[ROOT] ~~~ HTC EVO - Auto Root ~~~ v2.5 (4/25/11)(deprecated)

This tool is now deprecated. To root your Evo 4G running Gingerbread you will need to use the Revolutionary tool that can be found at http://www.revolutionary.io.

I'm sorry to do it but due to the ridiculous amount of people who are still asking for help rooting gingerbread, I will no longer be supporting this tool what so ever. Any further emails I receive about it will be deleted.

Click to expand...

Click to collapse

Click to expand...

Click to collapse

I am proud to present the HTC EVO Auto Root script! It took me awhile but I finally got it fully automated, it probably would have been easier using VB to write it but I wanted it to be readable by everybody. I don't have working scripts for Linux or Mac yet but for older phones you should be able to follow the Alternative Method and use the code included at the end of the post with minimal changes. If you are new to rooting the Evo you should check out the Rooting Information and Common Problems thread to familiarize yourself with some of the screens you will see. At times your phone may shows ominous looking icons that look bad but really aren't, at times like that it is important that you don't panic and do anything that could damage your phone.

This will make a backup of your WiMAX partition and the RSA keys that are stored on it; backing up your RSA keys separate is not necessary. It will save it in the AutoRoot folder so be sure not to delete it.

If you run into any problems please include the following information with your post: Any methods you have previously tried to root with, what it did last plus any error messages it may have given (if you can right click, select all and copy it from the terminal), and if you are in the bootloader we need to know what the top two lines say. Running this will create a log file named: autorootlog.txt. Please post this as well.

Any feedback no matter good or bad is appreciated! Let me know how it works for you.


Randy (randyshear on youtube) has made a great video of the process if you would like to get an idea of what to expect before hand. It is important to note that, depending on your phone, the process may be slightly more involved or require more or less time.
HTC EVO 4G ** ROOT AND NAND UNLOCK ** AUTOROOT V 2.2 ** HOW TO **



This has been confirmed working with:
Software versions 1.32, 1.36, 3.29, 3.30 & 3.70
hBoot Version .76, .93, .97, 2.02 & 2.10


Thanks go to
HTC for making the phone to begin with
Sebastian Khramer for his rageagainstthecage exploit
Toastcfh for his tutorial and all of his work on improving the Evo, a lot of this is borrowed from his previous work
Amon_RA for his recoveries and for his quick work creating a recovery compatible with the new NAND blocks
Calkulin for collecting all of the radios and update images
Whosdaman, Football and Sniper911 for sharing the RUUs with us
The Unrevoked Crew for all of their hard work on the Unrevoked Forever s-off tool
amoamare and Zikronix for all of their hard work on rooting phones with the 2.02 hboot
chris1683 for his Sprint Lovers ROM
Netarchy for all of the great kernels
A huge thanks goes out to Dan0412 who took the time to debug this for version 003 2.02 phones
Schnick1 and tauzins for their help with getting ADB to act right
Props go to RyanZA and anyone else who worked on the z4root app. I wouldn't have got 3.70 rooted as fast as I did if I didn't have their app to learn from.

You Will Need:

• A windows machine
• HTC Sync that can be found on Sprint's website. HTC Sync 2.0.35.exe
• At least 1 GB of free space on your SD card
• A full or close to full battery (your phone will not charge during part of this and if it dies you will be SOL, aka Bricked)
• ADB debugging enabled (Settings > Applications > Development > ADB Debugging)
• Your phone connected to your computer as Charge Only and HTC's Evo drivers / HTC Sync installed.
• The AutoRoot.zip File that can be found in this post
  
  [*]I highly recommend you have the appropriate RUU, or PC36IMG, downloaded before you start. It is always good to have and if something does not go as planned it can get your phone back up and running with minimal down time.

Click to expand...

Click to collapse

IF YOU HAVE PREVIOUSLY TRIED ROOTING YOU MUST RESTORE FROM A RUU BEFORE RUNNING THIS. IT WILL NOT ROOT IT UNLESS YOU DO THIS.

Instructions:

1. This will try to back up your apps but it's not always able to, you will also lose all of your settings. Titanium Backup works well to save your apps however you will need to use z4root to temporarily root before you will be able to use it.
   
   
2. Download HTC Sync from Sprint's website here and install it. You may need to use the 'Repair' option for it to replace any old drivers.
   
   
3. Extract AutoRoot.zip into a folder that is easy to find and then open the folder.
   
   
4. Right click on 'AutoRoot.bat' and run it as Administrator.
   
   
5. Once it finds your phone it will start by checking out what kind of setup it uses and then attempt to get root access. If it fails usually it's from too many active apps or the phone being used, if so you will need to restart it before trying again. If you are using 3.70 it will let you know when it is running by blurring the screen.
   
   
6. When it is ready it will reboot your phone into the boot loader. Then, depending on your phones setup, it will either enter RUU mode and automatically flash the debugging firmware or give you instructions on how to flash it from the hBoot.
   
   
7. If you have to flash it manually just push Power to select "BOOTLOADER" and say Yes when it asks to flash the PC36IMG.zip. It will complain part of the way through about Boot Loader and/or radio errors and then skip them, this is normal. Once it finishes say No when asked to reboot and use the Vol Down button to highlight Recovery. Then press Power to select it.
   
   
8. If you are entering the Recovery your phone will show a Red Triangle with an Exclamation mark inside, at this point the script will take back over and attempt to flash Unrevoked Forever.
   
   
9. After it finishes flashing the engineering bootloader, or Unrevoked Forever, it will reboot into the bootloader and see if your NAND is unlocked. If so it will flash the Sprint Lovers ROM along with the Recovery and updated Radios. Afterward it may boot into the ROM and attempt to restore your Apps before finishing, try not to interrupt it until it tells you it has finished.
   
   
10. Once it's fully rooted and you have your phone set back up it's a good idea to make one more NANDroid with everything up to date. Then make one more backup of your WiMAX partition in case something happens to the first one.

Click to expand...

Click to collapse

If you have an older phone and don't want to flash Unrevoked Forever or Sprint Lovers w/ the radio updates you can have it skip them. It will just flash the engineering bootloader to unlock the NAND and then flash the recovery directly from there. You will need to update everything and flash a custom ROM on your own. This will only work if your phone has a version .9x hBoot.

Instructions for Quick method:

1. This will completely wipe your phone. If you would like to back up your apps you can use Titanium backup to save them. It also has an option to save the system files but this can result in a buggy ROM afterward.
   
   
2. Extract AutoRoot.zip into a folder that is easy to find.
   
   
3. Open a DOS prompt by running the OpenShell file.
   
   
4. Type 'autoroot quick' and press Enter
   
   
5. It will then flash the engineering bootloader and the recovery through fastboot. Once it is finished you can use the bootloader menu to boot into the recovery and make a NANDroid, flash a ROM, radios, etc.

Click to expand...

Click to collapse

Links:

Downloads
AutoRoot v2.5 - Full Root Zip (MD5: 5E1BF365F3B5479329896BD55C33678E)
AutoRoot v2.5 - Tools Only (MD5: 5DBA70A8CDD052A9908E4F43D6BBC669)


The following are the ROMs pulled out of the RUUs, you can flash them by renaming and putting it on your sd card or from your computer with fastboot using the included FlashZip script.
Sprint Evos (USA):
3.29.651.5_PC36IMG.zip (MD5: 2F5046C0FC6FE61114EBC53D5997B485)
3.30.651.2_PC36IMG.zip (MD5: 4A2CAB264244C79B2E2BE9E3CFE2B503)
3.70.651.1_PC36IMG.zip (MD5: 7056D42812AA5DF03FCC8DDDC2B64E85)

KDDI Evos (Japan):
1.05.970.1_PC36IMG.zip (MD5: 78F9E8BFEE705F34790A46C258268F02)


Sources
How to unlock Nand Protection ~ Part-2
RA-evo-v1.8.0 (a modified version is included)
RUU to restore 3.29.651.5
RUU to restore 3.30.651.2
RUU to restore 3.70.651.1 (Thanks to 911Sniper for the original mirror)
Sprint Lovers ROM (a modified version is included)

Click to expand...

Click to collapse

Changes for v2.5

• Script now checks for Admin Priveledges and kills HTC Sync Services for Sync 3.05
• Fixed issue recognizing build numbers
• It will attempt to back up Apps now
• Checks branding in order to recognize KDDI Evos
• Unrevoked forever will now be retried if it doesn't get run the first try
• Changed it so it will leave the phones in Fastboot mode if it fails
• Recognizes ADB issues easier now

Changes for v2.4

• Updated the ROM and Recovery
• The working directory is now saved correctly when the path has a space in it
• Fixed an error checking the firmware version that would cause the script to close
• Made it more capable of recovering when the phone is in an unknown state
• Fixed the SD card not being recognized with Eclair
• Some parts will check for the 'daemon' error messages and will call to fix it
• Made it so the MTD data is not saved unless it is recognized
• The script will continue if it times out while waiting on Unrevoked Forever
• The WiMAX partition is backed up through the ROM at the very beginning instead of through the Recovery

Changes for v2.3:

• Updated the ROM, Recovery and Radios
• The script will now recognize your phone at any point in the process and will continue where it left off
• Fixed the FlashRecovery script and made it so you can choose what to flash, just put your PC36IMG of choice in the folder with it and let it do the work
• Fixed the version checker so it doesn't get confused with custom ROMs anymore
• Quick mode checks your hboot version from the ROM now so it won't even try if you have a new bootloader
• It is much more tenacious going into the recovery, hopefully fixing the issue with ADB dropping out there
• Fixed a bug where the MTD block sizes were not always being remembered correctly
• Added more checks to make sure the phone is where it's supposed to be throughout the process
• Made it try harder to get the recovery log so it doesn't get missed as much
• Tweaked the timing some so it moves a little bit quicker and you only have to hit a button twice to exit instead of three times
• Fixed the infinite loops so they are now 95% shorter

Changes for v2.2:

• Updated the recovery to Amon RA's version 2.2.1
• MTD information for each phone is saved in case it is restarted and unable to find out.
• Fixed a bug where pre 3.xx ROMs were not being recognized correctly.
• Phones are explicitly called by their serial number to prevent confusion if an emulator starts or another phone gets plugged in.
• Unresponsive ADB daemons are killed to help prevent them for hanging or randomly restarting.
• Changed autoroot.log to autorootlog.txt to make it easier to attach
• Minor bug fixes.

Changes for v2.1:

• Updated the recovery to Amon RA's version 2.2
• Minor bug fixes

Changes for v2.0:

• Added an app to give ADB root and keep it active in 3.70
• Updated Sprint Lovers and Amon RA
• Removed the two separate kernels/recoveries for new and old phones
• Added a battery life check before flashing
• Checks Firmware versions in both the ROM and hBoot
• Checks that the Misc partition was flashed properly
• Fixed all of the bugs with Quick root, it no longer flashes Sprint Lovers if you run it with S-OFF
• It automatically restarts adbd where it would occasionally reset itself and get hung up
• It also kills adbd when it finishes so you can move/delete it
• Changed the bat that restarted adbd so it kills it instead
• Added a bat to flash AmonRA through Fastboot with non-Eng hBoots
• Added a bat to open a Cmd prompt already in the autoroot folder
• Rewrote a good portion of the script and cleaned it up a lot
• Made it more flexible so it doesn't get lost as easily
• Plus more I forgot

Click to expand...

Click to collapse

Contents of v2.5 Include:

adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
AutoRoot.bat
check.bat
fastboot.exe
fastboot-linux
fastboot-mac
FindPhone.bat
FlashZip.bat
OpenShell.bat
StartRecovery.bat
amon_ra_1.8-mod/
res/
....AutoRoot.apk
....autoroot.ini
....dump_image
....Escalate.vbs
....Escalater.bat
....EscSC.lnk
....exploid.com
....FindPhone.bat
....flash_image
....ini.cmd
....mtd-eng.img
....PC36IMG_UD.zip
....PC36IMG_AmonRA-v2.3-hausmod_revA.zip
....PC36IMG-SprintLovers-AmonRA_2.3-hausmod_revA.zip
....radios.zip
....rageagainstthecage-arm5.bin
....recovery-RA-v2.3-hausmod_revA.img
....URFSOff.zip
....URFSOn.zip
....WatchPhone.bat

Notes:
Recovery is recovery-RA-supersonic-v2.3 with Netarchy's 4.3.2 CFS NoHAVS NoSBC NoUV
radios.zip is EVO_Radio_2.15.00.11.19_WiMAX_27167_R01_PRI_NV_1.90_003
URFSOff.zip is the Unrevoked Forever S-OFF tool
URFSOn.zip is the Unrevoked Forever S-ON tool

Click to expand...

Click to collapse

As always, this will void your warranty and may possibly damage your phone. You and you alone are responsible for anything that you do. Everything contained in this thread is for informational purposes only.

Click to expand...

Click to collapse

IMPORTANT: Everything contained in this post is meant for phones with the older bootloader. If you have hBoot version 2.02 or ROM version 3.30 you must use the above method.

Old Universal Root
(Scroll Down for Alternate Method)

You Will Need:

• A windows machine and basic knowledge of DOS or a Linux/Mac box with a little bit of determination
• At least 1 GB of free space on your SD card
• A full or close to full battery
• ADB debugging enabled (Settings > Applications > Development > ADB Debugging)
• Your phone connected to your computer as Charge Only
• The EVORoot.zip File that can be found in this post

Click to expand...

Click to collapse

Instructions:

1. Extract EVORoot.zip into a folder that is easy to find and go to that folder. Then copy the 'moveme' folder out of that one and on to your sdcard. Once it finishes copying unmount/eject the SD card through windows and change your phone back to Charge Only.
   
   
2. Double click on 'runexploit' and let it run. When it asks if you want to flash the hBoot push 'y' and then {enter}. If there are any errors follow the instructions given to try and resolve them. It will automatically reboot your phone once it is ready for it. If all you see is the prompt flashing press Ctrl+C or close the window to exit and re-run it as Administrator.
   
   
3. When the bootloader comes up push the Power button and you should see it start searching for updates. When it gets to PC36IMG.zip it will ask if you want to update with it, push Volume Up to say yes.
   *DO NOT TURN OFF THE PHONE OR LET THE BATTERY DIE WHILE UPDATING*
   When it's finished push the power button to select 'fastboot' and use the volume buttons to select the yellow 'reboot' button. Push power one more time to select it and reboot your phone. It should start up rooted and ready to go, however you will still need a custom Recovery so you can make NANDroid back-ups and flash an up to date ROM.
   
   
4. Once the phone starts back up run 'flashrecovery' through explorer. It will automatically flash and then reboot your phone into Amon_RA's recovery. When it reboots you should see green text on a black background, if you see a triangle with an exclamation mark then you still have the stock recovery and need to reboot and try again.
   
   
5. Use the volume buttons to select Backup/Restore then push Power to select it.
   
   
6. Select Nand backup and push power. This will make an exact copy of your phone as it is. If you get an error that says 'run mobile-nandroid...." make sure you have at least 3 or 400MB free on your memory card. You can use USB-MS toggle to mount your SD card if you need to make room or copy a ROM to your phone. The moveme folder can also be deleted from your SD card at this point and you can make copies or move the backup once it is complete. Just make sure you have one good backup before continuing.
   The NANDroids are saved under 'nandroid/??????????/backupfolder-date-time/'. The folders need to be moved whole.
   
   
7. Return to previous menu, select Wipe, then have it Wipe data/factory reset, Wipe cache & Wipe dalvik-cache. If you get stuck in a bootloop try these steps again and try wiping the SD:ext partition as well.
   
   
8. Return, then go in Flash zip from sdcard. Once there flash the Radios. It is again very important not to interrupt or reset the phone while the radios are being flashed, although it will probably want to reboot before flashing can be finalized, just follow the instructions.
   
   
9. Once it is finished Return to the previous menu and select Power Off. Then hold down the vol down button while turning the phone back on.
   
   
10. It will boot back up into the bootloader, select No if it asks to update or reboot. From here select Recovery and it should go back to the black background with green text.
    
    
11. Select Flash zip from sdcard and Flash ROM-Supersonic_3.30....zip. If you have a different ROM you want to use you can flash another one instead.
    
    
12. Once it is finished Return to the main menu and have it Reboot system. Your phone should start up normally and ask to be set up, complete the set up like normal.
    
    
13. When you have it set up and are sure everything is working properly I would make one more NANDroid so you have a copy with the updated radios. At this point you can also flash another recovery and do anything else you would normally do. Just be sure to use unrevoked forever if you plan on using a different hBoot.

Click to expand...

Click to collapse

Links:

Downloads
EVORoot.zip
EVORoot.zip - No bootloader, ROM or Radio updates
eng-PC36IMG.zip mirror 1, mirror 2

The following are the ROMs pulled out of the RUUs and renamed, make sure you use the correct version for your phone but if you aren't able to find out start with the 3.29.
3.29.651.5_PC36IMG.zip
3.30.651.2_PC36IMG.zip

If you are having trouble flashing custom ROMs try using this kernel (Thanks to xxbabiboi228xx)
Stock kernel #17

Sources
How to unlock Nand Protection ~ Part-2
All EVO Radio, WiMAX, PRI & NV versions
RA-evo-v1.8.0
RUU to restore 3.29.651.5
RUU to restore 3.30.651.2

Click to expand...

Click to collapse

Contents Include:

adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
exploid.com
flashboot.bat
flashrecovery.bat
runexploit.bat
moveme/
.....eng-PC36IMG.zip
.....evo_radios_wimax_pri_nv_3.30.zip
.....flash_image
.....mtd-eng.img
.....rageagainstthecage-arm5.bin
.....recovery-RA-evo-v1.8.0.img
.....SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip

Click to expand...

Click to collapse

Alternate method

If you already have the EVORoot.zip file you can download the scripts below without the boot/ROM/radio.

Instructions:

1. Extract EVORoot.zip into a folder that is easy to find such as C:\EVORoot. Then copy the 'moveme' folder out of that one and on to your sdcard.
   
   
2. Open up a DOS prompt and go to the EVORoot directory. eg. 'cd C:\EVORoot'.
   
   
3. type: runexploit {enter}
   It will scroll a few lines saying that the ADB server will be reset and to run it on the desktop, this is normal. If it says Permission Denied check to make sure your phone is set to charge only and your sd card is not mounted as a hard disk.
   
   
4. type: adb shell {enter}
   If you see '$' then type: "./data/local/tmp/rageagainstthecage-arm5.bin", without the quotation marks, and push enter. After a few seconds it should kick you out to the \> prompt.
   If you see '#' then type: exit {enter}
   
   
5. type: flashboot {enter}
   If you don't see any errors let it continue, if you do see an error push Ctrl+X to stop
   
   
6. Your phone will then reboot, when it comes back up the bootloader option should be highlight. Press the power button to select it. It should then search for a second and ask if you want to install the pc36img.zip, push Volume Up for Yes.
   *DO NOT TURN OFF THE PHONE OR LET THE BATTERY DIE WHILE UPDATING*
   When it's finished go into fastboot and select the yellow 'reboot' through the menu, it should start up rooted and ready to go however you will still need a custom Recovery so you can make NANDroid back-ups and flash an up to date ROM.
   
   
7. Once the phone starts up do step #4 to check for root (# prompt), if it is a '$' try typing 'su {enter}'. If that does not work use runexploit and then check again. Return to the DOS prompt once finished.
   
   
8. type: flashrecovery {enter}
   Let it continue as long as there are no errors, otherwise Ctrl+X will stop it. If you run this more than once you can ignore the file not found errors from when it first starts. When the phone reboots you should see green text on a black background, if you see a triangle with an exclamation mark then you still have the stock recovery.
   
   
9. Use the volume buttons to select Backup/Restore then push Power to select it.
   
   
10. Select Nand backup and push power. This will make an exact copy of your phone as it is. If you get an error that says 'run mobile-nandroid...." make sure you have at least 3 or 400MB free on your memory card. You can use USB-MS toggle to mount your SD card if you need to make room or copy a ROM to your phone. The moveme folder can also be deleted from your SD card at this point and you can make copies or move the backup once it is complete. Just make sure you have one good backup before continuing.
    The NANDroids are saved under 'nandroid/??????????/backupfolder-date-time/'. The folders need to be moved whole.
    
    
11. Return to previous menu, select Wipe, then have it Wipe data/factory reset, Wipe cache & Wipe dalvik-cache. If you get stuck in a bootloop try these steps again and try wiping the SD:ext partition as well.
    
    
12. Return, then go in Flash zip from sdcard. Select and Flash ROM-Supersonic_3.30....zip. If you have a different ROM you want to use you can flash that one instead.
    
    
13. Flash the Radios, it is again very important not to interrupt or reset the phone while the radios are being flashed. It will probably want to reboot itself afterward, just follow the instructions.
    
    
14. Once it is finished Return to the main menu and have it Reboot system. Your phone should start up normally and ask to be set up, complete the set up like normal.
    
    
15. Once you have it set up and are sure everything is working properly I would make one more NANDroid so you have a copy with the updated radios. At this point you can also flash another recovery and do anything else you would normally do. Just be sure to use unrevoked forever if you plan on using a different hBoot.

Click to expand...

Click to collapse

Links:

Downloads
EVORoot.zip
EVORoot.zip - No bootloader, ROM or Radio updates
eng-PC36IMG.zip mirror 1, mirror 2

Click to expand...

Click to collapse

Contents Include:

adb.exe
adb-linux
adb-mac
adbWinapi.dll
adbWinusbapi.dll
flashboot.bat
flashrecovery.bat
runexploit.bat
moveme/
.....eng-PC36IMG.zip
.....evo_radios_wimax_pri_nv_3.30.zip
.....flash_image
.....mtd-eng.img
.....rageagainstthecage-arm5.bin
.....recovery-RA-evo-v1.8.0.img
.....SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip


Batch Files

runexploit.bat

Code:

adb shell "cat /sdcard/moveme/rageagainstthecage-arm5.bin > /data/local/tmp/rageagainstthecage-arm5.bin"
adb shell "chmod 0755 /data/local/tmp/rageagainstthecage-arm5.bin"
adb shell "./data/local/tmp/rageagainstthecage-arm5.bin"

flashboot.bat

Code:

adb shell "cat /sdcard/moveme/flash_image > /data/flash_image"
adb shell "chmod 755 /data/flash_image"
adb shell "/data/flash_image misc /sdcard/moveme/mtd-eng.img"
adb shell "mv /sdcard/moveme/eng-pc36img.zip /sdcard/pc36img.zip"
adb shell sync
adb reboot bootloader

flashrecovery.bat

Code:

adb shell "mv /sdcard/PC36IMG.zip /sdcard/moveme/eng-PC36IMG.zip"
adb shell "mv /sdcard/moveme/evo_radio_wimax_pri_nv_3.30.zip /sdcard/evo_radio_wimax_pri_nv_3.30.zip"
adb shell "mv /sdcard/moveme/SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip /sdcard/ROM-SuperSonic_3.30.651.2_Rooted_BB_DeOdexed_Bash_ADP_BattPrcnt.zip"
adb shell "cat /sdcard/moveme/flash_image > /data/flash_image"
adb shell "chmod 755 /data/flash_image"
adb shell "/data/flash_image recovery /sdcard/moveme/recovery-RA-evo-v1.8.0.img"
adb shell sync
adb reboot recovery

Click to expand...

Click to collapse

This uses HTC's eng hBoot to unlock NAND protection so it is relatively safe, but, as always, this will void your warranty and may possibly damage your phone. You and you alone are responsible for anything that you do. This is for informational purposes only.

Click to expand...

Click to collapse

Well everyone, don't say I never did anything for the community. I had to rewrite the exploit to get it working normally again on the new software.

I should have an updated version up in a few hours.

I've had this tutorial and the auto_root file on my site for a while. For those that still need the original Auto_Root file you can find it at: http://www.darklome.com/2011/07/how-to-autoroot-evo-4g/

All credit goes to this post here. (I only copy good tutorials to my site if I use them myself incase something like this happens.... it's like my tutorial/files storage made public lol)

If this helped please hit Thanks!


P.S. - Click an Ad and help me out with hosting! lol. I also give space (ftp info) and a section on the site to any developers that want it... just msg me and we'll talk.

I was wondering that, too! Until I went back and read the first post. Near the bottom, there are several "RUU to Restore..." You need to pick the appropriate one from there--I'm now back in business.

And, since I'm a glutton for punishment... I'm going to try the root again!