This post shows complete output from the AAHK kit during HTC Desire HD hack. DHD was firstly downgraded to the Android 2.3.3 version and then rooted. If you are interested in steps and additional info, please go to my post How to Root the HTC Desire HD
Important note!
AAHK is no longer supported. Please read the following post: The AAHK is retired.
ubuntu@ubuntu:~/a$ uname -a
Linux ubuntu 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686 i386 GNU/Linux
ubuntu@ubuntu:~/a$ sudo ./hack-ace.sh
Ace Advanced Hack Kit
attn1 2011/2012
Goldcard integration courtesy of Revskills and Genepoole
Checking adb connection...
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
SH0CMRX01898 device
******************************************************************************
**************************** STOP WATCHING TV ********************************
******************************************************************************
************************** READ THE EFFEN MANUAL *****************************
******************************************************************************
**************************** ENTER THE PASS KEY ******************************
******************************************************************************
**************************** STOP WATCHING TV ********************************
******************************************************************************
************************** READ THE EFFEN MANUAL *****************************
******************************************************************************
**************************** ENTER THE PASS KEY ******************************
******************************************************************************
**************************** STOP WATCHING TV ********************************
******************************************************************************
************************** READ THE EFFEN MANUAL *****************************
******************************************************************************
**************************** ENTER THE PASS KEY ******************************
******************************************************************************
Input PASS KEY and press ENTER : RTEM-xx:xxxxxxxxx
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is: fastbootRUU
*********************************************************************
q - Quit
Input Selection and press ENTER : 1
This version of Android cannot use the hack kit at this time.
You can downgrade if you like, then rerun the hack step.
WARNING: THIS WILL WIPE DATA
Would you like to DOWNGRADE? y/n y
Download this RUU? (y/n) y
--2012-07-26 19:05:43-- http://tau.shadowchild.nl/files/PD98IMG-GB2.zip
Resolving tau.shadowchild.nl (tau.shadowchild.nl)... 176.9.40.154
Connecting to tau.shadowchild.nl (tau.shadowchild.nl)|176.9.40.154|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 259503624 (247M) [application/zip]
Saving to: `PD98IMG/PD98IMG-GB2.zip'
100%[======================================>] 259,503,624 480K/s in 8m 51s
2012-07-26 19:14:33 (478 KB/s) - `PD98IMG/PD98IMG-GB2.zip' saved [259503624/259503624]
Flash this RUU? (y/n) y
pushing rom to sdcard - this takes time, please be patient.
2367 KB/s (259503624 bytes in 107.024s)
Setting up to temproot....
rm failed for /data/local/tmp/*, No such file or directory
518 KB/s (21215 bytes in 0.039s)
2843 KB/s (572752 bytes in 0.196s)
469 KB/s (19240 bytes in 0.040s)
going for temproot using zergRush....
[**] Zerg rush - Android 2.2/2.3 local root
[**] (C) 2011 Revolutionary. All rights reserved.
[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.
[+] Found a GingerBread ! 0x00017118
[*] Scooting ...
[*] Sending 149 zerglings ...
[+] Zerglings found a way to enter ! 0x10
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[*] Trying a new path ...
[*] Sending 149 zerglings ...
[+] Zerglings caused crash (good news): 0x401219c4 0x0071
[*] Researching Metabolic Boost ...
[+] Speedlings on the go ! 0xaad26059 0xafb394f7
[*] Poping 22 more zerglings
[*] Sending 171 zerglings ...
[+] Rush did it ! It's a GG, man !
[+] Killing ADB and restarting as root... enjoy!
setting mainver lower for downgrade...
--set_version set. VERSION will be changed to: 1.21.415.2
Misc partition is "/dev/block/mmcblk0p13"
Patching and backing up misc partition...
Creating goldcard....
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.006 secs (64000 bytes/sec)
starting downgrade...
** The phone will now reboot into HBOOT.
** It will then check the file just sent.
** If everything is okay, the phone will
** prompt you to continue by pressing
** VOLUME UP. It will reboot, flashing twice.
**** PUSH POWER WHEN THIS STEP COMPLETES ****
If downgrade is successful, you may set up the phone and try to hack it again.
Once the downgrade is successful, press a key to return to the menu......
Otherwise, cut and paste the output to the screen into a text file for evaluation...
then press a key.
a <-- I pressed "a" key
2348 KB/s (4359771 bytes in 1.812s)
pkg: /data/local/tmp/stericson.busybox-1.apk
Success
467 KB/s (19240 bytes in 0.040s)
2167 KB/s (4564992 bytes in 2.057s)
2400 KB/s (3737600 bytes in 1.520s)
2776 KB/s (572752 bytes in 0.201s)
310 KB/s (13968 bytes in 0.043s)
2762 KB/s (557962 bytes in 0.197s)
223 KB/s (9796 bytes in 0.042s)
1787 KB/s (134401 bytes in 0.073s)
2355 KB/s (2801664 bytes in 1.161s)
2033 KB/s (2830336 bytes in 1.359s)
1799 KB/s (285981 bytes in 0.155s)
1729 KB/s (285981 bytes in 0.161s)
Android version is Gingerbread... using fre3vo temproot....
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802260340
smem_len: 3045521
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Scanning region fbb70000...
Potential exploit area found at address fbb9b311:e10.
Exploiting device...
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.004 secs (96000 bytes/sec)
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p13"
Patching and backing up misc partition...
Starting update process....
erasing 'cache'... OKAY
Be patient - sending update ...
sending 'zip' (17223 KB)... OKAY
writing 'zip'... INFOadopting the signature contained in this image...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOchecking main version...
INFOstart image[boot] unzipping & flushing...
INFO[RUU]UZ,boot,0
INFO[RUU]UZ,boot,21
INFO[RUU]UZ,boot,58
INFO[RUU]UZ,boot,89
INFO[RUU]UZ,boot,130
INFO[RUU]WP,boot,0
INFO[RUU]WP,boot,130
INFOstart image[recovery] unzipping & flushing...
INFO[RUU]UZ,recovery,0
INFO[RUU]UZ,recovery,21
INFO[RUU]UZ,recovery,47
INFO[RUU]UZ,recovery,68
INFO[RUU]UZ,recovery,89
INFO[RUU]UZ,recovery,130
INFO[RUU]WP,recovery,0
INFO[RUU]WP,recovery,130
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,62
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,99
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,51
INFO[RUU]WP,radio,59
INFO[RUU]WP,radio,68
INFO[RUU]WP,radio,76
INFO[RUU]WP,radio,85
INFO[RUU]WP,radio,95
INFO[RUU]WP,radio,100
OKAY
rebooting...
Radio downgrade complete - starting next process - please be patient...
major abra-cadabra going on, please be patient.....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000139a3 (80291)
Section index for section name string table: 41
String table offset: 0x000136fa (79610)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a10 (2570)
-- size: 0x000000ac (104)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9ee0, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc01a9e00
Kernel memory mapped to 0x32000000
Searching for brq filter...
- Address: 0xc02a9e10 + 0x35d
- 0x2a000113 -> 0xea000113
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
Checking adb connection....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000139b4 (80291)
Section index for section name string table: 41
String table offset: 0x000136fa (79610)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a10 (2570)
-- size: 0x000000ac (104)
Kernel release: 2.6.32.21
New .modinfo section size: 186
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02db110
Kernel memory mapped to 0x40008760
Searching for brq filter...
- Address: 0xc02aa21c + 0x33c
- 0x2a000123 -> 0xea000123
Patching and backing up partition 7...
patching secu_flag: 0
Done.
push: tools/afr/system/bin/su -> /system/bin/su
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
2 files pushed. 0 files skipped.
2533 KB/s (609587 bytes in 0.234s)
/system/bin/su
S-OFF, ROOT and Clockworkmod recovery complete
Be patient - installing updated radio and AAHK ENG hboot...
Starting update process....
erasing 'cache'... OKAY
Be patient - sending update ...
sending 'zip' (11650 KB)... OKAY
writing 'zip'... INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOstart image[hboot] unzipping for pre-update check...
INFOstart image[hboot] unzipping & flushing...
INFO[RUU]UZ,hboot,0
INFO[RUU]UZ,hboot,100
INFO[RUU]WP,hboot,0
INFO[RUU]WP,hboot,100
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,65
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,100
INFOstart image[rcdata] unzipping & flushing...
INFO[RUU]UZ,rcdata,0
INFO[RUU]WP,rcdata,0
INFO[RUU]WP,rcdata,100
OKAY
rebooting...
************ Process complete **************
**************** PRESS ENTER ****************
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is: fastbootRUU
*********************************************************************
q - Quit
Input Selection and press ENTER : q
what is htc input pass key ?
so important for me ……pls
Generated pass key can be found in CAJUN.txt file. But please be careful!
please tell me a god link to download AAHK
You can find download link on my previous post How to Root the HTC Desire HD.
sir….when i m trying to downgread…it gives me error that the flashfile is not available on net or 404 error… please wht to do…!!!
where can i download the RUU ?
my is not found
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012 ___________________________ MAIN MENU | | | Only ONE Menu Step to: | 1 - Hack Ace <----------------------------+ * S-OFF | | * SIM Unlock | 2 - DONATE (Encouraged, but optional) | * SuperCID | http://psas.revskills.de/?q=goldcard | * Root | http://www.eff.org/ | * Busybox | | | ********************************************************************** o - Options Menu (Return to Stock, Flash radios, etc) ********************************************************************** t - Toggle Flash Method - current method is fastbootRUU ********************************************************************* q - Quit [Select and press Enter]1 3.12.405.1 This version of Android cannot use the hack kit at this time. You can downgrade if you like, then rerun the hack step. WARNING: THIS WILL WIPE DATA [Would you like to downgrade? y/n]y Download this RUU? [y,n]y --2013-03-10 22:44:49-- http://tau.shadowchild.nl/files/PD98IMG-GB2.zip Resolving tau.shadowchild.nl... 176.9.40.154 Connecting to tau.shadowchild.nl|176.9.40.154|:80... connected. HTTP request sent, awaiting response... 404 Not Found 2013-03-10 22:44:49 ERROR 404: Not Found. Syntaxfehler. Parameterformat nicht ordnungsgemäß - "PD98IMG-GB2.zip". Woah dude[tte] - bogus md5sum! Bad mojo.... no file to flash Check it out - renamed the file to PD98IMG/PD98IMG-GB2.zip-bad You can re-download the file and keep going.... Download this RUU? [y,n]Please Help!
This post is output from AAHK for HTC DHD. Unfortunately, author of AAHK (Ace Hack Kit) decided to stop support and further development. Please read his post with explained reasons why hack kit is retired:
The AAHK is retired
Accordingly, the comments on this post will be closed in order to reduce any possible damage due to bricked HTC devices.
Sorry.