How to downgrade and root your DInc from 2.2
- August 30th, 2010
- Posted in Android . How To
- By zeiroe
- Write comment
I had a buddy that wanted to test out the leaked Droid Incredible froyo RUU … The 3.21.605.1 RUU with the 2.15 radio. Problem was that he quickly found out that he lost root and his clockwork recovery. The race condition that allowed you to pop in an sdcard had been fixed and unrevoked’s root and reflash utility didn’t work on this new leak. It was also pretty safe to say that any future shipments of DInc’s would have this type of load as well by default. Oh noes!
Fortunately we have an exploding community. Forumite smwoodward posted a guide on xda-developers.com to roll back your Radio, HBOOT and OS. With his guide, you can install the rom.zip file for any RUU applicable to your DInc. Seems smwoodward saw that the EVO users were in the same boat in the past and the same fix for them applies to the DInc. This fix should also apply to any new DInc’s that come to stores with 2.2 already installed.
Unfortunately, smwoodward didn’t have enough posts under his belt to post links in his thread. It was kind of hard to follow without working links. Here’s my reiteration of this fix:
** Not responsible if you break/brick your device or if your dog gets diarrhea. This guide was written assuming you have a basic understanding of ADB and it is required that your SDcard be formatted in FAT32**
- If you haven’t already, download the Android SDK here. Extract it to the root of your C: drive.
- Download the downgrade files here mirror. The zip contains 3 files. Extract those 3 files into the tools directory of the SDK folder. Should be “c:\android-sdk-windows\tools”.
- Download the PB31IMG.zip file here. Place this file in your “c:\android-sdk-windows\tools” directory. This was originally the rom.zip file found within the DInc’s RUU for 1.22.605.2_Radio_1.00.03.04.06_hboot_0.79_release_161494. I renamed it to PB31IMG.zip. This will be the file that the bootloader will look for. More on that later.
- With your phone on, plugged into your computer and “USB Debugging” enabled (Settings > Applications > Development > USB Debugging), open a cmd prompt and type
cd C:\android-sdk-windows\tools
- Once ready, type these commands in cmd prompt from your adb tools directory. After every line press enter.
adb push flash_image /data/local/ adb push rageagainstthecage-arm5.bin /data/local/tmp/ adb push mtd0.img /sdcard/ adb push PB31IMG.zip /sdcard/
Note: the PB31IMG.zip will take longer than expected to transfer to the sdcard. It is a BIG file.
- Now we chmod a few things. After every line press enter. It should repeat what you typed in and then return you to a blank line with an $ for everything in adb shell
adb shell cd /data/local/tmp chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin cd /data/local chmod 0755 /data/local/flash_image cd /data/local/tmp ./rageagainstthecage-arm5.bin
Note: You will now see some text on your cmd prompt screen explaining the exploit.
- Wait for the adb shell to go away, and it will dump you into your windows command prompt again (no shell) should look something like this: “C:\android-sdk-windows\tools>”
- Typing adb shell now should produce a # prompt.
cd /data/local ./flash_image misc /sdcard/mtd0.img
- that will flash your misc partition with Toast’s mtd-eng.img. Once completed, This should return you to a blank line with #.
reboot bootloader
- This will reboot your device into the bootloader and start to automatically install the PB31IMG.zip file you pushed on to your sdcard. The load process will take a little while.
- After a minute or so, there should be a prompt on your DInc’s screen asking if you want to apply the update. Press the volume up key to confirm. This will take a while. Your phone will reboot a couple of times during this process. Just let it sit. There will be a confirmation message once its done.
- Congrats! You are now rolled back to 2.1. Your HBOOT is rolled back prior to the race condition fix. Downloading the unrevoked root and reflash utility and running it will root your DInc and install the latest clockwork recovery.
Source: xda-developers.com



I keep getting “cannon stat flash_image:no such file or directory” whenever I do the first ADB push…
I keep getting “cannon stat flash_image:no such file or directory” whenever I do the first ADB push…
@Anthony
nvm…stupid me…
@Anthony
$ ./flash_image misc /sdcard/mtd0.img
error writing misc: Permission denied
?????????
This is a great guide and I do appreciate you for republishing with links, but if you could help me a little further I would appreciate it greatly. Everything works fine until I get to one part.
adb shell
cd /data/local/tmp
chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin
cd /data/local
chmod 0755 /data/local/flash_image
cd /data/local/tmp
./rageagainstthecage-arm5.bin
Wait for the adb shell to go away, and it will dump you into your windows command prompt again (no shell) should look something like this: “C:\android-sdk-windows\tools>”
Typing adb shell now should produce a # prompt.
as soon as I get to this point, it will no longer recognize my phone, it says error:device not found, no matter what I do. I will post screens or a screen capture if I need to showing what happens. Please help me if you can.
@Tim
Exact same thing happens to me!! I’ve done all steps like 10 times, and I’ve formatted my SD card to FAT32 a bunch of times, and I also did Factory Restore on phone several times. Still nothing!!! Help!
Exact same thing happens to me!! I’ve done all steps like 10 times, and I’ve formatted my SD card to FAT32 a bunch of times, and I also did Factory Restore on phone several times. Still nothing!!! Help!
@Tim
link to PB31IMG.zip through megauploads is corrupted. cpuld not open w winzip
I could not get this to work unless i had my phone set to HTC Sync (most guides say set to charge only) for whatever reason my sd card would be mounted when set to charge only and it produced many errors and permision errors like the ones seen above. heres what i did
CHange charge mode to htc sync: when it pops up looking for pc shit yada yada click the back soft key BOOM everything worked from here on out. after every reboot do the same thing hope this helps!
@slurm: me too! i’ve tried it hundreds of times to no avail…
I am experiencing this exact same issue. I have tried rebooting my phone and when I type adb shell after, it returns $ instead of #. Any ideas?
I just did this guide on a brand new Incredible and now the screen is blank… is there a way to unbrick this phone? I can’t see the screen to do anything… but it still functions.. This happened to me on an Evo also with the updated H-boot.
This guide is awesome followed to the T. It worked perfect the first time