You to ClearD For This Useful Post: [ View ] Gift ClearD Ad-Free

11th August 2014, 09:20 AM |#2

OP Inactive Recognized Developer

Gallipolis

Thanks Meter: 1,443

Donate to Me

Also, to save this spot and before I forget it going to sleep tonight, I'm actually not sure if firewater or sunshine will work or not yet because I haven't gotten app root yet for them to function. I'll have to get that, then we'll try one or the other of those. /end thought

Edit: I do believe we will need the wp_mod to disable system write protection and allow su to stick before we continue. That'll allow us full root. Or, we could continue with a twrp build or a Clockworkmod build if someone can assist.

Submit to XDA Portal Quick Reply Reply

11th August 2014, 08:42 PM |#3

Senior Member

Thanks Meter: 414

Quote:

Originally Posted by ClearD

Edit: I do believe we will need the wp_mod to disable system write protection and allow su to stick before we continue. That'll allow us full root. Or, we could continue with a twrp build or a Clockworkmod build if someone can assist.

I could help with that, but you will have to build, I currently don't have a cyanogenmod source around. I need outputs of:
cat /proc/emmc
mount
cat /system/build.prop #<-- root maybe required
and I need your stock recovery.img, try getting it from an ota, or using dd.

The kernel source for this phone is released, you don't need to use the wp_mod.

Submit to XDA Portal Quick Reply Reply

The Following User Says Thank You to dummie999 For This Useful Post: [ View ] Gift dummie999 Ad-Free

11th August 2014, 08:58 PM |#4

OP Inactive Recognized Developer

Gallipolis

Thanks Meter: 1,443

Donate to Me

It is? Where did you find it released? And how would we go about getting system writable without wp_mod?

I'm still trying to work out all the kinks and have never built from source.

The outputs you need should be in my dev info thread except for the build prop, but I can remount and pull that.

Submit to XDA Portal Quick Reply Reply

11th August 2014, 09:08 PM |#5

Senior Member

Thanks Meter: 414

Quote:

Originally Posted by ClearD

It is? Where did you find it released? And how would we go about getting system writable without wp_mod? I'm still trying to work out all the kinks and have never built from source.

The outputs you need should be in my dev info thread except for the build prop, but I can remount and pull that.

? never built from source? You are RD!

http://www.htcdev.com/devcenter/downloads Filter device desire 610.

About the system write protection: https://github.com/dummie999/android...c8b82ce8ca264a
Should work

Well, build.prop then,

Edit: I need your stock recovery. You can get this with:

Code:

dd if=/dev/block/mmcblk0p41 of=/path/to/file/recovery.img

But you'll need busybox installed.

Edit2: You play subwaysurf!

Submit to XDA Portal Quick Reply Reply

The Following User Says Thank You to dummie999 For This Useful Post: [ View ] Gift dummie999 Ad-Free

11th August 2014, 09:27 PM |#6

Senior Member

New York, NY

Thanks Meter: 971

Donate to Me

Quote:

Originally Posted by dummie999

Code:

dd if=/dev/block/mmcblk0p41 of=/path/to/file/recovery.img

But you'll need busybox installed.

Edit2: You play subwaysurf!

I'll add this hear also since I was adding it to the rooted forum. But dummie999 is right.

Quote:

Originally Posted by AdriVelazquez

That logic is sound; however slight differences in the model maybe.

Currently in the M8 this file is located in block/blk-core.c, which has the following.

Code:

#ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
    sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("system"));
    if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() &&
            (get_tamper_sf() == 1) && (bio->bi_rw & WRITE)) {
        pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",
                bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
        err = 0;
        goto wp_end_io;
    } else if (atomic_read(&emmc_reboot) && (bio->bi_rw & WRITE)) {
        pr_info("%s: Attempt to write eMMC, %s block %Lu \n", current->comm,
                bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
        err = -EROFS;
        goto wp_end_io;
    }
#endif

That line of code will need to be intercepted at boot to allow permanent root.

I haven't checked recently, but is the source for desire 610 posted?

Also, you'll need to build from source for this.

Also, you can just create modules to intercept the data on boot, which would be easier.

Submit to XDA Portal Quick Reply Reply

The Following User Says Thank You to AdriVelazquez For This Useful Post: [ View ] Gift AdriVelazquez Ad-Free

11th August 2014, 09:30 PM |#7

Senior Member

Thanks Meter: 414

Quote:

Originally Posted by AdriVelazquez

Also, you can just create modules to intercept the data on boot, which would be easier.

Lol, no I couldn't get that working

, compiling from source was a lot easier, at least for my d500

Edit:

Quote:

My company has actually done a lot of work with the desire 610 and HTC, unfortunately some proprietary. But other's aren't.

Just curious, where do you work?

Submit to XDA Portal Quick Reply Reply

11th August 2014, 09:32 PM |#8

OP Inactive Recognized Developer

Gallipolis

Thanks Meter: 1,443

Donate to Me

I usually build from pre built stock, then change what I want through decompiling and recompiling, also do gui things and script things and theme things. This is new territory, but nothing I'm not uncomfortable doing by any means. I'll work on it tonight.

Also, those outputs were not from my device, but from an unlocked and s-off device of a friend lol. I noticed that also, but was too lazy to remove it.