Zuofu
Member
Hi All,
WARNING: WILL CAUSE YOU TO LOSE ROOT FOR NOW, WE NEED A UNIVERSAL ROOTING METHOD FOR 4.0.4 WHICH IS APPARENTLY CLOSE TO WORKING
I took a look at how people were able to get unstuck from the .85 Droid RAZR leak here: Get Unstuck From Ics(But Not Back To Gb)! [6.14.84/85, 6.16.203/204/206] - DroidRzr.comasically how this operation works is this: Each over the air patch leak (e.g. .zip file) has (at least) 2 checks before it installs. The first is a check for the version that the user is coming from by looking at the build.props. The new build.props is stored (or really, a patch for it is stored) in a file called boot.img, which also has the kernel and some very low level system files. If you open up the update script for version 206, you will find a line that looks like this:
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "verizon/maserati_vzw/cdma_maserati:2.3.6/6.5.1_167_DR4-1_M1-219/4:user/release-keys" || file_getprop("/system/build.prop", "ro.build.fingerprint") == "verizon/maserati_vzw/cdma_maserati:4.0.4/6.7.2-180_DR4-16_M2-26/11:user/release-keys");
This checks if your current build.prop is either 2.3.6 build 2.3.6/6.5.1_167_DR4-1_M1-219/4 OR (||) 4.0.4/6.7.2-180_DR4-16_M2-26/11, corresponding to the build versions for the old gingerbread and the new 206 build (you can reinstall the update.zip over itself). Notice that the build revision for the 200 ICS leak (4.0.4/6.7.2-180_DR4-16_M2-20/5)is *NOT* here, which is why many of us on 200 are stuck.
You might wonder "well, why not just change the build.props?" This also does not work, because each of the files in the OTA update has a MD5 hash, which verifies that what is previously installed is the file from the gingerbread release. Since you've already upgraded the files to the 200 ICS leak, the MD5 hash no longer matches, so the update will fail even if you have the correct build.prop.
The obvious solution is to try to fastboot back to gingerbread and install "from scratch". HOWEVER, people who tried this have bricked their phones. This is because fastboot refuses to install an older boot.img over the new one, presumably because the gingerbread kernel is older than the ICS kernel and it checks some e-fuses (not sure about this). So what happens when you fastboot is that it skips over flashing boot.img, so you still have the ICS kernel, and when you try to boot it crashes. The only thing you can do here is flash the 200 .zip file back, because you still have the 200 kernel; if you try to flash 206 from this state, it still fails because your build.prop still says you are on 200 (even though your files are basically all gingerbread files at this point).
What we would like to do is to extract the boot.img for the 206 leak and flash that separately. That way we have the kernel and the build.prop from 206. Then we can fastboot to gingerbread, have it skip the boot.img as it typically does so we have the rest of the files from gingerbread. Having the correct build.prop lets us bypass the FIRST check, having the old gingerbread files (and MD5 checksums) lets us bypass the SECOND check. We can then install the .zip update for the 206 leak to get all the files updated to the latest ICS leak.
The snag here is that in the .zip updates (for the ICS leaks), the boot.img is not stored as an independent file, but it is stored as a patch for the existing boot partition as boot.img.p. Following the instructions here: Bspatch. Trying to get ICS stuck CDMA Razrs back on the path. - xda-developers I was able to recreate both 200 and 206 boot.img files by applying the patch to the gingerbread boot.img (which we do have the full version for courtesy of our fastboot image).
The procedure I copied from Get Unstuck From Ics(But Not Back To Gb)! [6.14.84/85, 6.16.203/204/206] - DroidRzr.com. Thanks go to mattlgroff, dhacker29, and everyone else involved with either this exploit or droid razr utility. I'm uploading 2 files, the first is a version of droid razr utility with the binaries replaced by droid razr files. The second is the unstuck ICS utility with 2 boot.img files (extracted from 200 and 206 respectively) instead of the droid razr (206 and 85) files.
Step 1. Dl 206
Step 2. Fastboot 181 (by 181 I mean gingerbread 219) using droid razr(4) utility
Step 3. Fastboot the 206 boot.img
Step 4. Boot into recovery.
Step 5. Flash 206 from external sd card
The rest of this is to try to get root onto 206, not sure if it works yet, I am trying it now. UPDATE: THIS DOES NOT WORK SINCE OUR "OLD" LEAK IS ALSO 4.0.4 (NOT 4.0.3 LIKE THE OLD RAZR LEAK). IF YOU USE THIS METHOD YOU WILL LOSE ROOT (AT LEAST UNTIL THE UNIVERSAL 4.0.4 ROOT METHOD IS RELEASED)
Step 6. Boot up and enable usb debugging
Step 7. Boot into ap fastboot mode
Step 8 flash 85 boot.img (by 85, we mean 200)
Step 9 boot using bp tools
Step 10 use ics root
Step 11 flash 206 boot.img
Step 12 profit
Files:
Droid RAZR Utility for Droid 4 (Full 1+GB!!)
https://dl.dropbox.com/u/22291559/droid4/DroidRAZRUtility1.6_for_droid_4.7z
Droid RAZR Utility Lite for Droid 4 (Copy latest 219 fastboot files into \files directory)
https://dl.dropbox.com/u/22291559/droid4/DroidRAZRUtility1.6_for_droid_4_lite.7z
https://dl.dropbox.com/u/22291559/droid4/unstuck ICS_for_droid_4.7z
WARNING: WILL CAUSE YOU TO LOSE ROOT FOR NOW, WE NEED A UNIVERSAL ROOTING METHOD FOR 4.0.4 WHICH IS APPARENTLY CLOSE TO WORKING
I took a look at how people were able to get unstuck from the .85 Droid RAZR leak here: Get Unstuck From Ics(But Not Back To Gb)! [6.14.84/85, 6.16.203/204/206] - DroidRzr.comasically how this operation works is this: Each over the air patch leak (e.g. .zip file) has (at least) 2 checks before it installs. The first is a check for the version that the user is coming from by looking at the build.props. The new build.props is stored (or really, a patch for it is stored) in a file called boot.img, which also has the kernel and some very low level system files. If you open up the update script for version 206, you will find a line that looks like this:
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "verizon/maserati_vzw/cdma_maserati:2.3.6/6.5.1_167_DR4-1_M1-219/4:user/release-keys" || file_getprop("/system/build.prop", "ro.build.fingerprint") == "verizon/maserati_vzw/cdma_maserati:4.0.4/6.7.2-180_DR4-16_M2-26/11:user/release-keys");
This checks if your current build.prop is either 2.3.6 build 2.3.6/6.5.1_167_DR4-1_M1-219/4 OR (||) 4.0.4/6.7.2-180_DR4-16_M2-26/11, corresponding to the build versions for the old gingerbread and the new 206 build (you can reinstall the update.zip over itself). Notice that the build revision for the 200 ICS leak (4.0.4/6.7.2-180_DR4-16_M2-20/5)is *NOT* here, which is why many of us on 200 are stuck.
You might wonder "well, why not just change the build.props?" This also does not work, because each of the files in the OTA update has a MD5 hash, which verifies that what is previously installed is the file from the gingerbread release. Since you've already upgraded the files to the 200 ICS leak, the MD5 hash no longer matches, so the update will fail even if you have the correct build.prop.
The obvious solution is to try to fastboot back to gingerbread and install "from scratch". HOWEVER, people who tried this have bricked their phones. This is because fastboot refuses to install an older boot.img over the new one, presumably because the gingerbread kernel is older than the ICS kernel and it checks some e-fuses (not sure about this). So what happens when you fastboot is that it skips over flashing boot.img, so you still have the ICS kernel, and when you try to boot it crashes. The only thing you can do here is flash the 200 .zip file back, because you still have the 200 kernel; if you try to flash 206 from this state, it still fails because your build.prop still says you are on 200 (even though your files are basically all gingerbread files at this point).
What we would like to do is to extract the boot.img for the 206 leak and flash that separately. That way we have the kernel and the build.prop from 206. Then we can fastboot to gingerbread, have it skip the boot.img as it typically does so we have the rest of the files from gingerbread. Having the correct build.prop lets us bypass the FIRST check, having the old gingerbread files (and MD5 checksums) lets us bypass the SECOND check. We can then install the .zip update for the 206 leak to get all the files updated to the latest ICS leak.
The snag here is that in the .zip updates (for the ICS leaks), the boot.img is not stored as an independent file, but it is stored as a patch for the existing boot partition as boot.img.p. Following the instructions here: Bspatch. Trying to get ICS stuck CDMA Razrs back on the path. - xda-developers I was able to recreate both 200 and 206 boot.img files by applying the patch to the gingerbread boot.img (which we do have the full version for courtesy of our fastboot image).
The procedure I copied from Get Unstuck From Ics(But Not Back To Gb)! [6.14.84/85, 6.16.203/204/206] - DroidRzr.com. Thanks go to mattlgroff, dhacker29, and everyone else involved with either this exploit or droid razr utility. I'm uploading 2 files, the first is a version of droid razr utility with the binaries replaced by droid razr files. The second is the unstuck ICS utility with 2 boot.img files (extracted from 200 and 206 respectively) instead of the droid razr (206 and 85) files.
Step 1. Dl 206
Step 2. Fastboot 181 (by 181 I mean gingerbread 219) using droid razr(4) utility
Step 3. Fastboot the 206 boot.img
Step 4. Boot into recovery.
Step 5. Flash 206 from external sd card
The rest of this is to try to get root onto 206, not sure if it works yet, I am trying it now. UPDATE: THIS DOES NOT WORK SINCE OUR "OLD" LEAK IS ALSO 4.0.4 (NOT 4.0.3 LIKE THE OLD RAZR LEAK). IF YOU USE THIS METHOD YOU WILL LOSE ROOT (AT LEAST UNTIL THE UNIVERSAL 4.0.4 ROOT METHOD IS RELEASED)
Step 6. Boot up and enable usb debugging
Step 7. Boot into ap fastboot mode
Step 8 flash 85 boot.img (by 85, we mean 200)
Step 9 boot using bp tools
Step 10 use ics root
Step 11 flash 206 boot.img
Step 12 profit
Files:
Droid RAZR Utility for Droid 4 (Full 1+GB!!)
https://dl.dropbox.com/u/22291559/droid4/DroidRAZRUtility1.6_for_droid_4.7z
Droid RAZR Utility Lite for Droid 4 (Copy latest 219 fastboot files into \files directory)
https://dl.dropbox.com/u/22291559/droid4/DroidRAZRUtility1.6_for_droid_4_lite.7z
https://dl.dropbox.com/u/22291559/droid4/unstuck ICS_for_droid_4.7z
Last edited:
