Unrevoked team: Incredible Root process
I will add more to this as we get further, thanks go to the Unrevoked devteam!
While this method is now public, we are working on other methods still, but this will be useful to folks in the meantime. While we still do not understand the first adbd race entirely, we do know that there are some key differences in system timing seemingly from sdcard (mmc1), wifi (uses mmc0), and emmc (uses mmc2). If frustrated you may try doing things to change your setup.
<6>[ 5.326202] mmc1: Slot status change detected (0 -> 1)
...Bluetooth and wifi begin to load...
<6>[ 5.481384] mmc1: new high speed SD card at address ff0e
<6>[ 5.490112] warning: `adbd' uses 32-bit capabilities (legacy support in use)
<6>[ 5.491027] mmcblk1: mmc1:ff0e SD02G 1.83 GiB
That is what a good dmesg will look like. please do a dmesg in android (not recovery) and see where you find those similar strings in yours. notice the numbers, 5.49 seconds is when adbd started roughly, a sd read was toggled at about the same time as you see, this means you win! Please look at yours and calculate how long a delay your sd card needs... then reseat it and try to hit that window...
NOTE: SD card choice seems to be a important factor in whether you get adb in recovery, in general the slower and crummier the card, the better.
The key is getting adb working in recovery. There is as of yet no easy way. reboot recovery, or reboot bootloader and go into recovery. try try try again...
To explain the method a little, there are 2 races here. It would be wise not to update any further if you get this, as they will most certain plug both our holes here. But in general the first race is in recoveries starting. It starts adbd, but also stops it. If for whatever reason the start takes longer than the stop, we win. The second race should be obvious looking at the instructions, but in short it verifies the real OTA update, while we swap it with a special one...