Full HTC Desire HD (sense 3.0/android 2.3.5) guide to root, S-OFF/Sim Unlock

Search This thread

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
Need to see the rest of your session. Could be any of the following...
-downgrade failed,not on exploitable radio
-not on correct recovery
-need to reboot prior to entering the recovery
-maybe others

There are alot of small errors that can cause failure. I've prolly run thru it a dozen times

Sent from my HTC One using Tapatalk 2

no probem and thankyou. i have to go sleep been at it for hours i will start it from fresh tommorow and post the whole session for you. thanks for your help
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
No prollem :)


Sent from my HTC One using Tapatalk 2

ONE THING WHEI TYPE IN fastboot oem rebootRUU i get a htc logo appear do i wait or go to the next cmd? or is this the downgrade

C:\>Adb push boot.img /data/local/tmp
adb server is out of date. killing...
* daemon started successfully *
1432 KB/s (4194304 bytes in 2.859s)

C:\>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
8192+0 records in
8192+0 records out
4194304 bytes transferred in 0.578 secs (7256581 bytes/sec)

C:\>adb pull /data/local/tmp/boot.img
1608 KB/s (4194304 bytes in 2.546s)

C:\>adb push goldcard /data/local/tmp
601 KB/s (19240 bytes in 0.031s)

C:\>adb shell chmod 775 /data/local/tmp/goldcard

C:\>adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
0000004d532020201022900c3800c846

C:\>adb shell /data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o
ata/local/goldcard.img
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/

C:\>adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory

C:\>adb push misc_version /data/local/tmp
1325 KB/s (572752 bytes in 0.421s)

C:\>adb shell chmod 775 /data/local/tmp/misc_version

C:\>adb shell /data/local/tmp/misc_version -s 1.11.111.1
--set_version set. VERSION will be changed to: 1.11.111.1
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...

C:\>Fastboot oem lock
... INFOLock successfully...
FAILED (status read failed (Unknown error))
finished. total time: 0.594s

C:\>fastboot oem rebootRUU
... OKAY [ 0.234s]
finished. total time: 0.234s

C:\>fastboot flash zip firmware.zip
sending 'zip' (18223 KB)... OKAY [ 4.547s]
writing 'zip'... INFOadopting the signature contained in this i
mage...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 10.938s

C:\>fastboot reboot-bootloader
rebooting into bootloader... OKAY [ 0.172s]
finished. total time: 0.172s

C:\>fastboot flash unlocktoken Unlock_code.bin
sending 'unlocktoken' (0 KB)... OKAY [ 0.016s]
writing 'unlocktoken'... INFOunlock token check successfully
OKAY [ 0.000s]
finished. total time: 0.016s

C:\>fastboot flash boot boot.img
< waiting for device >
sending 'boot' (4096 KB)... INFOstart check_usb: usb_ep0: type=128, reques
t=6

OKAY [ 1.328s]
writing 'boot'... OKAY [ 0.578s]
finished. total time: 1.906s

C:\>fastboot flash recovery recovery.img
sending 'recovery' (4458 KB)... OKAY [ 1.063s]
writing 'recovery'... OKAY [ 0.656s]
finished. total time: 1.719s

C:\>adb push gfree /tmp/
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:

C:\>adb push gfree /tmp/
adb server is out of date. killing...
* daemon started successfully *
1882 KB/s (722728 bytes in 0.375s)

C:\>adb shell chmod 775 /tmp/gfree

C:\>adb shell /tmp/gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x00015398 (86936)
Section index for section name string table: 41
String table offset: 0x000151df (86495)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x000011cc (4556)
-- size: 0x000000c4 (196)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... Failed.
Module failed to power cycle eMMC.

C:\>
 
Last edited:

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
ONE THING WHEI TYPE IN fastboot oem rebootRUU i get a htc logo appear do i wait or go to the next cmd? or is this the downgrade

When you type that,it should boot you to a black screen with silver letters. This is RUU mode. Once you're on that screen,enter the fastboot flash zip firmware.zip command. You should see stuff flashing in the cmd window,and a green status bar on the phone.

Sent from my HTC PG09410 using Tapatalk 2

---------- Post added at 03:33 AM ---------- Previous post was at 03:27 AM ----------

From the session above,you didn't downgrade. The flash failed basically because your goldcard still failed,and your cid isn't compatible with the downgrade firmware.

There is a copy of the session here that may help: http://androidforums.com/showthread.php?t=702100 It shows what outputs you can expect from each command. :)


Sent from my HTC PG09410 using Tapatalk 2
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
When you type that,it should boot you to a black screen with silver letters. This is RUU mode. Once you're on that screen,enter the fastboot flash zip firmware.zip command. You should see stuff flashing in the cmd window,and a green status bar on the phone.

[/COLOR]From the session above,you didn't downgrade. The flash failed basically because your goldcard still failed,and your cid isn't compatible with the downgrade firmware.

There is a copy of the session here that may help: http://androidforums.com/showthread.php?t=702100 It shows what outputs you can expect from each command. :)


Did all this again from start problems seems to be when I flash the zip firmware I get the 42 error.



Sent from my HTC Desire HD A9191 using xda app-developers app
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
Error 41 or 42 indicate that you have not correctly made your gold card .

Sent from my ADR6425LVW using Tapatalk 2
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
Error 41 or 42 indicate that you have not correctly made your gold card .

Sent from my ADR6425LVW using Tapatalk 2

During the goldcard process it don't say errors so I move onto next step.

How do I fix this :confused:

I'm pretty screwd because I made a backup of Roms but they faild to generate md5 sums everytime. My recovery seems to choose what roms it wants to flash. I think the whole process of rooting has gone wrong somewere on my phone. Deffo recovery mode issues. :mad:

Sent from my HTC Desire HD A9191 using xda app-developers app
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
During the goldcard process it don't say errors so I move onto next step.

How do I fix this :confused:

I'm pretty screwd because I made a backup of Roms but they faild to generate md5 sums everytime. My recovery seems to choose what roms it wants to flash. I think the whole process of rooting has gone wrong somewere on my phone. Deffo recovery mode issues. :mad:

Sent from my HTC Desire HD A9191 using xda app-developers app

actually,you did have an error:
C:\>adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory

i had that same issue... for some reason i was unable to save,and refind,the gold card image in data/local/tmp,as per attn1's original instructions.

what i did was just store the image in data/local:

/data/local/tmp/goldcard -c <sd card cid above> -o /data/local/goldcard.img

and then:
dd if=/data/local/goldcard.img of=/dev/block/mmcblk1

if you took the first command from me,then the second from the guide here,that is likely the issue.use the above dd is you use my command for goldcard image- they are slightly different. if youre following the code here,just make sure youre cutting and pasting everything correctly,if you still have some unexplained errors,maybe try the guide on AF instead. they are basically the same,with a couple small tweeks,and a bit more instruction.
 
  • Like
Reactions: ykdr-scott

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
Hey man its finnaly worked thanks to your help. Appreciate it man.

Can finnaly flash roms without fastbooting now.

Thankyou so much :thumbup::)


flashed 4ext recovery seems fine but trying to back up my rom hangs on "generating md5 sums..."

Sent from my HTC Desire HD A9191 using xda app-developers app
 
Last edited:
  • Like
Reactions: scotty1223

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
Alex Fate said:
Dear scotty1223,

I've seen you had been very helpful in the thread
Full HTC Desire HD (sense 3.0/android 2.3.5) guide to root, S-OFF/Sim Unlock

I would be grateful if you could help me out with my issue too. Right now I have problems with step 6.
Here is my log (I have marked red the lines which can point at the problem):

c:\ace-tools>Adb shell
adb server is out of date. killing...
* daemon started successfully *
$ su
su
# exit
exit
$ exit
exit

c:\ace-tools>Adb push boot.img /data/local/tmp
adb server is out of date. killing...
* daemon started successfully *
1557 KB/s (4194304 bytes in 2.630s)

c:\ace-tools>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
adb server is out of date. killing...
ADB server didn't ACK
* failed to start daemon *
error:

c:\ace-tools>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
adb server is out of date. killing...
* daemon started successfully *
/dev/block/mmcblk0p22: cannot open for read: Permission denied

c:\ace-tools>


Can you please help me to solve this issue?
Thank You

looks like you are having the prollem described at the end of post #58... "adb shell" not granting superpuser permissions. you can try
adb shell su dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img

or just use the android forum guide,wich pulls the adb shell commands out and just enters the shell,runs commands,then exits. its a little more typing/copy-pasing,but you can see that the commands that need superuser access are executed at a #> prompt
 

markyboyWATP

Senior Member
Jun 2, 2013
52
0
Glasgow
4. Install recovery image:
Open cmd and type:
• cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.

In cmd:
• fastboot recovery1.img

Hi guys, was wondering if anyone would be kind enough to help me.

I get to step 4 ok, when i open CMD and type in C:\ace-tools, i then type in fastboot recovery1.img, then i get the following error :

C:\ace-tools>fastboot boot recovery1.img
'fastboot' is not recognized as an internal or external command,
operable program or batch file.

Would anyone be kind enough to try and help me?

Thanks in advance

Mark
 

androidmodd

Senior Member
Apr 3, 2011
78
61
Hi guys, was wondering if anyone would be kind enough to help me.

I get to step 4 ok, when i open CMD and type in C:\ace-tools, i then type in fastboot recovery1.img, then i get the following error :

C:\ace-tools>fastboot boot recovery1.img
'fastboot' is not recognized as an internal or external command,
operable program or batch file.

Would anyone be kind enough to try and help me?

Thanks in advance

Mark

1 is there a folder called ace-tools in your C drive.

2 on your phone did you go to boot loader--->fast boot?
 
  • Like
Reactions: markyboyWATP

Steam.

Senior Member
Jun 7, 2012
1,070
255
Skopje
1 is there a folder called ace-tools in your C drive.

2 on your phone did you go to boot loader--->fast boot?

now that you're here, you might want to edit the 1st post cause you have an extra space in this command

take note of the string of numbers and letters that appear.
then:
• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img

the bit between local and tmp at the bolded part.

---------- Post added at 10:01 PM ---------- Previous post was at 10:00 PM ----------

Hi guys, was wondering if anyone would be kind enough to help me.

I get to step 4 ok, when i open CMD and type in C:\ace-tools, i then type in fastboot recovery1.img, then i get the following error :

C:\ace-tools>fastboot boot recovery1.img
'fastboot' is not recognized as an internal or external command,
operable program or batch file.

Would anyone be kind enough to try and help me?

Thanks in advance

Mark

try fastboot.exe boot recovery1.img
 
  • Like
Reactions: markyboyWATP

markyboyWATP

Senior Member
Jun 2, 2013
52
0
Glasgow
1 is there a folder called ace-tools in your C drive.

2 on your phone did you go to boot loader--->fast boot?

Hi there thanks for the reply

Yes there is a folder on my C drive called ace-tools

ss_zps011a1b60.jpg


Yes on my phone i am in FASTBOOT, i know this becuase on my phone it says in red FASTBOOT USB

Thanks for the help, much appreciated

Mark

---------- Post added at 09:15 PM ---------- Previous post was at 09:13 PM ----------

try fastboot.exe boot recovery1.img

Thanks very much, this seems to have worked so far :)

Will see how it goes from here.

Thanks again mate

Mark
 

androidmodd

Senior Member
Apr 3, 2011
78
61
Read the end part of steams post above.


Also steam I updated the first post, if there's anything else I should add on there or edit please tell me :)

Thanks.
 
  • Like
Reactions: markyboyWATP

markyboyWATP

Senior Member
Jun 2, 2013
52
0
Glasgow
Ignore my previous post :eek:

Very sorry but i made a NOOB error lol, i for got to insert my SD card into the phone lol

You would think after flashing dozens of ROMs on my Wildfire i wouldnt have done this lol

Mark
 

hacktrix2006

Senior Member
Jan 15, 2011
1,681
567
Thanks OP for putting the heads up from me but really no need for thanks it should be common knowledge by now that If your phone was pre-installed with Gingerbread it was not safe to use it. As most phone with froyo seemed to of had the buggy EMMC chip in it. I say that as the phone i got came with 2.3.5 GB and that had the none bugged EMMC chip.

Also the AAHK is no longer supported and people should bare that in mind if you do not know what your dealing with or you prob the EMMC you have and its the dreaded one do not continue its purely that simple.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 50
    Aahk2 is out please use that method instead, fully automated and much easier :) :

    http://xdaforums.com/showthread.php?t=2367322





    Warning thanks to hacktrix2006:
    Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.

    If you have SEM04G EMMC then your safe to continue.

    If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.

    Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.

    THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.

    PREFACE:

    Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87

    Full HTC Desire HD guide to root, S-OFF/Sim Unlock



    1.Unlock the bootloader at http://htcdev.com/bootloader/
    2.Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.

    step 2.2: reboot into fastboot
    step 2.3: execute in cmd-prompt "fastboot flash unlocktoken Unlock_code.bin"

    3.Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
    (link to rom thread: http://xdaforums.com/showthread.php?t=1382235&highlight=rooted+stock )
    step 3.2 Make a effen GOLDCARD!!!
    3.3 copy the ROM zip file to your SD card.

    4.Install recovery image:
    Open cmd and type:
    •cd (eg cd C:\ace-tools)
    Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.

    In cmd:
    •fastboot flash recovery recovery1.img

    5.boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
    6.Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
    •Adb shell
    •Su
    You should see the $ turn into a #. If this happens, congrats you have root access.
    Then type this:
    •Exit
    Then again:
    •Exit
    Then:
    •Adb push boot.img /data/local/tmp
    •adb shell
    root
    dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    •adb pull /data/local/tmp/boot.img
    •adb push goldcard /data/local/tmp
    •adb shell
    root
    chmod 775 /data/local/tmp/goldcard
    •adb shell
    root
    cat /sys/class/mmc_host/mmc2/mmc2:*/cid
    take note of the string of numbers and letters that appear.
    then:
    •adb shell /data/local/tmp/goldcard -c -o /data/local/tmp/goldcard.img

    •adb shell
    root
    dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
    •adb push misc_version /data/local/tmp
    •adb shell chmod 775 /data/local/tmp/misc_version
    •adb shell /data/local/tmp/misc_version -s 1.11.111.1



    7.If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    •Fastboot oem lock
    Then type:
    •fastboot oem rebootRUU
    •fastboot flash zip firmware.zip
    •fastboot reboot-bootloader
    unlock the bootloader again using the Unlock_code.bin you got from HTC:
    •fastboot flash unlocktoken Unlock_code.bin
    then flash boot.img in ace-tools folder:
    •fastboot flash boot boot.img
    next:
    •fastboot flash recovery recovery.img
    8.boot to recovery again then:
    •adb push gfree /tmp/
    •adb shell chmod 775 /tmp/gfree
    •adb shell /tmp/gfree -f
    reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.

    VICTORY:
    abzdoXeu.jpg

    fr_494.jpg

    I have also posted this over at modaco:
    http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
    4
    Guide worked for me!!!!!

    Hi all, reporting back my experience with this guide...

    Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)

    I basically followed this guide with a few little needed changes.

    1st I backed up my rom using 4ext recovery.

    1. same
    2. same
    3. same

    4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).

    5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).

    5a. reboot into recovery and flashed rom

    6. there was a typo in the line
    "• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
    there is an extra space between local & /tmp/ at the end of line, the command line should read
    • adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"

    7. If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    • Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
    Then type:
    • fastboot oem rebootRUU

    everything else was good....

    My Hboot screen is the same as OP screen shot.

    I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.

    I pretty sure that's all, I hope this helps.

    I probably won't ever update this.

    THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.

    PREFACE:

    Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87

    Full HTC Desire HD guide to root, S-OFF/Sim Unlock



    1. Unlock the bootloader at http://htcdev.com/bootloader/
    2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.

    3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
    (link to rom thread: http://xdaforums.com/showthread.php?t=1382235&highlight=rooted+stock )
    copy the ROM zip file to your SD card.

    4. Install recovery image:
    Open cmd and type:
    • cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
    Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.

    In cmd:
    • fastboot recovery1.img
    5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
    6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
    • Adb shell
    • Su
    You should see the $ turn into a #. If this happens, congrats you have root access.
    Then type this:
    • Exit
    Then again:
    • Exit
    Then:
    • Adb push boot.img /data/local/tmp
    • adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    • adb pull /data/local/tmp/boot.img
    • adb push goldcard /data/local/tmp
    • adb shell chmod 775 /data/local/tmp/goldcard
    • adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
    take note of the string of numbers and letters that appear.
    then:
    • adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
    • adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
    • adb push misc_version /data/local/tmp
    • adb shell chmod 775 /data/local/tmp/misc_version
    • adb shell /data/local/tmp/misc_version -s 1.11.111.1



    7. If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    • Fastboot oem lock
    Then type:
    • fastboot oem rebootRUU
    • fastboot flash zip firmware.zip
    • fastboot reboot-bootloader
    unlock the bootloader again using the Unlock_code.bin you got from HTC:
    • fastboot flash unlocktoken Unlock_code.bin
    then flash boot.img in ace-tools folder:
    • fastboot flash boot boot.img
    next:
    • fastboot flash recovery recovery.img
    8. boot to recovery again then:
    • adb push gfree /tmp/
    • adb shell chmod 775 /tmp/gfree
    • adb shell /tmp/gfree -f
    reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.

    VICTORY:
    abzdoXeu.jpg

    View attachment 1858622

    I have also posted this over at modaco:
    http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/

    help me out if you feel like it :) by signing up to dropbox with my refferal link:
    Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
    3
    Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.

    If you have SEM04G EMMC then your safe to continue.

    If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.

    Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.

    Trust me this tutorial works.
    2
    it does not, at least for me. i don't know exactly if i'm simlocked, but i hang on this step:

    c:\ace-tools>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    /dev/block/mmcblk0p22: cannot open for read: Permission denied

    but i know that my hd is rooted, and i was able to install the pre-rooted rom.

    i come from stock hboot, and stock 3.12. firmware.


    EDIT: first try, then post. it helped when i type in:

    adb shell
    su

    and afterwards

    dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img

    EDIT2: had to do it always when it said "permission denied"

    but at the last operation, i get this error:
    /tmp/gfree -f
    --secu_flag off set
    --cid set. CID will be changed to: 11111111
    --sim_unlock. SIMLOCK will be removed
    Section header entry size: 40
    Number of section headers: 44
    Total section header table size: 1760
    Section header file offset: 0x00015398 (86936)
    Section index for section name string table: 41
    String table offset: 0x000151df (86495)
    Searching for .modinfo section...
    - Section[16]: .modinfo
    -- offset: 0x000011cc (4556)
    -- size: 0x000000c4 (196)
    Kernel release: 2.6.32.21
    New .modinfo section size: 196
    Attempting to power cycle eMMC... Failed. (Not fatal)
    Module tried to power cycle eMMC, but could not verify write-protect status.
    Searching for mmc_blk_issue_rq symbol...
    - Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
    Kernel map base: 0xc02db000
    Kernel memory mapped to 0x40002000
    Searching for brq filter...
    - Address: 0xc02db21c + 0x34c
    - ***WARNING***: Found fuzzy match for brq filter, but conditional branch isn't
    . (0xea000012)
    Backing up current partition 7 and patching it...
    Error reading input file.

    EDIT3: i gave up this method and tried AAHK2 instead. (got it from a german forum, google aahk2 v 1.75) my mistake was that i had to relock the bootloader to downgrade from 3.12 to 2.x in order to get s-off.... :) now i'm finally on 2.5

    EDIT4: the only difference to the screenshots in post #1 is that i'm on hboot v 0.85.2425... but s-off, yay
    2
    Hi all, reporting back my experience with this guide...

    Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)

    I basically followed this guide with a few little needed changes.

    1st I backed up my rom using 4ext recovery.

    1. same
    2. same
    3. same

    4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).

    5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).

    5a. reboot into recovery and flashed rom

    6. there was a typo in the line
    "•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
    there is an extra space between local & /tmp/ at the end of line, the command line should read
    •adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"

    7.If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    •Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
    Then type:
    •fastboot oem rebootRUU

    everything else was good....

    My Hboot screen is the same as OP screen shot.

    I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.

    I pretty sure that's all, I hope this helps.

    Thanks, ill update first post again.