Get Unstuck from ICS Leak 200 (AKA Upgrading from 200 to 206) INSTRUCTIONS

[orangechoochoo]

I'm trying to think out loud about retaining root for those who upgrade from 206 to 208 because doing the upgrade removes root and there currently is no way to root ICS. Right now I have rooted 206 using rootkeeper when I went from 219 to 206. The files that rootkeepr modded in 206 to retain root, can that be copied and flashed separately after upgrading to 208 so we can keep root? Rootkeeper doesn't use an exploit to root, it saves the SU and reactivates it. People have been having trouble because when rootkeeper tries to reactivate SU some of the paths have been changed when using the unstick method to go from 200 to 206, and presumably from 206 to 208. So if there is some way to save and restore/flash whatever was changed during the unstick process then rootkeepr may still work.

Basically the process would copy the files that contain the paths that allows rootkeeper to work on 206. Then use the unstick method to upgrade from 206 to 208. Then flash those files back and then rootkeepr will have the correct files & paths so it can retain root in 208.

Alternatively, someone who has rooted 208 can save whatever we need to retain root and then we can flash that after moving from 206 to 208.

NEVERMIND. After rereading some things, rootkeeper won't survive the unstick process so my first suggestion about restoring the files & paths won't work.

But maybe my second suggestion might work?:

1. Fastboot 219 which will create a nonbootable hybrid GB/ICS system.
2. Fastboot 208 boot image.
3. Boot into recovery
4. Flash complete 208.
5. Fastboot rooted 208 files.

 

[droidian1441]

For those who are trying to patch the new 208 build kernel (boot.img), check out whirleye's post in: Bspatch. Trying to get ICS stuck CDMA Razrs back on the path. - xda-developers . I'll eventually get around to doing it, but the thought of having to backup and restore all my data again is daunting right now and I'm not sure what all is changed in 208 vs 206.

I'm trying to work on it myself, I've unpacked the. 219 kernel and and am trying to figure out how to apply the boot.img.p from the .208 leak. I am willing to wipe my data I did it three times in 15 mins the other day testing stuff on 206.

Sent from my DROID4 using Tapatalk 2

 

[droidian1441]

I am close to getting the 6.16.208 kernel! Those on 206 who wanna go to 208 may not have to wait much longer.

 

[orangechoochoo]

Thanks for the hard work! I'm more concerned about retaining root though. Maybe when ICS for the Razr comes out next week and the root method is released, I'll upgrade to 208 and then root it.

 

[droidian1441]

Thanks for the hard work! I'm more concerned about retaining root though. Maybe when ICS for the Razr comes out next week and the root method is released, I'll upgrade to 208 and then root it.

I wonder if the same method would work for us.

 

[droidian1441]

Ive got the kernel!!Im currently flashing 208 OVER 206!!!!!

Ill post the kernel later. The method in the OP is the one I used and it seems to work. Ill keep posted.

Give credit to mattlgroff for helping me with the kernels.

It works, I am now on 208 and I came from 206! I am uploading the kernel for your use now.

 

[Z4ck]

Ive got the kernel!!Im currently flashing 208 OVER 206!!!!!

Ill post the kernel later. The method in the OP is the one I used and it seems to work. Ill keep posted.

Give credit to mattlgroff for helping me with the kernels.

It works, I am now on 208 and I came from 206! I am uploading the kernel for your use now.

Good job bro hell yeah =D

 

[bdsullivan76]

Did you maintain root?

Sent from my DROID4

 

[Z4ck]

Did you maintain root?

Sent from my DROID4

No root im on 208 you will lose it gotta do the unstuck method but use the 208 kernel and then flash 208zip

 

[Danis]

How about a rooted nandroid backup with 208 if we already had safestrap loaded would it help? After the restore you would use the ota upgrade package.

Sent from my XT894 running ICS

 

[tcrews]

How about a rooted nandroid backup with 208 if we already had safestrap loaded would it help? After the restore you would use the ota upgrade package.

Sent from my XT894 running ICS

Nope, forget safestrap when talking OTA's. They don't play together. Forget nandroid's when talking about updating kernel/baseband. Only OTA's do this.

 

[bdsullivan76]

How about a rooted nandroid backup with 208 if we already had safestrap loaded would it help? After the restore you would use the ota upgrade package.

Sent from my XT894 running ICS

Without root there is no way of flashing the nandroid backup. This is a huge development none the less. It just proves we will be able to move on to the official update as soon as it is released. For now I will stick with. 206
And maintain root. Gratz to droidian and all that helped him to work this method out. It just proves locked boot loader or not where there is a will there's a way.
Sent from my DROID4

 

[adventuretuber]

Hi, I was on the .200 kernel for a few weeks and just tried to make the jump to .206 yesterday. I followed the detailed instructions from orangechoochoo exactly, but on the recovery menu when I try to update from the external SD, it aborts while verifying and I get the message:

E:signature verification failed

Does anybody have any ideas about what else I can try? Currently I can't fully boot because I'm on the weird hybrid. If I get the .200 kernel from someone and fastboot that with the unstuck tool can I reflash the .200 leak? At this point, any working ROM would suffice.

Just for good measure, I've tried this whole process three times and tried applying all of the updates several times from the recovery menu (fastbooting the .208 kernel where appropriate).

FYI: If you didn't know already, you can pull the battery sticker off and charge the battery directly by hooking a 5V DC power supply (or severed USB cord) to the two leads. Battery seems to be fully charged at 3.88V.

 

[orangechoochoo]

Try redownloading the 206 image file and put your sd card in another phone and redownload the full 206 update then put it iback in your phone. Then start over. Maybe one of the downloads is corrupt.

If that fails still you should still be able to reflash 200.

 

[siggma]

If this procedure works to trick the installer to update to 206 or now 208 (SEE: http://www.droidforums.net/forum/droid-4-roms/211413-6-16-208-kernel-6-16-206-users-only.html) why can't we use it to go all the way back to stock GB?

Can't I fastboot the .219 files then separately flash the GB kernel and have a working stock GB phone again, ready for the Motoverizon OTA when it comes in July or Aug? For me, since I lost root when I updated it would provide me a way to re-root with the correct su binary so I can re-update to .206 or .208 and keep root.

Has anybody tried this? As long as I keep track of what I have on the phone in terms of images and kernels, and what changes I've made by flashing new files so I can go back and recover to my current state, it should be safe to at least try it.

I have tried fastbooting a new system.img containing a copy of su over the top of .206 and it worked but it wouldn't boot. I got a flash error (it skipped cdt.bin and boot.img) so I flashed the first two pre-boot files (mbmloader...yada ydad) to recover from the flash error and that worked but then I got a boot error pointing to the /system I flashed. There is no way to bypass this for sure since it's the very reason eFuse exists. But, couldn't I flash the .219 boot.img first, then reflash the .219 update files, or maybe the .219 GB first then the boot.img from the .219 archive?

My experience:
When I tried to go forward with my modified system image, RSD refused to flash cdt.bin as well as boot.img the second time, and good thing it did. CDT.BIN is the "Certificate Data Table", an eFuse table in flashable memory that contains the certificates for each of the read-only partitions mounted when the phone is running. If the CDT does not match the contents of the partition you get a "boot error" and the phone won't boot, no matter what you do. apparently it does not check all partitions but it obviously does check /system. Perhaps it doesn't check /data, providing a "hole" through which one could root this phone...? Anyway your only recourse at this point is to re-flash one of the working OTA updates, in this case since I'm currently on .206 that's the only update that would work because it checks the current kernel. This gives me an idea...I have to assume that if you successfully acquire root and modify the system, boot, recovery or data partitions, the eFuse must update the CDT to match the new partition contents, otherwise you wouldn't be able to restart the phone with su installed or an edited build.prop. This information may provide some help for those working on how to build a "cannonical", flashable ROM package with all the correct signatures for eFuse from a directory of files.

Anyway, it makes sense that if you have the original CDT.bin for GB (it's in the VRZ_XT894_6.5.1-167_DR4-1_M1-219_1FF_01.xml.zip) the only thing preventing the original STOCK update from taking me all the way back to STOCK is the boot.img that the update refuses to flash. If I flash the stock images back to the phone and manually try to flash boot.img it should work fine since the CDT and all the other signatures will match the kernel I'm flashing, successfully satisfying eFuse for both flashing and booting. I think I tried this once before and it refused to flash cdt.bin but I might be wrong. The STOCK update can be installed using either RSD or "flash from sdcard", either one should work. If I decide to try it and it works I'll post a procedure in a new thread, unless somebody has already tried it?

WARNING WARNING WARNING:
If you decide to try this, keep this in mind. If you flash the wrong partition(s) and get a boot error you must re-flash the original partition(s) that matches the CDT.BIN currently on your phone or you won't be able to enter recovery and apply the update needed to recover. I've tried it and was able to successfully recover from the boot error by re-flashing the original system.img, in my case it was the GB system.img but if you weren't able to successfully update cdt.bin it will be the partitions that match the version currently on your phone.