Full HTC Desire HD (sense 3.0/android 2.3.5) guide to root, S-OFF/Sim Unlock

Search This thread
Confusing.

Try to follow there original guide http://tau.shadowchild.nl/attn1/?cat=6

You have to use the recovery in the ace tools or it won't work!

ok so did use the recovery came with the tools. but no dice... i still need help

thanks for your help for some reason RUU is not being flashed or some like that man this is soo annoying...

________________________________
HTC Desire HD
Sabsa Prime 16

You have to use the recovery in the ace tools or it won't work!

ok so did use the recovery came with the tools. but no dice... i still need help

thanks for your help for some reason RUU is not being flashed or some like that man this is soo annoying...
 

aljazirrr

Senior Member
Sep 26, 2012
393
201
Castellon
I get this today with aahk :thumbup::thumbup::);):beer:

Sent from my HTC Desire HD using xda premium
 

Attachments

  • uploadfromtaptalk1367445719878.jpg
    uploadfromtaptalk1367445719878.jpg
    105.7 KB · Views: 614

TheJurgenp1

Member
Mar 27, 2013
30
6
I thought aahk was retired and therefor did no longer work

Sent from my Desire HD using xda app-developers app
 
need professional help.

C:\Users\Smoke\Desktop\Root Stuff\ace-tools>fastboot getvar all
INFOversion: 0.5
INFOversion-bootloader: 2.00.0029
INFOversion-baseband: 26.14.04.28_M
INFOversion-cpld: None
INFOversion-microp: 0438
INFOversion-main: 3.13.0.0
INFOserialno: HT12PTZ00951
INFOimei: 35576104025****
INFOproduct: ace
INFOplatform: HBOOT-7230
INFOmodelid: PD9814000
INFOcidnum: TELUS001
INFObattery-status: good
INFObattery-voltage: 4194mV
INFOpartition-layout: Generic
INFOsecurity: on
INFObuild-mode: SHIP
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: fcef1579
INFOhbootpreupdate: 11
INFOgencheckpt: 0
INFOregion-id: 0
all: Done!
finished. total time: 0.032s

i have been gettin those FAILED(remote: 43 main version check fail)
i need the right RUU please suggest
and cant get off s-off i need help please stuck with this issue for 3 days now..

any help is appreciated.
 
Last edited:

zerozerocool

Member
Sep 4, 2009
6
0
hi guys..
been trying to s-off...
somehow failed at step 7..

D:\ace-tools>fastboot flash zip firmware.zip
sending 'zip' (18223 KB)... OKAY [ 3.113s]
writing 'zip'... INFOadopting the signature contained in this image...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 11.884s

D:\ace-tools>

using recovery image from this link http://xdaforums.com/showthread.php?t=2169515
try to flash recovery in ace tools yet failed...
anybody had any idea with part got problem..
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056

shingers5

Inactive Recognized Contributor
amazing stuff man
all commands worked beautifully
always remember guide doesnt always say to go back to fastboot like after locking or unlocking bootloader but its obvious you may need to do a bettery pull. these steps are so simple and by copy and paste commands its even simpler :laugh:

thank you so much
 

masChmagic

Member
Jul 16, 2007
47
1
VICTORY!!

THank you!

Although I messed up at this part, I didn't know this is when you wre supposed to install the SDcard into the phone. The SDcard was still in my computer:
• adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
 

androidmodd

Senior Member
Apr 3, 2011
78
61

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
Typo at the end of section4...
The command should be:

fastboot boot recovery1.img

Actually,it should prolly be:

Fastboot flash recovery recovery1.img

Since the following directions say to enter recovery from hboot.

Fastboot boot will launch the image,not permanently install it in the recovery partition.

Sent from my HTC One using Tapatalk 2
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
help please

so im following these instructions and it seems the problem im facing is the goldcard.img there is no goldcard.img only gold card. how do i find or get the gldcard.img ( if thats my problem ) heres a log of this..


C:\>fastboot flash recovery recovery.img
sending 'recovery' (4458 KB)... OKAY [ 0.875s]
writing 'recovery'... OKAY [ 0.828s]
finished. total time: 1.703s

C:\>Adb shell
adb server is out of date. killing...
* daemon started successfully *
# su
su
# exit
exit
# exit
exit

C:\>Adb push boot.img /data/local/tmp
1424 KB/s (4194304 bytes in 2.875s)

C:\>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
8192+0 records in
8192+0 records out
4194304 bytes transferred in 0.549 secs (7639897 bytes/sec)

C:\>adb pull /data/local/tmp/boot.img
1618 KB/s (4194304 bytes in 2.531s)

C:\>adb push goldcard /data/local/tmp
240 KB/s (19240 bytes in 0.078s)

C:\>adb shell chmod 775 /data/local/tmp/goldcard

C:\>adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
02544d534430324732ab62c18900846e

C:\>adb shell /data/local/tmp/goldcard -c02544d534430324732ab62c18900846e-o /
a/local /tmp/goldcard.img
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/

Usage: /data/local/tmp/goldcard -c <sdcardid> [-r] -o <outputfile>
Options:
-h This help menu.
-c <sdcardid> Specify the SD Card Serial ID (required).
-r Specifies that <sdcardid> is already reversed.
-o <outputfile> Specify the output file (required).


C:\>adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
so im following these instructions and it seems the problem im facing is the goldcard.img there is no goldcard.img only gold card. how do i find or get the gldcard.img ( if thats my problem ) heres a log of this..



C:\>adb shell /data/local/tmp/goldcard -c02544d534430324732ab62c18900846e-o /
a/local /tmp/goldcard.img

the prollem is your command. you need spaces between the -c and cid,and cid and -0:

/data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o /data/local/goldcard.img
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
the prollem is your command. you need spaces between the -c and cid,and cid and -0:

/data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o /data/local/goldcard.img


tried that still no joy


C:\>Adb push boot.img /data/local/tmp
adb server is out of date. killing...
* daemon started successfully *
787 KB/s (4194304 bytes in 5.203s)

C:\>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
8192+0 records in
8192+0 records out
4194304 bytes transferred in 0.623 secs (6732430 bytes/sec)

C:\>adb pull /data/local/tmp/boot.img
1202 KB/s (4194304 bytes in 3.406s)

C:\>adb push goldcard /data/local/tmp
42 KB/s (19240 bytes in 0.437s)

C:\>adb shell chmod 775 /data/local/tmp/goldcard

C:\>adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
0000004d532020201022900c3800c846

C:\>adb shell /data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o
ata/local/goldcard.img
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/

C:\>adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
tried that still no joy

your command still is missing characters.

C:\>adb shell /data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o
ata/local/goldcard.img
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/

your command:
C:\>adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
/data/local/tmp/goldcard.img: cannot open for read: No such file or directory

proper command:
adb shell /data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o
ata/local/goldcard.img

looks like youre having issues typing,or copy/pasting.

/data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o /data/local/goldcard.img

one other thing you need to watch for,is that including "adb shell" in the command,that the rest is actually getting su access. some times you need to enter adb shell su blah blah blah
 

ykdr-scott

Senior Member
May 27, 2013
270
40
birmingham
the prollem is your command. you need spaces between the -c and cid,and cid and -0:

/data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o /data/local/goldcard.img

tried that still no joy

your command still is missing characters.



proper command:
adb shell /data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o
ata/local/goldcard.img

looks like youre having issues typing,or copy/pasting.

/data/local/tmp/goldcard -c 02544d534430324732ab62c18900846e -o /data/local/goldcard.img

one other thing you need to watch for,is that including "adb shell" in the command,that the rest is actually getting su access. some times you need to enter adb shell su blah blah blah




okay looks like final stages is failing now

C:\>adb shell /tmp/gfree -f
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x00015398 (86936)
Section index for section name string table: 41
String table offset: 0x000151df (86495)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x000011cc (4556)
-- size: 0x000000c4 (196)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... Failed.
Module failed to power cycle eMMC.

C:\>fastboot rebbot bootloader
usage: fastboot [ <option> ] <command>
 

scotty1223

Inactive Recognized Contributor
Jan 3, 2011
2,813
3,056
Need to see the rest of your session. Could be any of the following...
-downgrade failed,not on exploitable radio
-not on correct recovery
-need to reboot prior to entering the recovery
-maybe others

There are alot of small errors that can cause failure. I've prolly run thru it a dozen times

Sent from my HTC One using Tapatalk 2
 

Top Liked Posts

  • There are no posts matching your filters.
  • 50
    Aahk2 is out please use that method instead, fully automated and much easier :) :

    http://xdaforums.com/showthread.php?t=2367322





    Warning thanks to hacktrix2006:
    Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.

    If you have SEM04G EMMC then your safe to continue.

    If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.

    Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.

    THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.

    PREFACE:

    Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87

    Full HTC Desire HD guide to root, S-OFF/Sim Unlock



    1.Unlock the bootloader at http://htcdev.com/bootloader/
    2.Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.

    step 2.2: reboot into fastboot
    step 2.3: execute in cmd-prompt "fastboot flash unlocktoken Unlock_code.bin"

    3.Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
    (link to rom thread: http://xdaforums.com/showthread.php?t=1382235&highlight=rooted+stock )
    step 3.2 Make a effen GOLDCARD!!!
    3.3 copy the ROM zip file to your SD card.

    4.Install recovery image:
    Open cmd and type:
    •cd (eg cd C:\ace-tools)
    Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.

    In cmd:
    •fastboot flash recovery recovery1.img

    5.boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
    6.Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
    •Adb shell
    •Su
    You should see the $ turn into a #. If this happens, congrats you have root access.
    Then type this:
    •Exit
    Then again:
    •Exit
    Then:
    •Adb push boot.img /data/local/tmp
    •adb shell
    root
    dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    •adb pull /data/local/tmp/boot.img
    •adb push goldcard /data/local/tmp
    •adb shell
    root
    chmod 775 /data/local/tmp/goldcard
    •adb shell
    root
    cat /sys/class/mmc_host/mmc2/mmc2:*/cid
    take note of the string of numbers and letters that appear.
    then:
    •adb shell /data/local/tmp/goldcard -c -o /data/local/tmp/goldcard.img

    •adb shell
    root
    dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
    •adb push misc_version /data/local/tmp
    •adb shell chmod 775 /data/local/tmp/misc_version
    •adb shell /data/local/tmp/misc_version -s 1.11.111.1



    7.If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    •Fastboot oem lock
    Then type:
    •fastboot oem rebootRUU
    •fastboot flash zip firmware.zip
    •fastboot reboot-bootloader
    unlock the bootloader again using the Unlock_code.bin you got from HTC:
    •fastboot flash unlocktoken Unlock_code.bin
    then flash boot.img in ace-tools folder:
    •fastboot flash boot boot.img
    next:
    •fastboot flash recovery recovery.img
    8.boot to recovery again then:
    •adb push gfree /tmp/
    •adb shell chmod 775 /tmp/gfree
    •adb shell /tmp/gfree -f
    reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.

    VICTORY:
    abzdoXeu.jpg

    fr_494.jpg

    I have also posted this over at modaco:
    http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/
    4
    Guide worked for me!!!!!

    Hi all, reporting back my experience with this guide...

    Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)

    I basically followed this guide with a few little needed changes.

    1st I backed up my rom using 4ext recovery.

    1. same
    2. same
    3. same

    4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).

    5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).

    5a. reboot into recovery and flashed rom

    6. there was a typo in the line
    "• adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
    there is an extra space between local & /tmp/ at the end of line, the command line should read
    • adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"

    7. If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    • Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
    Then type:
    • fastboot oem rebootRUU

    everything else was good....

    My Hboot screen is the same as OP screen shot.

    I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.

    I pretty sure that's all, I hope this helps.

    I probably won't ever update this.

    THIS GUIDE IS MAINLY this guide (http://tau.shadowchild.nl/attn1/?cat=6) SIMPLIFIED TO SOME EXTENT. with parts that werent included in the guide added to the guide and resources added to the ace-tools folder that would have to be downloaded separately.

    PREFACE:

    Download this and unzip it somewhere (reccommend C:\ root folder): http://www.multiupload.nl/MXW371YT87

    Full HTC Desire HD guide to root, S-OFF/Sim Unlock



    1. Unlock the bootloader at http://htcdev.com/bootloader/
    2. Copy your Unlock_code.bin file that you got in the email to the ace-tools folder.

    3. Download rooted stock rom: http://www.multiupload.nl/20T9R21IGY
    (link to rom thread: http://xdaforums.com/showthread.php?t=1382235&highlight=rooted+stock )
    copy the ROM zip file to your SD card.

    4. Install recovery image:
    Open cmd and type:
    • cd <the directory of the ace-tools folder> (eg cd C:\ace-tools)
    Ensure your phone is connected to your PC and then boot into bootloader, then navigate to fastboot.

    In cmd:
    • fastboot recovery1.img
    5. boot into recovery through bootloader and Install the ROM you placed on the SD card, (via install zip fileselect the rom zip)
    6. Reboot the phone, ensure the rom is working fine and you have root access you can test this by turning on usb debugging then:
    • Adb shell
    • Su
    You should see the $ turn into a #. If this happens, congrats you have root access.
    Then type this:
    • Exit
    Then again:
    • Exit
    Then:
    • Adb push boot.img /data/local/tmp
    • adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    • adb pull /data/local/tmp/boot.img
    • adb push goldcard /data/local/tmp
    • adb shell chmod 775 /data/local/tmp/goldcard
    • adb shell cat /sys/class/mmc_host/mmc2/mmc2:*/cid
    take note of the string of numbers and letters that appear.
    then:
    • adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img
    • adb shell dd if=/data/local/tmp/goldcard.img of=/dev/block/mmcblk1
    • adb push misc_version /data/local/tmp
    • adb shell chmod 775 /data/local/tmp/misc_version
    • adb shell /data/local/tmp/misc_version -s 1.11.111.1



    7. If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    • Fastboot oem lock
    Then type:
    • fastboot oem rebootRUU
    • fastboot flash zip firmware.zip
    • fastboot reboot-bootloader
    unlock the bootloader again using the Unlock_code.bin you got from HTC:
    • fastboot flash unlocktoken Unlock_code.bin
    then flash boot.img in ace-tools folder:
    • fastboot flash boot boot.img
    next:
    • fastboot flash recovery recovery.img
    8. boot to recovery again then:
    • adb push gfree /tmp/
    • adb shell chmod 775 /tmp/gfree
    • adb shell /tmp/gfree -f
    reboot to bootloader and you should see it says S-OFF at the top of the screen, if It does congrats your done.

    VICTORY:
    abzdoXeu.jpg

    View attachment 1858622

    I have also posted this over at modaco:
    http://www.modaco.com/topic/361797-...-30android-235-guide-to-root-s-offsim-unlock/

    help me out if you feel like it :) by signing up to dropbox with my refferal link:
    Always have your stuff when you need it with @Dropbox. Sign up for free! http://db.tt/G8qfL77X
    3
    Also before anyone continues make sure you run cat /proc/kmsg | grep 'mmc0:0001' If you have a M4G2DE EMMC stop do no use clockworkmod recovery or even try to root as you will fry your EMMC.

    If you have SEM04G EMMC then your safe to continue.

    If your using the PD98IMG.zip from the retired AAHK just remember its no longer support.

    Personally i would use the firmware.zip file from the tutorial which is included in the http://tau.shadowchild.nl/files/ace-tools.zip its safer that way just remember to backup your boot.img as its important if you want to boot back into sense 3.0.

    Trust me this tutorial works.
    2
    it does not, at least for me. i don't know exactly if i'm simlocked, but i hang on this step:

    c:\ace-tools>adb shell dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img
    /dev/block/mmcblk0p22: cannot open for read: Permission denied

    but i know that my hd is rooted, and i was able to install the pre-rooted rom.

    i come from stock hboot, and stock 3.12. firmware.


    EDIT: first try, then post. it helped when i type in:

    adb shell
    su

    and afterwards

    dd if=/dev/block/mmcblk0p22 of=/data/local/tmp/boot.img

    EDIT2: had to do it always when it said "permission denied"

    but at the last operation, i get this error:
    /tmp/gfree -f
    --secu_flag off set
    --cid set. CID will be changed to: 11111111
    --sim_unlock. SIMLOCK will be removed
    Section header entry size: 40
    Number of section headers: 44
    Total section header table size: 1760
    Section header file offset: 0x00015398 (86936)
    Section index for section name string table: 41
    String table offset: 0x000151df (86495)
    Searching for .modinfo section...
    - Section[16]: .modinfo
    -- offset: 0x000011cc (4556)
    -- size: 0x000000c4 (196)
    Kernel release: 2.6.32.21
    New .modinfo section size: 196
    Attempting to power cycle eMMC... Failed. (Not fatal)
    Module tried to power cycle eMMC, but could not verify write-protect status.
    Searching for mmc_blk_issue_rq symbol...
    - Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
    Kernel map base: 0xc02db000
    Kernel memory mapped to 0x40002000
    Searching for brq filter...
    - Address: 0xc02db21c + 0x34c
    - ***WARNING***: Found fuzzy match for brq filter, but conditional branch isn't
    . (0xea000012)
    Backing up current partition 7 and patching it...
    Error reading input file.

    EDIT3: i gave up this method and tried AAHK2 instead. (got it from a german forum, google aahk2 v 1.75) my mistake was that i had to relock the bootloader to downgrade from 3.12 to 2.x in order to get s-off.... :) now i'm finally on 2.5

    EDIT4: the only difference to the screenshots in post #1 is that i'm on hboot v 0.85.2425... but s-off, yay
    2
    Hi all, reporting back my experience with this guide...

    Prior to using this guide, I was already HTCDEV unlocked, rooted and custom rom (SVHD V1.3.0)

    I basically followed this guide with a few little needed changes.

    1st I backed up my rom using 4ext recovery.

    1. same
    2. same
    3. same

    4. There was no file named "recovery1.img" in ace-tools, so I just flashed the "recovery.img" (If you already have custom recovery flashed, I don't think you need to do this step but I did it anyway).

    5. Because I was already on custom rom with different kernel (boot.img) than stock (rooted) rom, before I reboot into recovery, I extracted boot.img from stock rooted zip downloaded from the link and flashed it from fastboot (if you don't do this your rom may not boot).

    5a. reboot into recovery and flashed rom

    6. there was a typo in the line
    "•adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local /tmp/goldcard.img"
    there is an extra space between local & /tmp/ at the end of line, the command line should read
    •adb shell /data/local/tmp/goldcard -c <string of numbers and letters should go here> -o /data/local/tmp/goldcard.img"

    7.If this is all fine boot into bootloader again.
    From bootloader go to fastboot.
    Go back to the cmd window on your PC from earlier, type in:
    •Fastboot oem lock<------ phone rebooted itself after this command so needed to go back to bootloader fastboot (I did a quick battery pull)
    Then type:
    •fastboot oem rebootRUU

    everything else was good....

    My Hboot screen is the same as OP screen shot.

    I reflashed the 4ext recovery I previously had, then did a system restore of my backup and booted into SVHD with out a hitch.

    I pretty sure that's all, I hope this helps.

    Thanks, ill update first post again.