[Tutorial][07-17]How to unlock/root/s-off and revert back an Evo 3D(ShooterU) - HTC EVO 3D

Updated
Please read the instructions completely and carefully before you attempt anything.
Disclaimer:
What ever you do with your device is your own responsibility. In no way shall I, any other member of XDA or HTC, be held responsible in case you brick, destroy your device or even cause any bodily injury to you, by following these instructions
Click to expand...
Click to collapse
Before you start meddling with your device, please read, search XDA for related information, use wiki.
Those people who are trying to gain S-off to flash ICS ROMs with sense 4.0... You do not have to flash the new firmware as a compulsion. The older Radio works well with the sense 4 ROMs. It is not an absolute necessity to upgrade the firmware. You can skip that. And you can flash any ROM in 4ext touch recovery even with S-ON. Proceed to S-off only if you accept the risks of bricking your device completely without any possibility of recovering it again. And also keep in mind, you will lose all your personal data on the device by following these instructions.
Resources:
1. Windows running computer(PC).
2. HTC EVO 3D android smartphone.
3. USB cable that came with your Evo 3D.
4. Micro SD card with adequate space in it.(At least 4 GB)
5. Basic computer knowledge of how to open a command prompt and how to run commands in command prompt.
6. 7z / winrar archiver.
Prerequisites for doing anything with your device.
1. Download and install the HTC drivers.
(You can get this from HERE)
2. Unlock your device the htcdev way. Visit http://www.htcdev.com and follow the instructions.
You can take a preview of all the steps in attached zip below.
3. Read this post by flashmaniac, http://forum.xda-developers.com/showpost.php?p=22494488&postcount=1
4. Read this post by happyhallsy8 http://forum.xda-developers.com/showpost.php?p=17233858&postcount=1
5. Uninstall the HTC sync application from your computer.
6. Download the adb and fastboot files attached below in fastboot-cmd.rar and extract this to the root of the C drive on your computer and rename the folder to Android.
You need to understand a few important terminologies before going forward:
1. Root: It is the basic file system of the android operating system on your device. This has all the important files and programs and drivers which make your device run. And to access this you need to have administrator privileges. Which is obtained by flashing a custom rom which gives you administrator privileges by default, or you need to flash superuser from a custom recovery and then install busy box.
2. Custome ROM: It is an installable zip archive which contains all essential programs and files found in the operating system released for your device by the manufacturer with some modifications so as to enhance the functionality according each individuals taste.
3. RUU/shipped ROM: RUU is an executable which re-installs the original manufacturer released version of the ROM onto your device.
4. Bootloader: It is the part of the firmware which resides in your device which runs the most basic function of starting the device and switches the control to the operating system once the bootstrap of the operating system has loaded on.
5. Locked bootloader: The device manufactures lock this firmware so that your device does not fail to boot and bad programs don't ruin the essential files.
6. adb: A program which can control your device when your device is connected to the computer through a USB cable.
7. cid: This is your manufacturer provided general hardware/firmware id.
8. Serial number: Unique identification number of your device.
9. Unlocking: Unlocking your device the HTCDEV way gives you ability to flash custom ROMS which are not authenticated by HTC and it does not enable you to flash custom kernels on to your devices.
10: Kernels: These are the files that determine how your device perfomes, so if you do not intend to meddle with your kernels, all you will ever need is unlocking the HTCDEV way
Click to expand...
Click to collapse
If you just want to flash a new ROM you do not need to s-off your device
S-off is required only to flash custom kernels​
The instructions for each different procedure are posted in a new post.
Continued in the next post.

---

Getting started... Up to flashing a rooted custom ROM
Now lets get started.
1. Unlock your device HTCDEV way. There are ways in which you can achieve S-OFF without unlocking your device first. Search for them in the forum. Unlocking HTCdev way has been shown to be consistently successful.
By unlocking HTCDEV way, you will loose all your personal data from your device, so please make a nandroid backup before doing this.
Also use any of the apps and contacts backup and restore apps available in the market and restore all your messages, contacts, apps and settings.
2. Download Clockworkmod recovery by clockworkmod. This tool is essential to flash any custom ROM. Copy this file to your adb folder on your cumputer, That is c:\android.
3. Download a fully rooted custom ROM like one from LeeDroid or any other custom ROM which is rooted.
4. Additionally you can download superuser rooting app.
5. Go to settings in your device, and select applications-->development-->check the USB debugging. Connect your device to your computer by USB cable.
6. Click start and run cmd prompt.
7. Enter the following code
Code:
cd\(Hit Enter button)
cd android(Hit Enter Button)
adb reboot bootloader(Hit Enter button)
The result will look like this.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
8. Your device will boot into bootloader mode and it will show fastboot USB.
9. Now Enter this code
Code:
fastboot flash recovery cwm_4.0.1.4-shooteru.img
Wait for it to finish.
Once done, reboot your device.
Once rebooted, enter the code:
Code:
adb reboot recovery
You will enter the clockworkmod recovery.
10. Select the option mounts and storage.
next select mount USB storage.
Wait for your computer to recognize and install the driver, now copy and paste the superuser.zip which you downloaded earlier into the sdcard.
Also copy and paste the LeeDroid ROM which you downloaded into the root of your sdcard.
Right click your removable disk on the computer and select eject.
11. Select Unmount in the recovery on your phone. and then select go back.
12. Now on your computer, in the command prompt enter the following code
Code:
adb reboot recovery
13. Your device reboots into the recovery again.
14. Now select install zip from sd card.
then select choose zip.
Then choose the superuser zip and press power button to select.
Reboot the device normally and do the following.
Code:
adb shell (Hit enter, and you will see $, as shown below)
$su(hit enter)
#(Now you have to allow the superuser privileges on your device)
#exit(ENTER)
$exit(ENTER)
c:\Android>adb reboot(hit enter)
once the device is booted into android, visit the google play store, and search for busy box, download it and install, you will have root access.
Now your device is fully rooted.
15. Another way of rooting your phone is by flashing a pre-rooted rom. Download any Gingerbread rom which has been pre-rooted, copy that to your SD card, reboot into CWM recovery and select the rom you downloaded and flash it.
16. If the device gets stuck in the HTC white screen, then follow these steps.
a. Enter the following code in the command prompt.
Code:
adb reboot bootloader
Then go to the folder where you had downloaded the LeeDroid zip, you extract one particular file by the name boot (It is a .img type of file)
Now copy this file to the android folder in C:\ drive (C:\android)
Now in command prompt enter this code.
Code:
fastboot flash boot boot.img(Press enter)
fastboot reboot
You are done flashing a fully rooted custom ROM with latest superuser app.
Means you are fully rooted and unlocked and have a custom recovery through which you can flash any other ROM if you want to.
CREDITS: IN NO PARTICULAR ORDER,
Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.

---

Downgrading your Hboot
Now that you have unlocked and got rooted, lets get your device S-off.
As I understand, till date this following way has been successful in getting your device HBoot down and achieve S-OFF, Important thing for that is to change your CID to a universal CID, that is HTC__001.​
I do not know that MY way will work for every device, you are welcome to try my way, for at least the unbranded devices.
There are two ways of changing your device cid.
1. Through fastboot. Open the command prompt, connect your device by USB cable, check USB debugging is enabled. and enter the following code
Code:
adb reboot bootloader
wait till your device enters bootloader and shows fastboot USB, now enter the following code.
a. For unbranded devices.
Code:
fastboot oem writecid HTC__001
fastboot oem lock
fastboot oem reboot bootloader
Please note that in the cid there are 2 underscores before 001.
b. For branded devices such as Vodafone.
Code:
fastboot oem writecid VODAP001
fastboot oem lock
fastboot reboot bootloader
You can even change that CID to HTC__001.
Once you have achieved S-OFF you can change your cid back to original.
2. Manually.
For this you need to download xvi32 hex editor from here
Extract this anywhere, run the xvi32 and open mmcblk0p31.img which you had copied to your device sdcard.
Now change the cid as shown in these pictures.
Initial
Changed
Now save the file.
For branded devices.
Initial,
Changed.
Now save the file and exit.
Now go to adb shell and do as shown:
After this you can check your cid and it will show the changed cid and software build number.
You will get best results if you do this before you flash the custom ROM.
Now you can downgrade the Hboot also in two ways, one is automated as demonstrated by flashmaniac in his thread and the other one is manual.
Downgrading flashmaniac's way does not require you to unlock your device the HTCDEV way.
1. Flashmaniac's way.
Download his tool (Makes sure there are step1.exe, step2.exe and step3.exe in the folder).
Extract the entire folder to root of C drive on your computer.
Run step1.exe
If do not get any errors run step2.exe
Then run the step3.exe
Wait for it to flash the European version of RUU onto your device.
This RUU/Rom.zip in the downloaded folder has the Hboot version 1.49.0007.
2. A little bit cumbersome and manual way of doing it,
Download the tools from Flashmaniac's thread. Extract the zip. Copy the mmcblk0p31.img to your sdcard.
Then run this code in adb. (Your device will be booted normally into android and USB debugging mode should be enabled)
Code:
c:\android>adb shell (Hit enter)
#dd if=/mnt/sdcard/mmcblk0p31.img of=/dev/block/mmcblk0p31 (Hit enter)
You will see copied successfully.
You might face problems here if you are not rooted fully or if your device is still locked.
Then you check the cid and if it shows non workable cid, then write the new cid and relock your device.
Code:
fastboot oem readcid
fastboot getvar cid
Code:
fastboot oem writecid HTC__001 (or)
fastboot oem writecid VODAP001
Code:
fastboot oem lock
Now boot your device into recovery:
Code:
fastboot reboot
adb reboot recovery
In your computer, from the tool folder downloaded from Flashmanic'c thread, rename the Rom.zip to PG86IMG
Copy this zip to your sdcard by mounting your sdcard in recovery.
Reboot into bootloader.
Code:
adb reboot bootloader
now check that your device bootloader shows as Relocked.
If it doesn't show Relocked.
Try this method to Relock it.
Code:
fastboot flash unlocktoken unlock_code.bin
YOU MIGHT HAVE TO RE-DO THE ENTIRE PROCESS OF HTCDEV WAY OF UNLOCKING AGAIN AT THIS POINT. WORKS 100% OF THE TIME
Accept the disclaimer by HTC and let it reboot.
Now pull the battery, and then reboot into bootloader by pressing volume down button and then pressing the power button.(You should keep the volume down button pressed till you boot into the bootloader)
Now relock your bootloader again.
Code:
fastboot oem lock (hit enter)
fastboot reboot-bootloader(hit enter)
Now your device will start reading the zip then it will check it for a signature and will ask you if you want to flash.
select yes by pressing the volume up button.
Let it finish.
You may see some error in the end, stating fail. Don't worry.
Just reboot your device.
You are done.
Now you have a Hboot version 1.49.007.
CREDITS: IN NO PARTICULAR ORDER,
Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.

---

Now Finally to S-OFF
Finally the much awaited S-OFF
The need to do all the above steps was to finally arrive here.
It is essential to make sure that, your device has a Hboot 1.49.007.
The whole point of this tutorial up to here has been this.
There is one way getting S-OFF on your device, that is by using the revolutionary tool.
Visit http://revolutionary.io
Select the appropriate operating system.
The download will start as soon as you click on the operating system shown.
Enable USB debugging mode on your device and connect it to your computer by the USB cable.
Extract the downloaded zip from revolutionary site to your C drive.
Run the revolutionary.exe as administrator.
This will give you your device serial number.
Enter the serial number in the space given on the revolutionary.io site and copy the S-off code generated, and paste it your notepad.
For the revelotutionary tool to work you must have an identifiable software build number on your device (You can change that in mmcblk0p31.img with a hex editor).. Better still just flash the European ROM with Hboot 1.49.007.. This is safer and avoids problems while running the revolutionary tool.
Now type the code in the program.
Hit enter and wait for it to finish.
If something goes wrong, or if it says failed.
Then recheck your device's boot loader is locked.
And try again and again till you succeed.
The second way is just download this supertool by frigid and run it and you are done.
Now your device has been successfully S-OFF.
Reboot your device.
Copy which ever custom ROM you want to your device's sdcard.
copy any kernel you want.
Then flash them using the CWM recovery in the recovery.
Or use the fastboot commands to flash the kernels and ROMs as you like.
Hope This tutorial will benefit all the noobs as well as members who face problems while trying to S-OFF their devices.
CREDITS: IN NO PARTICULAR ORDER,
Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.
Thank you guys.

---

For warranty issues you can revert back to your original version by following these steps​
Visit this thread
Download the appropriate RUU version for your region.
Make sure that you have your original cid written back on your device.
You can do this by entering the following code
Code:
//to check the current cid//
C:\android>fastboot oem getvar cid
//to change the cid//
C:\android>fastboot oem writecid HTC__044
//You must enter your device cid which you wrote down before you changed it//
Repeat these steps two to three times and reboot into bootloader and re_lock your device
Code:
C:\android>fastboot oem lock
Run the .exe and follow the onscreen instructions.
If this does not work, then, RUN THE .EXE FILE and do as described below.
When the RUU asks you accept, minimize the RUU/drag it down.
Start the task manager on your computer, go to processes, look for a process which has a name ARUwizard, right click on that and select go to location.
Now you can see a zip archive called rom.zip
Open that, and find the android-info.txt, extract it or just open it within winrar.
This will contain the cidnumber, note down the cidnum which was similar to your cid number, and note down the software build number.
Now make these changes in the mmcblk0p31.img with the help of xvi32 hex editor, copy back the file to your device in adb.
Instead, if you remember your original cid and software build number, you can write them back.
Please also remember to write the original cid of your device back in fastboot.
Copy that rom.zip to the root of your sd card, and then reboot into bootloader and flash it in bootloader.
Now reboot the device and run the RUU, once done, do the following.
Enter this code in fastboot:
Code:
fastboot oem lock
Remember to lock your device bootloader first, before writing the secureflag 3, If you don't lock the bootloader, you will brick your device.
Code:
fastboot oem write secureflag 3
fastboot reboot-bootloader
You will see that your bootloader is S-ON and shows RELOCKED.
You are done.

---

Just in case I fall short of space

---

Just in case one more

---

Thanks for this...I already have a custom recovery, and a fully rooted rom...awaiting S-OFF instructions...
I assume that your instructions will work for CID: VODAP021... with HBOOT: 1.49.0013
Thanks

---

Thanks - Is it worth trying the touch version of Clockworkmod recovery?
also there's no point flashing the superuser.zip and then flashing a rooted rom on top as the superuser.zip would only give root on the current rom - which is then overwritten by the rooted (leeroid) rom

---

sorry but this post is useless....
how to root is already explained... there are automated recovery flashers... there is an automatically way of gaining s-off.
you destroy the chance that people get the right tutorial on first try...
43D again.... you will never get S-OFF.
Lothaen said:
Thanks - Is it worth trying the touch version of Clockworkmod recovery?
Click to expand...
Click to collapse
No... it's buggy as hell.

---

Flashmaniac said:
No... it's buggy as hell.
Click to expand...
Click to collapse
that's a shame - worked perfectly on the HTC Desire

---

Flashmaniac said:
sorry but this post is useless....
how to root is already explained... there are automated recovery flashers... there is an automatically way of gaining s-off.
you destroy the chance that people get the right tutorial on first try...
43D again.... you will never get S-OFF.
No... it's buggy as hell.
Click to expand...
Click to collapse
This tutorial is not yet complete flashmaniac, this will give every possible way of getting s off. That's the point of this. If you don't mind... I will use your links here and will explain your automated way in the beginning. That is my intention.
Please wait till it is complete.
There are some workarounds, those will also be explained.

---

Flashmaniac said:
43D again.... you will never get S-OFF
Click to expand...
Click to collapse
BS you are the only one posting this...WTF IS YOUR ISSUE...tell me why or STFU!

---

4D3 said:
BS you are the only one posting this...WTF IS YOUR ISSUE...tell me why or STFU!
Click to expand...
Click to collapse
I am just telling you, that it is not possible. but try and try - you will know why I told you that a hundred times already
dryogeshd said:
This tutorial is not yet complete flashmaniac, this will give every possible way of getting s off. That's the point of this. If you don't mind... I will use your links here and will explain your automated way in the beginning. That is my intention.
Please wait till it is complete.
There are some workarounds, those will also be explained.
Click to expand...
Click to collapse
this will confuse people. there are plenty of none-working ways. now you add one more....
downgrading only works for the cid's that I listed on my thread...
edit: I see that you are advicing people to change their cid.
It usually does not work
if it is working you cannot lock the bootloader

---

Flashmaniac said:
I am just telling you, that it is not possible. but try and try - you will know why I told you that a hundred times already
this will confuse people. there are plenty of none-working ways. now you add one more....
downgrading only works for the cid's that I listed on my thread...
edit: I see that you are advicing people to change their cid.
It usually does not work
if it is working you cannot lock the bootloader
Click to expand...
Click to collapse
I have done that.. my cid wasn't listed, now I am s off. What do you say for that?

---

dryogeshd said:
I have done that.. my cid wasn't listed, now I am s off. What do you say for that?
Click to expand...
Click to collapse
As I said - usually it does not work. If there are RUU'S with CID's for your carrier and region you can change them but you cannot lock the bootloader. it says succesfull but stays unlocked

---

Flashmaniac said:
As I said - usually it does not work. If there are RUU'S with CID's for your carrier you can change them but you cannot lock the bootloader. it says succesfull but stays unlocked
Click to expand...
Click to collapse
There is a workaround for that as I have written dude..

---

dryogeshd said:
There is a workaround for that as I have written dude..
Click to expand...
Click to collapse
and what is if you CID is TELST001? right! it is not working and it will never work.
This is just one of a thousand examples.
I tried changing the CID with a guy that has TELST001, it has never worked.
never mind... go on with this.

---

If I downgrade hboot from 1.49.0018, to 1.49.0007, what I'm losing?

---

Flashmaniac said:
and what is if you CID is TELST001? right! it is not working and it will never work.
This is just one of a thousand examples.
I tried changing the CID with a guy that has TELST001, it has never worked.
never mind... go on with this.
Click to expand...
Click to collapse
Will update as and when I find out the workarounds for not supported cids..
This thread needs support from guys like you. Please wait till I finish the tutorial. You will see why I started this.