Android Devs

Ok, so you have firmware v. 123099 and wanna have root access… no problem. Here’s how.

QMAT public (free) version used to succesfully downgrade with WM device: qmat_424.zip, md5: 7f0ccd1b52072bc2a6d594393f2ce348.

The new version of QMAT can create a Goldcard only in the paid version. Buy it or get the old one somewhere else (Google/Bing search it).

Requirements:
- Micro SD card formated FAT32 (128 MB to 2 GB), Sandisc cards may not work (but worked for me).
- Connected Windows Mobile device (application unlocked)

SD Card:
- Format recommended

format F: /FS:FAT32 /A:4096

(Replace F: with your SD card reader drive letter.)

TESTED, WORKING

1. Insert the SD card into the Windows Mobile device and connect it to your PC. Windows Mobile has to be application unlocked.
2. Download QMAT (http://revskills.de/pages/download.html)
3. Start QMAT and select Hardware Forensics -> Generate HTC Goldcard
4. Select Dream from the list of devices, Click “Get SD Card Serial from WINCE Device” and then “Save Goldcard Image to WINCE SD”
5. Copy DREAIMG.NBH to the root of sd (UK – RC7 recommended for our DREA110)
6. Power off the G1, put the card inside, hold Camera button and press the Power button
7. Press the Power button to start flashing
8. Apply the HardSPL update, root & upgrade
9. You don’t need the GoldCard any more (HardSPL fixes it, you should be able to flash any image now).
10. Format the SD once again or lend it to a friend to downgrade his/her G1

The Other Way

No Windows Mobile device needed, just Linux (or Cygwin, to use dd) and the paid version of QMAT. However this may not work (incorrect sd card serial number read from G1).

For using Linux to generate and write the image (full version of QMAT):

• Get sdcard serial (using adb shell, or terminal emulator within Android): cat /sys/class/mmc_host/mmc1/mmc1:*/cid
• Start QMAT using wine
• Byte-wise reverse the serial string using QMAT: Cryptoanalysis Tools/Crypto Toolbox, enter serial in the box left of the “reverse string” button, click button, copy reversed serial string
• Generate Goldcard image: click Hardware Forensics/Generate HTC Goldcard, enter reversed serial string into the “Serialnumber of SD-card” field, press “Save Goldcard Image to file” button, remember filename “goldcard.img” and path
• Check filesize < 440 byte (otherwise writing this to the beginning of the sdcard would corrupt the partition table): ls -l goldcard.img
• If < 440 byte, use dd and a USB card reader. G1 with USB cable does also work, verified! (Probably you need to be root for that to work) to write the contents of the file “goldcard.img” to the beginning of the sdcard (assumes sdcard is /dev/sdb, might be other, check!): dd if=goldcard.img of=/dev/sdb
• Done!

Or try:

• In Linux, update to the latest version of Wine
• Use the SD card included with your G1.
• Get card ID using G1′s console by doing a
• Use QMAT 4.30 to reverse bytes. Write reversed bytes into “Serialnumber of SD-card (CID):” Save goldcard.img

cd /sys/class/mmc_host/mmc1/mmc1:8fe4
cat cid > /sdcard/cid.txt

• Zero the SD card:
Code:

dd if=/dev/zero of=/dev/sdb bs=1M

• In Linux use fdisk to create a partition with FAT16
• In Windows XP, format your SD card:

format E: /FS:FAT32 /A:4096

• In WinXP, copied file DREAIMG.NBH
• Copy DREAIMG.NBH E:
• Go back to Linux and write the goldcard.img file

dd if=goldcard.img of=/dev/sdb bs=384

The Other Other Way

Generate the image for free and dd it to sd:

Click here to generate goldcard for free!

Just enter your CID (from steps taken above) and email address, press the button “Continue” and
WAIT, only press Continue one time. It will then generate the goldcard and send it via Email.

Proof it Worked:

• Bookmark on Delicious
• Digg this post
• Recommend on Facebook
• share via Reddit
• Share with Stumblers
• Tweet about it
• Subscribe to the comments on this post
• Tell a friend