Evo3d(CDMA)HBoot/S-off Differences & Rooting Background Info 10-13-12

Pick your bootloader!

I thought it might be a good idea to post my collection of bootloaders so they could all be downloaded from one place. Attached are all the bootloaders I've tested, including the new JuopunutBear bootloader (1.58.5858) that was created for the Sprint OTA.

Note: All attached hboot files have been updated to work with both the Sprint Evo 3D (CID=SPCS_001) and Virgin Mobile Evo V (CID=SPCS_002)

Here are the MD5 checksums for the zip files:

PG86IMG_1.30-hboot: 92d5abf4f778a473b420a53a76f4a228
PG86IMG_1.40-hboot: 3dc952832e485f9d80ea1aee559fe298
PG86IMG_1.50-hboot: 50ead742f1cf2dec21dd39e2c952271b
PG86IMG_1.57-hboot: 6a07091016270452be23b7350cb749bf
PG86IMG_1.58-hboot: 44af7b2a809b901dde390cc7543bdfc6
PG86IMG_ENG_1.04-hboot: e20048034a5143b22e5faaec4686c36f
PG86IMG_JBear_1.50.5050_hboot_GB: a6c48789c16f60dcd484e861513edc61
PG86IMG_JBear_1.57.5757_hboot_VM_ICS: 9bcf8a954d66cd96422c134d10891b4a
PG86IMG_JBear_1.58.5858_hboot_Sprint_ICS: 9d19534761d24fadf2d4263a79ec110d
PG86IMG_Revolutionary_1.40.1100-hboot: d81adbbdc6e16521e8a170de650ab2c9

ramjet73

DISCLAIMER: I'm not a dev, nor do I play one on t.v. Use the information and links at your own risk. READ and UNDERSTAND what your doing before flashing is the best bet. I take no responsibility or credit for the information.

Edit: This info primarily relates to the Sprint CDMA Evo3D. I am not familiar with phones flashed to other carriers (Vmobile, Boost, etc) and flashing Sprint Evo3D Ruu's etc may wipe out your carrier settings. If you know whether or not any of this works with other CDMA carriers, please feel free to respond.
------------------------------------------------------------------------------
SDX Version of this thread

I've had the Evo3D for a few months now and must say I really have come to like it.
If you want root, it's a bit quirky, You basically have 3 options:
(See the Hboot 1.5x HTC Unlock Guide in my signature for info & links)

1) HTCdev.com's "Bootloader Unlock":
Basically this leaves the bootloader's (ie, Hboot 1.50 & 1.58) security flag on (S-On) but "unlocks the bootloader" (kinda like the phones Bios) so that you can manually flash everything except for Radios (Baseband) and Boot Logo's (Splash Screen). Kernels & roms can be flashed once a custom recovery is installed, but there are "extra" steps involved because the /boot partition (kernel/zImage) can only be set to write access from the Android OS or by initiating custom recovery from a pc's "Fastboot Command Prompt". There are workarounds, some work better than others. To flash Radio updates, you have to relock the bootloader and flash an OEM Full Stock Ruu (Rom Update Utility), kinda like Samsung's Sw Updater for the Transform. You also have to register your device with HTC and it "may void your warranty".

2) Downgrade Bootloader from Hboot 1.50 to 1.40 (to get S-Off before you update to Hboot 1.58):
This has been around for a few months now & Unknownforce has a new "Ultimate Downgrade Tool" in the last few weeks that does even more. Basically involves corrupting the flashing process of the RUU by removing power in the middle of the flash and "bricking it" (more like mostly bricked). It forces the phone into a special eMMC Download mode that can only be fixed by pushing the older bootloader to the phone from a Linux pc. Good thing is that Closeone has a Linux LiveCD.iso that you copy to a USB Drive or CD and temporarily boot to a custom Linux Interface specifically set up for flashing the bootloader.
Once that's done, you rerun an earlier RUU (compatible with Hboot 1.40) to get the phone working fully, then root via "Revolutionary's site" (another fastboot/adb rooting tool) to get S-Off (Full root), load a recovery, update the radio, then you can flash roms & kernels like normal.
UPDATE: 2 Reports of this working with Hboot 1.58/2.89 FW by "Bricking it Twice"

3) Juopunutbear's S-OFF Wire Trick (Will reset the "Unlocked" status to "Locked" when a stock Hboot is flashed):
There is a similar third option now to brick (short out pins with a wire) & replace the bootloader on 1.50 with s-off but I haven't tried it. (Must HTC Unlock first & have a rooted "Stockish" rom installed).
Note: Jbear now works on the new OTA with Hboot 1.58.

dmdelgado said:

I wanted to share with everyone else suffering from HBoot 1.5 that if you have been using Chads ICS Firmware fix because of constant bootloops you dont need to downgrade your HBoot to 1.4. I know every time i would flash the firmware fix it would break many bugs that had already been fixed, I had to flash it to avoid getting constant boot-loops. But Juopunutbear's Wire trick to get S-Off was a miracle fix, and after it turns S-Off it asks if you would like to install a custom Juopunutbear Hboot. After this is done you are officially on HBoot 1.5 S-Off! And can flash any ICSense ROMS successfully without having bootloops! I really hope this helps someone enjoy their ROMs that much MORE because i know it feels good TO FINALLY BE FREED FROM THE CURSE OF S-ON!

Click to expand...

Click to collapse

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

HBoot & S-Off Background Info:
PLEASE ASSIST: If you have any comments/experience/verification of flashing different roms/kernels with the different Hboots please reply/post so we can get some certainty on the results below. Big thanks to the Mikeyxda, Ramjet, other MeanRom users, and everyone that has put out the firmware & Hboot updates.

mpgrimm2 said:

Here is a list of Hboot differences and compatibilities gathered from various posts.
If you are S-Off and want to change your Hboot/Bootloader, see the next post for a How-To courtesy of xhausx and a download links courtesy of RamJet73. (Remember to thank them both!)

Hboots: ____________________ Differences:

1.04.2000 (Eng Hboot) = Extended functions ................. Appear to be incompatible with newer 2.89 based kernels
1.30 (Stock Hboot with 1.07.651.1 Gb) .................... Appear to be incompatible with newer 2.89 based kernels
1.40 (Stock Hboot with 1.13.651.7 Gb) ................... Appear to be incompatible with newer 2.89 based kernels
1.40.1100 (incl. w/Revolutionary S-Off) ........................... Appear to be incompatible with newer 2.89 based kernels

1.50 (Stock Hboot with 2.08.651.3 Gb) ................... Appear to be incompatible with newer 2.89 based kernels (VM ICS Leak Kernel will boot)

1.57 (Stk Hboot w/ 1.13.652.1 VM ICS Leak) ...... May be compatible with other ICS Leak kernels & newer 2.89 based kernels. (some reports)
................................................................................edit: Nandroid of GB roms will boot, but Clean GB Installs bootloop.

1.50.5050 (incl. w/Jbear for GB S-Off) ........................... May be compatible with newer 2.89 based kernels & prior fw/kernels (some reports)
1.57.5757 (incl. w/Jbear for ICS S-Off) .......................... May be compatible with newer 2.89 based kernels & prior fw/kernels (some reports)

1.58 (Stock Hboot with 2.89.651.2 ICS) ............. Compatible with newer 2.89 based kernels (& Vm ICS Leak), not GB based (some reports)
.............................................................................edit: Some boot issues with AOSP/AOKP roms & kernels reported (ie CM9)

1.58.5858 (incl. w/Jbear for Sprint ICS S-Off) ............... Compatible with newer 2.89 based kernels (& Vm ICS Leak), not GB based (some reports)
.............................................................................edit: Some boot issues with AOSP/AOKP roms & kernels reported (ie CM9)

Hboot Note: Stock Hboots Do Not Support All Fastboot Commands (see below)

Kernel Note:
.......... VM ICS Leak Kernel: 3.0.16-g4211684

....... Sprint 2.89 ICS Kernel: 3.0.16-g294f767

Madmaxx & Ramjet73 have identified why kernels may not flash correctly AFTER the Sprint 2.89 Base kernel has been installed. See Madmaxx's explanation further down.

Click to expand...

Click to collapse

Major Thanks to Unknownforce for providing the following explanation!

Unknownforce said:

First, keep in mind, that there are technically two S-OFF's, the hboot and the radio. This is somewhat misleading. When you're phone displays S-OFF on the hboot screen, this is actually the Radio S-OFF, not hboot S-OFF. Gaining hboot S-OFF is actually just as simple as flashing a new modified hboot. (which is why there are revo hboot and now jbear hboot, they have been modified to now have hboot S-OFF)

hboot S-OFF is almost the same as unlocking your bootloader via HTC's method. Just that HTC's method doesn't get you S-OFF and is more limited than revo/jbear S-OFF.

So a few of the the differences here are:

1.) ENG Hboot is S-OFF and offers more fastboot commands and a few more unlocked features. This is an advanced hboot that you can do serious damage to the partitions in your phone if you don't know what you're doing. It's kind of like an all access pass.

2.) The stock hboots are S-ON, they don't allow very many of the fastboot commands. These are limited to very basic fastboot commands.

3.) revo/jbear are S-OFF, they allow for many of the "standard" fastboot commands, like flashing to partitions and whatnot, but not nearly as "feature packed" as the eng hboot, these are typically enough for normal users.

As to it providing any benefit to using a newer version of hboot, the only one that provides more features is the eng hboot for more fastboot access. What this means is that there's no major feature/performance difference between 1.30 and 1.57 aside from some appearance and some security adjustments (to allow HTC Unlock and also attempt to counter the S-OFF/exploits)

As I understand it, the differences between radio S-OFF and hboot S-OFF are basically as follows:

Radio S-OFF has signature verification off, what this means is that you can flash any PG86IMG.zip and it doesn't have to be signed by HTC. This will allow it to flash just about anything from there. This is why you can revert to a lower hboot without having to do anything special when you accidentally (or purposefully) flash a new hboot over your revo or any other hboot. Radio S-OFF also doesn't check the signature of most of the current partitions (so you don't get "security warning")

hboot S-OFF allows many more of the fastboot commands to be accepted and opens up the ability to flash some of the restricted partitions from it as well.

Hope this helps clear up some confusion.

Click to expand...

Click to collapse

To drive home these differences between Radio S-OFF & Hboot S-OFF, here's Ramjet73's post:

ramjet73 said:

I finally figured out what one of the main differences is between the custom bootloaders (Engineering (ENG), JuopunutBear and Revolutionary) and the stock boot loaders (1.40,1.50,1.57,1.58).

I was trying to boot a new version of TWRP recovery with the 1.58 bootloader installed using the "fastboot boot recovery.img" command from my PC and I kept getting "remote: not allowed" so I tried flashing it using "fastboot flash recovery recovery.img" and still got the same error. I then tried the JuopunutBear 1.58.5858 bootloader for the Sprint ICS build and the same commands worked!

After reading Unknownforce's description of the bootloaders again and recalling what the JBear developers said about their custom versions, it all makes sense. The ENG and custom bootloaders are "hboot S-OFF". Those fastboot commands (and some others) are restricted by the stock hboots unless you HTC unlock, even if you are radio S-OFF. However, the custom bootloaders are modified to allow those commands even when the bootloader status is ***LOCKED***, which mine has been since using the wire trick to gain radio S-OFF.

I think I'll just stick with the jbear 1.58.5858 or ENG bootloaders for now, since it's nice to be able to use those fastboot commands as an alternative to flashing PG86IMG.zip files from the bootloader.

ramjet73

Click to expand...

Click to collapse

Major thanks to Madmaxx and Ramjet73 for figuring the 2.89 Kernel to Custom Kernel Flash Issue out!

madmaxx82 said:

We've found the problem.
And it has absolutely nothing to do with any recovery.

In fact it is completely impossible to work in its unmodified form:

The problem is the boot.img that is flashed before: The 2.89 boot.img has its header at a different offset that wasn't common in earlier days.
That way utilities that are used for changing kernels in your current boot.img (in that case the 2.89 boot.img) will fail if they are not the latest version (unpackbootimg got updated by Koush not long ago).

However, the flashable zip used to install doesn't use unpackbootimg/mkbootimg, but something different: "abootimg" and this one wasn't made compatible yet officially (at least not where the source of the source comes from).

An unofficial, hidden, very dirty, modified abootimg does work.

Long story short: 2.89 was the bad boy

Ramjet73 and mpgrimm2 can tell you more about that.

Click to expand...

Click to collapse

If you flashed the Sprint 2.89 kernel and need to go back to the VM ICS kernel so u can flash a third party kernel afterwards, Ramjet73 put together a zip for you...
VM ICS Leak Kernel: 3.0.16-g4211684

Bootloader Flashing (CDMA) 8-9-12

Special thanks to xhausx for this background on Flashing the Hboots independently from his Eng Hboot thread (Req's S-OFF).

xHausx said:

Now that S-OFF is available we can use the eng bootloader to get extra fastboot commands.
If you set S-ON for whatever reason you must flash a SHIP (Stock) bootloader first or you will brick your phone.
If you aren't sure if you need this or not odds are you probably don't, it can be extremely useful but it assumes you know what you are doing so it is much easier to brick your phone with it.

To flash either rename to PG86IMG, place on your sd card and then reboot to the bootloader; or you can use 'fastboot oem rebootRUU' followed by 'fastboot flash zip PG86IMG_eng-hboot.zip'. A list of the available commands can be found here.

hBoot 1.04.2000, mirror - MD5: 3348C361FED927DABB853E49744BD7F2

If you would like to go back to the SHIP one you can download it here. The process to flash it is the same except over USB you can do it straight from fastboot without RUU mode.
PG86IMG_1.40-hboot - MD5: 1B994699EA226390B47282BCB54088DD

Thank you to the AlphaRev & Unrevoked teams for getting us all S-OFF! I also want to say thank you to TeamWin for making the wait bearable by getting us root and to everyone who has spent time ripping this phone apart.
Also thanks go out to SolsticeZero for being a guinea pig and making sure it flashed correctly

Click to expand...

Click to collapse

NOTE: All Available Bootloaders -> Ramjet's Pick Your Bootloader Post

Bootloader lock/unlock for S-OFF users

While on androidforums.com answering a question about returning to stock for an Evo V user, brian706 referred me to this post by scotty85 that includes zip files with a modified version of the update-binary found in recovery flashable zips that will query and reset the lock status of the bootloader for S-OFF users.

Since I always flash a custom bootloader to enable the extended fastboot commands and my bootloader is still locked from the JuopunutBear wire trick I don't really need to use them, but if someone who has an "unlocked" or "relocked" bootloader and is S-OFF would like to try the lock version of the zip it should be safe on the Evo 3D since I already tested the query version as working.

I've attached the zip files for convenience since the original downloads are on mediafire.

Edit: This is the original XDA thread by S-trace that documents the principle behind this, but credit goes to scotty85 for automating the process for the Evo 3D.

ramjet73

KL45SiiK said:

So i took the OTA and i'm s-on with the new hboot. If i unlock via htc dev will i be able to install any ICS rom in the development section? Before I took the OTA i was on hboot 1.50 s-on and I couldn't successfully run ANY ICS roms.

Click to expand...

Click to collapse

I'm not 100% sure yet. It may depend on what kernel is included in the particular rom ie, 2.17 Based kernel (GB) won't work, but Vm ICS Leak kernel & Sprint 2.89 based kernels (& newer) should work. MeanRom ICS v2.6 works with the new fw, kernel & hboot 1.58.

On a sidenote, here is some Hboot testing courtesy of RamJet73 from the MeanRom ICS thread:

ramjet73 said:

I tested some additional bootloaders and here's what I found:

1.50 (2.17.651.5)
- boots and flashes GB ROM's
- boots VM leak but not 2.89 kernel

1.50.5050 (Jbear GB)
- same as 1.50

1.57 (VM Leak)
- boots GB ROM's restored from nandroid
- flash of GB ROM results in boot loop
- flashes and boots ICS ROM's and kernels, including 2.89

1.57.5757 (Jbear ICS)
- same as 1.57

1.57, 1.57.5757 and 1.58 display the OpenADSP release.

ramjet73

Click to expand...

Click to collapse

ramjet73 said:

Based on the results of my earlier testing, it appears that you can restore a nandroid of a GB ROM flashed with 2.17 firmware and boot it using hboot 1.58 and the rest of the new firmware, but fresh installs of 2.17 based GB ROM's result in boot loops.

I just tested reverting back to the ENG 1.04 bootloader and flashed MeanROM GB 4.3 and it worked. I could flash, boot and run 4.3 using the ENG bootloader with the rest of the new (2.89) firmware installed, but it wouldn't boot if I reinstalled the 1.58 bootloader. I didn't test it, but suspect I would get the same results using the 1.4 and 1.5 bootloaders.

This means that if you you need to flash a GB ROM based on the 2.17 build, a temporary install of one of the older bootloaders should work to flash and run that ROM even with the rest of the new firmware installed. The bootloaders I used for my testing are attached to this post.

A tip for switching bootloaders is to restore or flash a ROM that you know will boot with either bootloader, such as MeanROM ICS with the VM leak kernel, before you flash the new bootloader. If you can't boot the installed ROM after flashing a different bootloader you will have to delete the PG86IMG.zip file in the root of the SD card on another device since there will be no way to boot directly into recovery after the new bootloader is flashed.

ramjet73

Click to expand...

Click to collapse

Sent from my "Up all night, Sleep all day" EVO3D!