[ROOT][GUIDE] HBoot 2.02/2.10 SOFF - Goodbye Stranger - Upd. 02.25.11

Search This thread

zikronix

Senior Member
Feb 7, 2009
1,308
208
I am sad to say the time has come to retire this post....Now before you get all panicky and ****, just sit your **** down, take your adderall and relax, damn antsy ass people. Anywho, with people our there like xHausx and others that have automated all of this there really isnt a need for me to keep this updated. I will keep the post here for archival purposes but, I will not be updating it, any further. I may pop into the thread here and there but probably not. I would like to thank all those that helped and supported me during this threads run. With out you we would still be stuck.

In the mean time if your looking to root your phone, check out xHausx's thread
here: http://xdaforums.com/showthread.php?t=838448

And no I still dont recommend Clockwork or Unrevoked.

Till next time...Super Tramp - Goodbye Stranger





Archive of the guide as of 2/14/11

READ THIS GUIDE CAREFULLY SEE POST TWO FOR FAQ OR SEARCH THE THREAD.
Presenting the ONE AND ONLY surefire root method that backs up your RSA KEYS prior to rooting !!!!

Also I am aware that unrevoked has out their new tool. However while I was sitting in IRC, I saw many that it wasnt working for. So Until there is a surefire, easy method, I will keep this thread updated.

Credit goes to:
amoamare (Initial method)
toast (fake recovery and script)
unrevoked (thanks for your app)
amon_ra (fixed custom recovery)
chris1683 (thanks for the rom) (sprintlovers)
ryanza (z4root)
illogos, epicroot, xHausx, TrevE, Chubbzlou (Testing)
BooDaddy (RSA Backup Info)

and who ever else I missed

Help me finance my Vette!
zikronix


Disclaimer and well a little fun:
This has been tested on many phones and it worked fine...but if it breaks your **** dont come cry to me about it...you knew the risks! No one here is responsible if you break, brick, set fire, punch, smash, stab, destroy, your self, computer or your phone. The only person responsible is you! Just because it worked for me and others does not mean it will for you. Anytime you flash something its a risk.

Ladies and gentlemen... I've traveled over half our forum to be here tonight. I couldn't get away sooner because I had a POST coming in and I had to see about it. That phone is now rooted at and running well. I have two others comming in and this method has rooted many on the board. So, ladies and gentlemen... if I say my guide works you will agree. You have a great chance here, but bear in mind, you can lose it all if you're not careful.
Out of all methods that beg for a chance to root your phone, maybe one in twenty will work; the rest will be trolls-that's posters trying to get between you and the guide-to get some of the root action that ought by rights come to you. Even if you find one that has a simpler guide, and means to root, he'll maybe know nothing about helping. This is... the way that this works. This method is reliable like no other in this field and that's because its been tested and tested time and time again. I assure you, whatever the others promise to do, when it comes to the showdown, they won't be there...



Downloads
================================================== ====
STOP HERE READ THIS

This Method soley uses Amon_RA Recoveries....Period. A poor soul that lost his RSA keys (broken 4g forever) by recent clock work shenanaigans here

VX - Updated Amon Ra Recovery. Download Here: hboot_2.xx_soff-VX.zip
MD5: 27eb4a36ba01078193975fc93723dd60
<---VERIFY YOUR MD5, IF ITS NOT THIS REDOWNLOAD

Lets Get Rooted!
======================================================


Prerequsites:

Extract only the main zip file to a folder of your choice. I recommend the root of C:\ into a folder of your choice or on the desktop. Make sure you have the drivers installed for your phone (recommended: SDK Drivers or unrevoked hboot drivers) and USB debugging is on. This was setup for people running windows, if you have access to it do it on a 32bit version. I can't stress this enough you must use the adb.exe included with the package This is command line based do NOT double click the exe. Assume nothing, and cut and paste or type the commands EXACTLY as listed, they are case sensitive and each line is a seperate command. Oh and Read the FAQ and Warnings for f-sakes

1) Connect your phone to the computer (Rear USB Port Perferred) make sure the computer detects the phone (DO NOT MOUNT USB) If it doesnt install the drivers. Now master Reset your Phone (Menu>settings>Sd & Phone Storage>Factory Data Reset). Your phone will reboot. While your phone is rebooting it ctrl+alt+delete on your computer and open up task manager and click the processes tab look for anything that says adb.exe click it and hit end process.

2) Your phone should be booted and in the rom. You can skip the setup. On your phone enable install applications from unknown sources.(menu>settings>applications>unknown sources) and turn on usb debugging.

3) Open a command prompt (do NOT click adb.exe) and change to where ever you extracted the files to.

4)Type the following (this must be excuted from the folder you extracted to)

adb push root/unrevoked-forever.zip /sdcard/
adb push root/mtd-eng.img /sdcard/
adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip
adb push root/flash_image /data/local/

5) Now were gonna install z4root. When its done look at your phone z4root should be running. Select temporary root... It will go thru the process will eventually come to a white screen *Wait* after a sec or so screen will come up saying temp root was a success. Ok so now type the following

adb -d install -r root/z4root.apk
adb shell am start -a android.intent.action.MAIN -n com.z4mod.z4root/com.z4mod.z4root.z4root

6) Your command should still be open and you should be in the directory where you extracted the files. Once you have typed "su" command below look at your phone and click allow for SuperUser...Ok so now type the following from the command prompt


6A) REQUIRED RSA BACKUP This will back up your RSA keys just in case something goes wrong in that department. You should still be in your command window inside the shell with a #. (The following came from this thread)

mkdir -p /sdcard/nandroid/RSA-PR-BACKUP
cat /dev/mtd/mtd0 > /sdcard/nandroid/RSA-PR-BACKUP/wimax.img

This saves it in a file that can actually be restored. This next step is another type of backup just for good measure

busybox sed -n '/BEGIN CERTIFICATE/,$p' /dev/mtd/mtd0 > /sdcard/rsa_OEM.key

This will dump the RSA keys to a text file on your SD Card named rsa_OEM.key
Mine was about 4575 KB in size, but the size could vary. Go ahead and switch the phone's USB connection over to "Disk Drive" and then browse to your SD Card and verify that the file rsa_OEM.key is indeed on the card.

Proceed to Step 7

7) You Should still be at a "#". This means you have root if you see a "$" or some other error message. Reboot your phone, check your drivers, usb debugging and cable and start over. If you got a "#" You can Proceed. You should still be in the shell at a "#" If not start over...Otherwise

chmod 0755 /data/local/flash_image
./data/local/flash_image misc /sdcard/mtd-eng.img
sync

8) Now we are going to reboot your phone into the boot loader to flash the first PC36IMG.zip. You should still be in the shell So Type:


9) Once your phone is in the boot loader highlight bootloader, and press the power button. It will load the PC36IMG File...When it ask you to flash press VOL-UP. You will notice that it says bootloader bypassed and maybe some other errors. Dont worry this is normal. Once the flash of the file is done it will ask to reboot, Select NO by Pressing VOL-DOWN. Now some people have gotten some errors here and there during the flashing just continue as normal.

10) You should still be in the boot loader at this point. Scroll down to recovery and press the power button. It Should take you to a red triangle. If not and you get stuck at a white htc screen pull the battery and then repower the phone with power + vol down and select recovery. When you see the red triangle. Type the following (IF YOU GET STUCK HERE CHECK THE FAQ):

adb push recovery /
adb shell busybox --install /sbin
adb shell nohup /sbin/recovery &

With any luck you should be at a recovery (green screen with text)

11) Select enable USB-MS. This will mount your sdcard. Look in the root of your sdcard and you should have two files. One named PC36IMG.zip and one named PC36IMG-MR.zip. Rename the file named PC36IMG.zip to PC36IMG-ENG.zip and then rename PC36IMG-MR.zip to PC36IMG.zip when your done follow the instructions on your phone to disable usb (press power) then proceed to step 12

12) Now Select flash zip from the menu and choose unrevoked-forever.zip. Wait for it to complete. Select Reboot from the menu.

Now pay attention. It might kick you back into:

BOOT LOADER: See 12A
ROM: See 12B
WHITE HTC SCREEN: See 12C

12A) Ok so you got kicked to the boot loader. It should scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

12B) Ok so the phone booted into a rom. Power the phone off. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

12C) Ok so the phone is stuck at a white htc screen. Power the phone off by pulling the battery. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

13) Ok your phone is rooted now, and you should be inside the rom. The rom you just flashed is Sprint Lovers rom with the modified recovery. Download a rom of your choice copy it to the root of your sd card and flash it. But type the following first

adb shell mv /sdcard/PC36IMG.zip /sdcard/PC36IMG-MR.zip
adb reboot recovery

14) You Should be in the recovery menu now (green text screen). Do a backup by navigating to backup/restore press power to select then do a Nand backup in the next menu. Once thats done, select return, then reboot or flash a rom of your choice. If you flashed a different custom rom than the one thats included in the package cool. If not no big deal eitherway. Do a PRL/Profile update while in the rom after the phone is done rebooting. Your Done.

15) Read the FAQ for questions


==========================================
FIX BROKEN RECOVERY
This is really only needed if you rooted with one of the previos guides version 6 or lower or if you installed a different recovery like I told you not to. It installs amon_ra 2.2.1

1) Download File PC36IMG_Recovery.zip and Rename to PC36IMG.zip.
copy to the root of your SDCard and power off phone

2) Power your phone back on into the boot loader by holding power and vol-down until your presented with a white screen. It will read the pc36img.zip and as you if you want to flash. Say yes. Then it will ask if you want to reboot, VOL+UP for yes.

3) If your rom gets tossed in the process. Reboot your phone into bootloader select recovery, and reflash your rom....DONE

================================================
UNROOT GUIDE
NOTE: This will erase all data on the phone. (Will not erase data on the SDCard)

1) If your on Hboot 2.10 Download the PC36IMG.zip Here. If your on Hboot 2.02 Download the PC36IMG.zip here then Unrevoked s-on here rename the pc36img file to pc36img.zip copy that and the unrevoked s-on tool to the root of your sd

2) Power your off. Power the Phone back on into the boot loader by holding power and vol-down until your presented with a white screen.

3) It will scan for the pc36img.zip. Select no to flash. Select recovery from the menu. Once in recovery choose flash zip from the menu, and select unrevoked forever s-on.

4) When its done flashing select reboot from the menu.

5) From here either run the official ruu or boot back into the boot loader (see step 2). When it scans and ask you to flash the pc36img.zip select yes then yes to reboot.
 
Last edited:

zikronix

Senior Member
Feb 7, 2009
1,308
208
FAQ

FAQ:

Your here cause something went wrong right? Ok thats fine. This list isnt extensive but its here to provide quick answers to some weird or common questions. New questions and problems are added to the bottom.

Q: Will this downgrade my hboot
A: No. I used to have an hboot downgrade but it was bricking peoples phones. However is you want to risk bricking your device, visit this thread here. I I advise against this. This bricked alot of phones which is why I pulled it.

Q: How do I install the Hboot Drivers
A: Check this here

Q: I get "error: more than one device and emulator"
A: kill the adb.exe tasks in task manager or reboot your computer

Q: Step #9 my phone does read the PC36IMg.zip
A: If you renamed the zip file make sure it doesn't say PC36IMG.zip in the name remember that xp and up on windows doesn't show the file ext by default so if you see PC36IMG.zip chances are its named PC36IMG.zip.zip

Q: Why cant I use Clockwork Recovery
A: At the moment its not coded for the new partitions. Just read the first few pages of this thread or check this here

Q: What Hardware does this work for
A: All currently known hardware 0001-0004

Q: What Hboot's does this work for
A: It was built for 2.02 and 2.10 however it will work for all version its just there are easier ways for those

Q: I think I messed up can I just start over.
A: Yes. Its recommended if you want to start over run the official ruu.

Q: This is very complicated
A: It is...thats why there is instructions

Q: Will this erase my data
A: Yes but not from the SDCARD

Q: Can I deleted the files off my SDCARD when done
A: Yes, except for RSA_OEM.KEY and WIMAX.IMG

Q: I get permission denied or device offline when trying to step 10
A: Check here or here or here this might work for you

Q: I used clockwork it seems to work fine.
A: It might but considering the partition information is not correct. You may have just over wrote your wimax keys and broke 4G. Have fun with that like this poor guy here

Q: This uses unrevoked in one of its steps? Explain?
A: There have been some concerns that this uses unrevoked-forever in one of its steps. As far as we know that Unrevoked 3 (not to be conufused with unrevoked-forever) is causing some radio issues with hardware in general and new hardware. Unrevoked-forever does not appear to bork the radio like unrevoked 3 does. This is apparent by the many success stories. However Unrevoked3 could very well possibly destroy your radio/wimax/brick if used.

Q: I get device not found
A: Install the drivers for your phone, (Unrevoked, ADB)

Q: Camera doesnt work after doing this
A: Flash a new rom thats current. Like SteelRom, Fresh, Stock Rooted. The issue here is the Hardware is different. NO CUSTOM KERNELS

A2: Reports say they changed the camera provider/hardware. And the drivers are different! Using a rom based off the latest release and kernel should fix it As Discussed here and here and here

Q: When I go to recovery. I get a red triangle.
A: See Step 10

Q: This doesnt work!
A: Yes it does if you follow the directions, Unless some other bull**** decided to popup!

Q: CM6.x doesnt work
A: See Question 7....Nothing I can do about that if the kernel doesnt support your camera/device.

Q: My phone boot loops now...You broke my ****!
A: I didnt break your ****. You broke your own ****! Its not broken so chill out (well it might be but probably not). What rom did you flash? Did you flash a custom kernel? Did your rom come with a custom kernel? I bet your using a custom kernel. Try a rom like Steel Rom, Sprint Lovers

Q: How do I back up my RSA Keys
A: Check here for the latest up to date information. Or run this command from the shell

cat /dev/mtd/mtd0 > /sdcard/wimax.img

Q: My 4g Doesnt work
A: Was it broken prior to the s-off, what steps did you take. Are you running AOSP ROM or Another kernel?, Did you try a different rom? What version is your phone? Do you have SwitchPro Widget installed? (uninstall it), Did you try to run unrevoked3 prior to this? After flashing the radios and stock kernel based rom did you do a data and prl update? Does the mac behind your battery match whats in about phone (4g has to be on to see mac) Also try the tree.xml fix posted

adb shell
ls /data/misc/wimax/

look for a file with your macaddress ending in .tree.xml. you want to move that to another location so it gets regenerated. (the following command basically renames it.)

mv /data/misc/wimax/(Your-mac-address).tree.xml /data/misc/wimax/(Your-mac-address).tree.xml.old

4. Start 4G may not connect
5. Do a prl/profile update
6. Power off the phone and power it back on. Try it
7. PRL/Profile. Try it

Q: 4G is still broke.
A: Check your RSA keys

adb shell
cat /dev/mtd/mtd0 | grep RSA

returned output show appear as this:
# cat /dev/mtd/mtd0 | busybox grep RSA
cat mtd0 | busybox grep RSA
RSA-REQUEST
RSA-REPLY
RSA-REJECT
RSA-ACK
RSA-1024
RSA-REQUEST
RSA-REPLY
RSA-REJECT
RSA-ACK
RSA-1024
RSA
ReRSA
RSA requests
RSA replies
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
#

It should look just like the above
the important lines are BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY.
If you have those two lines, your keys are still likely to be intact.
If those two lines are missing, your keys are likely missing.

/dev/mtd/mtd0 is where the wimax image is stored.

Q: OK I think My Keys are tossed. We made a backup right? So how do I restore it?
A: This post or post should do it for you

Q: My Phone says its not rooted.
A: If you have s-off your rooted. Simple as that. Try a different rom if you want. The second pc36img.zip file you flashed is Sprint Lovers and is a very nice rooted rom.

Q: When I try to get into Fastboot by pressing VOLUME UP and booting the phone, my phone instead buzzes three times and acts dead. What happened?
A: The S-OFF update also enables Qualcomm Diagnostics mode on your phone, which is entered by doing what you just did. You can exit this mode (and boot normally) by removing the battery and USB cable.


Q: Can you tell me what this does?
A: Read the guide? Basically your downgrading the phone, so you can flash unrevoked because htc "comically fixed" the phone. Then your re upgrading the phone back to shipping radios, system, pri, nv, kernel...all the while with keeping s-off

Q: How did you get to be so cool
A: If you have it, you don’t need it. If you need it, you don’t have it. If you have it, you need more of it. If you have more of it, you don’t need less of it. You need it to get it. And you certainly need it to get more of it. But if you already don’t have any of it to begin with, you can’t get any of it to get started. Which means you really have no idea how to get it in the first place, do you? You can share it, sure. You can even stockpile it if you like. But you can’t fake it. Wanting it, needing it, wishing for it. The point is, if you’ve never had any of it, ever, people just seem to know.

Q: Do you really own a vette?
A: Yes, and a backpack with jets!

Q: Whats with you and the dots ...
A: ...

Q: Your Kind of an Cocky Asshole
A: Yea...I Get that. Oh well. I cant fix stupid or ignorant.
 
Last edited:

abiezer

Senior Member
Feb 7, 2009
266
53
Miami
Oh I see so this is basically for people who couldn't root to be able to root. Got it. Thanks.
 

shepkc

Member
Oct 14, 2008
49
0
Dumb question, sorry trying to keep up with this while at work. Once I do this, then I still need to run Unrevoked, correct?
 

zikronix

Senior Member
Feb 7, 2009
1,308
208
its working for some but not others...i dont know why the main version is older thing...
 

llontop.m

Senior Member
Nov 2, 2010
65
2
Fort Eustis, VA
Confirmed, V2 works

alright brotha your v2 of the batch file works like a charm. S-OFF confirmed on HBOOT 2.02. Thanks to everyone involved in making this happen.
 

b0r0b

Senior Member
Jun 12, 2009
53
5
On a brand new fresh 2.2 out of the box running HBOOT 2.02 I got "Main version is older". Are there any prerequisites i have to run to get this to work? I just reinstalled 2.2 and ran the script and got main version is older.
 
Last edited:

bigboyd75

Member
Jun 19, 2007
7
0
Main version is older

I have also tried with V2 and get the "Main version is older".

Baseband
2.15.00.09.01

Software
3.30.651.2

PRL
60671
 

Top Liked Posts

  • There are no posts matching your filters.
  • 112
    I am sad to say the time has come to retire this post....Now before you get all panicky and ****, just sit your **** down, take your adderall and relax, damn antsy ass people. Anywho, with people our there like xHausx and others that have automated all of this there really isnt a need for me to keep this updated. I will keep the post here for archival purposes but, I will not be updating it, any further. I may pop into the thread here and there but probably not. I would like to thank all those that helped and supported me during this threads run. With out you we would still be stuck.

    In the mean time if your looking to root your phone, check out xHausx's thread
    here: http://xdaforums.com/showthread.php?t=838448

    And no I still dont recommend Clockwork or Unrevoked.

    Till next time...Super Tramp - Goodbye Stranger





    Archive of the guide as of 2/14/11

    READ THIS GUIDE CAREFULLY SEE POST TWO FOR FAQ OR SEARCH THE THREAD.
    Presenting the ONE AND ONLY surefire root method that backs up your RSA KEYS prior to rooting !!!!

    Also I am aware that unrevoked has out their new tool. However while I was sitting in IRC, I saw many that it wasnt working for. So Until there is a surefire, easy method, I will keep this thread updated.

    Credit goes to:
    amoamare (Initial method)
    toast (fake recovery and script)
    unrevoked (thanks for your app)
    amon_ra (fixed custom recovery)
    chris1683 (thanks for the rom) (sprintlovers)
    ryanza (z4root)
    illogos, epicroot, xHausx, TrevE, Chubbzlou (Testing)
    BooDaddy (RSA Backup Info)

    and who ever else I missed

    Help me finance my Vette!
    zikronix


    Disclaimer and well a little fun:
    This has been tested on many phones and it worked fine...but if it breaks your **** dont come cry to me about it...you knew the risks! No one here is responsible if you break, brick, set fire, punch, smash, stab, destroy, your self, computer or your phone. The only person responsible is you! Just because it worked for me and others does not mean it will for you. Anytime you flash something its a risk.

    Ladies and gentlemen... I've traveled over half our forum to be here tonight. I couldn't get away sooner because I had a POST coming in and I had to see about it. That phone is now rooted at and running well. I have two others comming in and this method has rooted many on the board. So, ladies and gentlemen... if I say my guide works you will agree. You have a great chance here, but bear in mind, you can lose it all if you're not careful.
    Out of all methods that beg for a chance to root your phone, maybe one in twenty will work; the rest will be trolls-that's posters trying to get between you and the guide-to get some of the root action that ought by rights come to you. Even if you find one that has a simpler guide, and means to root, he'll maybe know nothing about helping. This is... the way that this works. This method is reliable like no other in this field and that's because its been tested and tested time and time again. I assure you, whatever the others promise to do, when it comes to the showdown, they won't be there...



    Downloads
    ================================================== ====
    STOP HERE READ THIS

    This Method soley uses Amon_RA Recoveries....Period. A poor soul that lost his RSA keys (broken 4g forever) by recent clock work shenanaigans here

    VX - Updated Amon Ra Recovery. Download Here: hboot_2.xx_soff-VX.zip
    MD5: 27eb4a36ba01078193975fc93723dd60
    <---VERIFY YOUR MD5, IF ITS NOT THIS REDOWNLOAD

    Lets Get Rooted!
    ======================================================


    Prerequsites:

    Extract only the main zip file to a folder of your choice. I recommend the root of C:\ into a folder of your choice or on the desktop. Make sure you have the drivers installed for your phone (recommended: SDK Drivers or unrevoked hboot drivers) and USB debugging is on. This was setup for people running windows, if you have access to it do it on a 32bit version. I can't stress this enough you must use the adb.exe included with the package This is command line based do NOT double click the exe. Assume nothing, and cut and paste or type the commands EXACTLY as listed, they are case sensitive and each line is a seperate command. Oh and Read the FAQ and Warnings for f-sakes

    1) Connect your phone to the computer (Rear USB Port Perferred) make sure the computer detects the phone (DO NOT MOUNT USB) If it doesnt install the drivers. Now master Reset your Phone (Menu>settings>Sd & Phone Storage>Factory Data Reset). Your phone will reboot. While your phone is rebooting it ctrl+alt+delete on your computer and open up task manager and click the processes tab look for anything that says adb.exe click it and hit end process.

    2) Your phone should be booted and in the rom. You can skip the setup. On your phone enable install applications from unknown sources.(menu>settings>applications>unknown sources) and turn on usb debugging.

    3) Open a command prompt (do NOT click adb.exe) and change to where ever you extracted the files to.

    4)Type the following (this must be excuted from the folder you extracted to)

    adb push root/unrevoked-forever.zip /sdcard/
    adb push root/mtd-eng.img /sdcard/
    adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
    adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip
    adb push root/flash_image /data/local/

    5) Now were gonna install z4root. When its done look at your phone z4root should be running. Select temporary root... It will go thru the process will eventually come to a white screen *Wait* after a sec or so screen will come up saying temp root was a success. Ok so now type the following

    adb -d install -r root/z4root.apk
    adb shell am start -a android.intent.action.MAIN -n com.z4mod.z4root/com.z4mod.z4root.z4root

    6) Your command should still be open and you should be in the directory where you extracted the files. Once you have typed "su" command below look at your phone and click allow for SuperUser...Ok so now type the following from the command prompt


    6A) REQUIRED RSA BACKUP This will back up your RSA keys just in case something goes wrong in that department. You should still be in your command window inside the shell with a #. (The following came from this thread)

    mkdir -p /sdcard/nandroid/RSA-PR-BACKUP
    cat /dev/mtd/mtd0 > /sdcard/nandroid/RSA-PR-BACKUP/wimax.img

    This saves it in a file that can actually be restored. This next step is another type of backup just for good measure

    busybox sed -n '/BEGIN CERTIFICATE/,$p' /dev/mtd/mtd0 > /sdcard/rsa_OEM.key

    This will dump the RSA keys to a text file on your SD Card named rsa_OEM.key
    Mine was about 4575 KB in size, but the size could vary. Go ahead and switch the phone's USB connection over to "Disk Drive" and then browse to your SD Card and verify that the file rsa_OEM.key is indeed on the card.

    Proceed to Step 7

    7) You Should still be at a "#". This means you have root if you see a "$" or some other error message. Reboot your phone, check your drivers, usb debugging and cable and start over. If you got a "#" You can Proceed. You should still be in the shell at a "#" If not start over...Otherwise

    chmod 0755 /data/local/flash_image
    ./data/local/flash_image misc /sdcard/mtd-eng.img
    sync

    8) Now we are going to reboot your phone into the boot loader to flash the first PC36IMG.zip. You should still be in the shell So Type:


    9) Once your phone is in the boot loader highlight bootloader, and press the power button. It will load the PC36IMG File...When it ask you to flash press VOL-UP. You will notice that it says bootloader bypassed and maybe some other errors. Dont worry this is normal. Once the flash of the file is done it will ask to reboot, Select NO by Pressing VOL-DOWN. Now some people have gotten some errors here and there during the flashing just continue as normal.

    10) You should still be in the boot loader at this point. Scroll down to recovery and press the power button. It Should take you to a red triangle. If not and you get stuck at a white htc screen pull the battery and then repower the phone with power + vol down and select recovery. When you see the red triangle. Type the following (IF YOU GET STUCK HERE CHECK THE FAQ):

    adb push recovery /
    adb shell busybox --install /sbin
    adb shell nohup /sbin/recovery &

    With any luck you should be at a recovery (green screen with text)

    11) Select enable USB-MS. This will mount your sdcard. Look in the root of your sdcard and you should have two files. One named PC36IMG.zip and one named PC36IMG-MR.zip. Rename the file named PC36IMG.zip to PC36IMG-ENG.zip and then rename PC36IMG-MR.zip to PC36IMG.zip when your done follow the instructions on your phone to disable usb (press power) then proceed to step 12

    12) Now Select flash zip from the menu and choose unrevoked-forever.zip. Wait for it to complete. Select Reboot from the menu.

    Now pay attention. It might kick you back into:

    BOOT LOADER: See 12A
    ROM: See 12B
    WHITE HTC SCREEN: See 12C

    12A) Ok so you got kicked to the boot loader. It should scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    12B) Ok so the phone booted into a rom. Power the phone off. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    12C) Ok so the phone is stuck at a white htc screen. Power the phone off by pulling the battery. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    13) Ok your phone is rooted now, and you should be inside the rom. The rom you just flashed is Sprint Lovers rom with the modified recovery. Download a rom of your choice copy it to the root of your sd card and flash it. But type the following first

    adb shell mv /sdcard/PC36IMG.zip /sdcard/PC36IMG-MR.zip
    adb reboot recovery

    14) You Should be in the recovery menu now (green text screen). Do a backup by navigating to backup/restore press power to select then do a Nand backup in the next menu. Once thats done, select return, then reboot or flash a rom of your choice. If you flashed a different custom rom than the one thats included in the package cool. If not no big deal eitherway. Do a PRL/Profile update while in the rom after the phone is done rebooting. Your Done.

    15) Read the FAQ for questions


    ==========================================
    FIX BROKEN RECOVERY
    This is really only needed if you rooted with one of the previos guides version 6 or lower or if you installed a different recovery like I told you not to. It installs amon_ra 2.2.1

    1) Download File PC36IMG_Recovery.zip and Rename to PC36IMG.zip.
    copy to the root of your SDCard and power off phone

    2) Power your phone back on into the boot loader by holding power and vol-down until your presented with a white screen. It will read the pc36img.zip and as you if you want to flash. Say yes. Then it will ask if you want to reboot, VOL+UP for yes.

    3) If your rom gets tossed in the process. Reboot your phone into bootloader select recovery, and reflash your rom....DONE

    ================================================
    UNROOT GUIDE
    NOTE: This will erase all data on the phone. (Will not erase data on the SDCard)

    1) If your on Hboot 2.10 Download the PC36IMG.zip Here. If your on Hboot 2.02 Download the PC36IMG.zip here then Unrevoked s-on here rename the pc36img file to pc36img.zip copy that and the unrevoked s-on tool to the root of your sd

    2) Power your off. Power the Phone back on into the boot loader by holding power and vol-down until your presented with a white screen.

    3) It will scan for the pc36img.zip. Select no to flash. Select recovery from the menu. Once in recovery choose flash zip from the menu, and select unrevoked forever s-on.

    4) When its done flashing select reboot from the menu.

    5) From here either run the official ruu or boot back into the boot loader (see step 2). When it scans and ask you to flash the pc36img.zip select yes then yes to reboot.
    18
    FAQ

    FAQ:

    Your here cause something went wrong right? Ok thats fine. This list isnt extensive but its here to provide quick answers to some weird or common questions. New questions and problems are added to the bottom.

    Q: Will this downgrade my hboot
    A: No. I used to have an hboot downgrade but it was bricking peoples phones. However is you want to risk bricking your device, visit this thread here. I I advise against this. This bricked alot of phones which is why I pulled it.

    Q: How do I install the Hboot Drivers
    A: Check this here

    Q: I get "error: more than one device and emulator"
    A: kill the adb.exe tasks in task manager or reboot your computer

    Q: Step #9 my phone does read the PC36IMg.zip
    A: If you renamed the zip file make sure it doesn't say PC36IMG.zip in the name remember that xp and up on windows doesn't show the file ext by default so if you see PC36IMG.zip chances are its named PC36IMG.zip.zip

    Q: Why cant I use Clockwork Recovery
    A: At the moment its not coded for the new partitions. Just read the first few pages of this thread or check this here

    Q: What Hardware does this work for
    A: All currently known hardware 0001-0004

    Q: What Hboot's does this work for
    A: It was built for 2.02 and 2.10 however it will work for all version its just there are easier ways for those

    Q: I think I messed up can I just start over.
    A: Yes. Its recommended if you want to start over run the official ruu.

    Q: This is very complicated
    A: It is...thats why there is instructions

    Q: Will this erase my data
    A: Yes but not from the SDCARD

    Q: Can I deleted the files off my SDCARD when done
    A: Yes, except for RSA_OEM.KEY and WIMAX.IMG

    Q: I get permission denied or device offline when trying to step 10
    A: Check here or here or here this might work for you

    Q: I used clockwork it seems to work fine.
    A: It might but considering the partition information is not correct. You may have just over wrote your wimax keys and broke 4G. Have fun with that like this poor guy here

    Q: This uses unrevoked in one of its steps? Explain?
    A: There have been some concerns that this uses unrevoked-forever in one of its steps. As far as we know that Unrevoked 3 (not to be conufused with unrevoked-forever) is causing some radio issues with hardware in general and new hardware. Unrevoked-forever does not appear to bork the radio like unrevoked 3 does. This is apparent by the many success stories. However Unrevoked3 could very well possibly destroy your radio/wimax/brick if used.

    Q: I get device not found
    A: Install the drivers for your phone, (Unrevoked, ADB)

    Q: Camera doesnt work after doing this
    A: Flash a new rom thats current. Like SteelRom, Fresh, Stock Rooted. The issue here is the Hardware is different. NO CUSTOM KERNELS

    A2: Reports say they changed the camera provider/hardware. And the drivers are different! Using a rom based off the latest release and kernel should fix it As Discussed here and here and here

    Q: When I go to recovery. I get a red triangle.
    A: See Step 10

    Q: This doesnt work!
    A: Yes it does if you follow the directions, Unless some other bull**** decided to popup!

    Q: CM6.x doesnt work
    A: See Question 7....Nothing I can do about that if the kernel doesnt support your camera/device.

    Q: My phone boot loops now...You broke my ****!
    A: I didnt break your ****. You broke your own ****! Its not broken so chill out (well it might be but probably not). What rom did you flash? Did you flash a custom kernel? Did your rom come with a custom kernel? I bet your using a custom kernel. Try a rom like Steel Rom, Sprint Lovers

    Q: How do I back up my RSA Keys
    A: Check here for the latest up to date information. Or run this command from the shell

    cat /dev/mtd/mtd0 > /sdcard/wimax.img

    Q: My 4g Doesnt work
    A: Was it broken prior to the s-off, what steps did you take. Are you running AOSP ROM or Another kernel?, Did you try a different rom? What version is your phone? Do you have SwitchPro Widget installed? (uninstall it), Did you try to run unrevoked3 prior to this? After flashing the radios and stock kernel based rom did you do a data and prl update? Does the mac behind your battery match whats in about phone (4g has to be on to see mac) Also try the tree.xml fix posted

    adb shell
    ls /data/misc/wimax/

    look for a file with your macaddress ending in .tree.xml. you want to move that to another location so it gets regenerated. (the following command basically renames it.)

    mv /data/misc/wimax/(Your-mac-address).tree.xml /data/misc/wimax/(Your-mac-address).tree.xml.old

    4. Start 4G may not connect
    5. Do a prl/profile update
    6. Power off the phone and power it back on. Try it
    7. PRL/Profile. Try it

    Q: 4G is still broke.
    A: Check your RSA keys

    adb shell
    cat /dev/mtd/mtd0 | grep RSA

    returned output show appear as this:
    # cat /dev/mtd/mtd0 | busybox grep RSA
    cat mtd0 | busybox grep RSA
    RSA-REQUEST
    RSA-REPLY
    RSA-REJECT
    RSA-ACK
    RSA-1024
    RSA-REQUEST
    RSA-REPLY
    RSA-REJECT
    RSA-ACK
    RSA-1024
    RSA
    ReRSA
    RSA requests
    RSA replies
    -----BEGIN RSA PRIVATE KEY-----
    -----END RSA PRIVATE KEY-----
    #

    It should look just like the above
    the important lines are BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY.
    If you have those two lines, your keys are still likely to be intact.
    If those two lines are missing, your keys are likely missing.

    /dev/mtd/mtd0 is where the wimax image is stored.

    Q: OK I think My Keys are tossed. We made a backup right? So how do I restore it?
    A: This post or post should do it for you

    Q: My Phone says its not rooted.
    A: If you have s-off your rooted. Simple as that. Try a different rom if you want. The second pc36img.zip file you flashed is Sprint Lovers and is a very nice rooted rom.

    Q: When I try to get into Fastboot by pressing VOLUME UP and booting the phone, my phone instead buzzes three times and acts dead. What happened?
    A: The S-OFF update also enables Qualcomm Diagnostics mode on your phone, which is entered by doing what you just did. You can exit this mode (and boot normally) by removing the battery and USB cable.


    Q: Can you tell me what this does?
    A: Read the guide? Basically your downgrading the phone, so you can flash unrevoked because htc "comically fixed" the phone. Then your re upgrading the phone back to shipping radios, system, pri, nv, kernel...all the while with keeping s-off

    Q: How did you get to be so cool
    A: If you have it, you don’t need it. If you need it, you don’t have it. If you have it, you need more of it. If you have more of it, you don’t need less of it. You need it to get it. And you certainly need it to get more of it. But if you already don’t have any of it to begin with, you can’t get any of it to get started. Which means you really have no idea how to get it in the first place, do you? You can share it, sure. You can even stockpile it if you like. But you can’t fake it. Wanting it, needing it, wishing for it. The point is, if you’ve never had any of it, ever, people just seem to know.

    Q: Do you really own a vette?
    A: Yes, and a backpack with jets!

    Q: Whats with you and the dots ...
    A: ...

    Q: Your Kind of an Cocky Asshole
    A: Yea...I Get that. Oh well. I cant fix stupid or ignorant.
    9
    Hi i am new to the EVO and rooting.
    I looked through guides and forums and couldn't find the answers to my basic questions.
    During step 1: after each command what am i supposed to see or verify that the command went through???
    During step 4 same thing. I am getting "usage chmod mode file" is this normal???
    Lastly in step 5 i am getting "./data/local/tmp/rageagainstthecage not found

    What am i doing wrong???
    I have the EVO set to debug and drivers are installed i think.
    How to check???

    I am tech and computer savy but cant seem to get a hang of this.
    Please Help
    Thanks
    Kevin

    1. Make sure that you downloaded and installed HTC Sync from HTC website.
    2. Unzip hboot202-s_off-V71.zip to a folder in your C: drive. I used C:\hroot
    3. This hroot folder should have a folder inside it called root. If you have a folder called hboot202-s_off-V71 then you need to move all the files from that subfolder to c:\hroot.
    4. In Vista/7 slick on the start button and type in cmd. You will see in the program list the command prompt. Right click and open as Administrator.
    5. In the command prompt type cd c:\hroot
    6. On phone goto-> Setting>Applications>Debugging make sure usb debugging is on.
    7. Connect the usb cable to your computer and phone. The phone should change it's screen to ask you what type of connection mode you want. Make sure that it is on charge only. Do not mount.
    8. Type into the command prompt: adb push root/unrevoked-forever.zip /sdcard/ After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    9. Type into the command prompt: adb push root/mtd-eng.img /sdcard/ After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    10. Type into the command prompt: adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    11. Type into the command prompt: adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    12. Type into the command prompt: adb push root/flash_image /data/local/ After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    13. Type into the command prompt: adb push root/rageagainstthecage /data/local/tmp After a pause you should see a confirmation message that states the file size and transfer speed when the file is done being pushed.
    14. Type into the command prompt:adb shell You should see a $, this means that you are "in" the phone.
    15. Type into the command prompt:chmod 0755 /data/local/tmp/rageagainstthecage You should see this echoed on your screen. This is normal. You should still have $ on your cmd line.
    16. Type into the command prompt: chmod 0755 /data/local/flash_image You should see this echoed on your screen. This is normal. You should still have a $ on your cmd line.
    17. Type into the command prompt:./data/local/tmp/rageagainstthecage A message will pop up on the screen. It will take a few seconds, and your will be kicked "out" of the phone. The $ should now be gone.
    18. Type into the command prompt: adb shell You should have a # on your command line instead of a $. # means you have temporary root in your phone. If you do not have #, then start over.
    19. Type into the command prompt that has #: ./data/local/flash_image misc /sdcard/mtd-eng.img
    20. Type into the command prompt that has #: sync
    21. Type into the command prompt that has #: reboot bootloader
    22. Your phone will be rebooting now. Eventually your phone will be at the bootloader menu. On your phone use volume up/down to highlight bootloader and press the power button once. It will start loading the PC36img.zip file.
    23.After it loads, it will ask if you want to flash. Press Volume UP to say yes. It will now flash, which can take some time. You may see some red fail messages. This is normal.
    24.When it is done flashing it will ask you if you want to reboot. Press Volume Down to say now to reboot.
    25. Use volume up/down to highlight recovery. Press the power button once. This will try to boot into recovery mode but fail and load a screen with a red triangle. This is normal because you have not installed recovery yet.
    26. Go back to your computer screen and your command prompt. You should not have a #
    27. Type into the command prompt: adb push recovery /
    28. Type into the command prompt: adb shell busybox --install /sbin
    29. Type into the command prompt: adb shell nohup /sbin/recovery &
    30. After a pause you should see a new screen on your phone. It should be green text with your recovery options.
    31. Highlight backup/restore. Press the power button. Highlight backup nand and press the power button. Press the power button again to confirm the action. Your phone is now doing a nandroid backup. This will backup your wimax keys amongst other things.
    32. It will take a little time to do the backup. After it is done press the power button once to return to the recovery menu.
    33. Highlight enable USB-MS and press the power button.
    34. On your computer, you should see a new drive in my computer or a pop up asking you for an action. Click on Explore, or open the drive in my computer, to access your phone like you would a thumb drive.
    35. Rename the file named PC36IMG.zip to PC36IMG-ENG.zip and then rename PC36IMG-MR.zip to PC36IMG.zip
    36. On your phone, press the power button to disable USB-MS mode. You should be back at the recovery menu.
    37. Highlight the option to flash image from zip. Press the power button.
    38. Highlight unrevoked-forever.zip and press the power button. Press the power button again to confirm if told to do so.
    39. When it completes flashing the image, select reboot from the menu.
    40. When it reboots a few things could happen. If you think your phone is frozen, you are okay because that is a normal occurrence on this step.
    ----->Your phone gets "stuck" on a white screen with the word HTC on it for more than a minute. You need to take the back case off your phone and pull your battery out. Put the battery back in and put the back case on again. Hold down Volume Down and press(and release) the power button while you continue to hold down the volume down button. Your phone should go into the boot loader like it did at the start of the guide.
    ----->You phone started up and fully booted. You need to completely power off.Hold down Volume Down and press(and release) the power button while you continue to hold down the volume down button. Your phone should go into the boot loader like it did at the start of the guide.
    ----->The phone returns to the boot loader.
    41. No matter which of the 3 scenarios occurred to you in the last step, you are now in the boot loader. Obviously the 3rd scenario is the best, but all are OKAY.
    42. The phone should find PC36img.zip. It then loads this file and asks if you want to flash. Use volume up for yes. When it asks to reboot press volume up for yes.
    43. When it is done booting, return to your computer screen and type adb shell mv /sdcard/PC36IMG.zip /sdcard/PC36IMG-MR.zip into the command prompt.
    44. Type into the command prompt: adb reboot recovery
    45. Highlight backup/restore in recovery and then press power. Highlight backup nand and press power. Press power again to confirm. Wait for the backup to complete.
    46. Press power to return to recovery menu. Highlight reboot phone and press power.
    47. Your phone is now rooted, S-OFF, and booted into stock 3.30.651.2.
    -------------------------------------------------------------------------

    After Root:
    1. Run through setup and get to the actual phone screens.
    2. Try to turn on 4G/wifi/etc and see if it all works. It may not and this does not mean disaster.

    For me, I had to flash Stock RUU root 3.30.651.3 to get 4G to work. Here is what I did next:

    1. Download stock RUU root 3.30.651.3(I opted for Odexed version) from http://xdaforums.com/showthread.php?t=836728
    2. Reboot phone into recovery by completely powering off. Hold down volume down and press power. When you get into the boot loader it will try to find PC36img.zip and fail (we renamed that file remember?) and that is normal. Use volume up/down to highlight recovery and press the power button.
    3. In recovery highlight USB-MS and press power to enable.
    4. Your phone should be mounted as a drive in your computer again like before. Copy the whole zip file that you downloaded for RUU 3.30.651.3 rooted odexed to your phone. Wait for it to finish the transfer.
    5. On your phone press power to turn off USB-MS mode.
    6. On the recovery menu highlight wipe and press power.
    7. Highlight the first wipe option which is something like wipe cache/factory reset. Press power. Press power again to confirm if needed.
    8. Hightlight the second wipe option which is wipe cache. Press power and then press power again if needed.
    9. Highlight the third wipe option which is wipe dalvik-cache. Press power and then press power again if needed.
    10. Return recovery menu.
    11. Hightlight flash image from zip and press power.
    12. Highlight the file that you just transfered over that is for RUU 3.30.651.3 and press power. Press power again to confirm if asked. It will start flashing the image to your phone, but you will not see progress bars. It will take a few minutes.
    13. When it is complete select the option to reboot the phone.
    14. The phone should fully boot up into the stock rooted 3.30.651.3 rom.
    15. Now try to turn 4G/wifi/etc on and make sure it works. It did for me.
    16. Assuming that everything is working fine, fully power off, boot into recovery, and do another backup. This newest backup is your holy grail backup. It is stock rooted S-OFF and 4G working backup.

    Note: these last 15 steps can be used to flash any custom rom too. Just make sure that you get your "holy grail" backup first before you experiment.
    5
    This is For Radio version 2.15 and hboot 2.10
    Op i sent this to you in a pm just felt like some ppl could use this now so i also posted this

    Edit
    ::::: Seems like this may be having issues on hw 0004 i need some ppl to test this pls::::::

    I edited Ops original post and deleted /added info and directions.... hopefully hes cool with this it just made it faster/easier for me to get out to the ppl here.. I also thought since every one has who needs this has been using his guide so far and it would be easier for them to adop to quicker if i just changed the instructions instead of creating completley new ones......

    Big Big thanks for xHausx for letting us know about Z4Root... this is what made it possible big thanks to the creator of this app also RyanZA








    Prerequsites:
    Extract only the main zip file to a folder of your choice. I recommend the root of C:\ into a folder of your choice or on the desktop. Make sure you have the drivers installed for your phone (recommended: SDK Drivers or unrevoked hboot drivers) and USB debugging is on. If possible master reset your phone. At the least reboot the damn thing. This was setup for people running windows, if you have access to it do it on a 32bit version. Use the adb.exe included with the package Oh and Read the FAQ and Warnings for f-sakes


    1) Make sure usb debugging is on, and plug in your phone, DO NOT MOUNT USB
    2) Open a command prompt and change to where ever you extracted the files to.
    3)Type the following (this must be excuted from the folder you extracted to)

    adb push root/unrevoked-forever.zip /sdcard/
    adb push root/mtd-eng.img /sdcard/
    adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
    adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip
    adb push root/flash_image /data/local/
    Do not push RageAgainstTheCage Exploit to phone I Repeat Do Not Push !!!


    4) You have hboot 2.10 you must do the following

    1.Download Z4Root from this link http://xdaforums.com/showthread.php?t=833953 install .apk on the phone
    2. launch Z4Root app choose temporary root .. will go thru process will eventually come to a white screen *Wait* after a sec or so screen will come up saying temp root was a success..
    3. go back into cmd change to directory where you extracted all your files..
    type Adb Shell
    then
    SU
    once you have typed Su look at your phone and click allow for SuperUser

    7. in adb type
    ./data/local/flash_image misc /sdcard/mtd-eng.img
    Should get the same exact thing you typed up under it
    then Type
    sync
    Should have Sync under it if done right

    8) Now we are going to reboot your phone into the boot loader to flash the first PC36IMG.zip. You should still be in the shell So Type:

    reboot bootloader

    9) Once your phone is in the boot loader highlight bootloader, and press the power button. It will load the PC36IMG File...When it ask you to flash press VOL-UP. You will notice that it says bootloader bypassed and maybe some other errors. Dont worry this is normal. Once the flash of the file is done it will ask to reboot, Select NO by Pressing VOL-DOWN. Now some people have gotten some errors here and there during the flashing just continue as normal.

    10.1 If you get stuck at White htc evo screen after trying to load recovery just battery pull and reload bootloader and choose recovery will work this time

    10) You should still be in the boot loader at this point. Scroll down to recovery and press the power button. (If you get stuck at White htc evo screen after trying to load recovery just battery pull and reload bootloader and choose recovery will work this time)
    When you see the red triangle. Type the following:

    adb push recovery /
    adb shell busybox --install /sbin
    adb shell nohup /sbin/recovery &

    With any luck you should be at a recovery (green screen with text)

    11) Select enable USB-MS. This will mount your sdcard. Look in the root of your sdcard and you should have two files. One named PC36IMG.zip and one named PC36IMG-MR.zip. Rename the file named PC36IMG.zip to PC36IMG-ENG.zip and then rename PC36IMG-MR.zip to PC36IMG.zip when your done follow the instructions on your phone to disable usb (press power) then proceed to step 12

    12) Now Select flash zip from the menu and choose unrevoked-forever.zip. Wait for it to complete. Select Reboot from the menu.

    Now pay attention. It might kick you back into:

    BOOT LOADER: See 12A
    ROM: See 12B ( will take a good 5 or 6 minutes to load into ROM )
    WHITE HTC SCREEN: See 12C

    12A) Ok so you got kicked to the boot loader. It should scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    12B) Ok so the phone booted into a rom. Power the phone off. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    12C) Ok so the phone is stuck at a white htc screen. Power the phone off by pulling the battery. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 13

    13) Ok your phone is rooted now, and you should be inside the rom. The rom you just flashed is Sprint Lovers 12/05/10 build rom with the modified recovery. Download a rom of your choice copy it to the root of your sd card and flash it. But type the following first

    adb shell mv /sdcard/PC36IMG.zip /sdcard/PC36IMG-MR.zip
    adb reboot recovery

    14) You Should be in the recovery menu now (green text screen). Do a backup by navigating the menu. Once thats done, follow the on screen instructions and reboot or flash a rom of your choice. Reboot. If you flashed a different custom rom than the one thats included in the package cool. If not no big deal eitherway. Do a PRL/Profile update while in the rom after the phone is done rebooting. Your Done.
    3
    I modified the guide and the faq to put the wimax backup into a folder


    So if your using the new updated guide here is a Rough procedure for restoring wimax.

    If you rooted this using this thread there are two places we backed up wimax.img files.

    If you plug in your phone and browse the SDcard
    navigate to the folder "nandroid" on the sdcard. Inside there you will see your phones serial number. It may look something like this "HTxxxxxxxxxxx" where the x's are is various letters and numbers. There should also be a folder called "RSA-PR-BACKUP"

    Copy the "RSA-PR-BACKUP" to the folder with your phones serial number

    Once you did that reboot into recovery goto the backup/restore and select it. then select nandroid restore, select your serial number, then select wimax back up. Now it will restore but it will throw an error because there is no md5 in that folder so the backup cant be verified once thats done back out and reboot the phone when it comes up do a prl/profile update and test...I think it should work