[VIDEO GUIDE] FULL S-OFF ROOT for Evo SHIFT. Froyo (2.2) + Gingerbread (2.3.3+2.3.4)

Search This thread

VICODAN

Senior Member
Apr 27, 2011
1,687
474
San Jose, CA
-1) Check your phone's version in settings -> About phone.

2.2: Whew! Life is easy, skip to the bottom of this thread for rooting 2.2 after completing the prerequisites.

2.3.3: Skip to the 2.3.3 section after completing the prerequisites.

2.3.4: Follow every step from step 0. Skip 2.3.3 section.

PREREQUISITES:

0) A PRECAUTIONARY THING TO NOTE: YOU WILL BE ON BASEBAND 1.07 AND WIMAX 27167 AFTER ROOTING! YOU SHOULD FLASH 1.08.01.0111 AND WIMAX 27240 AFTER ROOTING. ALSO NOTE THAT BEFORE YOU FLASH THE RADIOS MAKE SURE YOU ARE STILL ON STOCK 2.2 TO AVOID BOOT CORRUPTION AND MORE WORK. AFTER FLASHING THE RADIOS YOU SHOULD REFLASH CLOCKWORK RECOVERY, WIPE CACHE, WIPE DALVIK, FORMAT /SYSTEM, WIPE DATA/FACTORY RESET AND REFLASH YOUR ROM OF CHOICE!

1) Install HTC Sync and Android SDK with platform tools so you have adb!

Android SDK available HERE:
http://developer.android.com/sdk/index.html

INSTALL PLATFORM-TOOLS ONLY!


HTC Sync available HERE (only needed on windows):
http://dl4.htc.com/setup_3.0.5557.exe

DOWNLOAD THE Shift rootkit here EVERYONE NEEDS THIS:

MIRROR1:
http://www.sendspace.com/file/tjnn1b
MIRROR2:
http://d-h.st/m8U
MIRROR3 (BROKEN RIGHT NOW):
http://www.goo-inside.me/roms/VICODAN/shift-rootkit.rar

2) Check your phone's Android version. If 2.2 skip to rooting Android 2.2 section. If 2.3.4 continue to the next step. If 2.3.3 skip to 2.3.3 section.

WARNING: THIS VOIDS YOUR WARRANTY AND YOU WILL LOSE ALL DATA IN UNLOCKING THE BOOTLOADER


3) Watch these 4 videos before starting:

Here are all 4 video howtos on rooting from 2.3.4:



===============================================

ROOTING ANDROID 2.3.4:


3) Be running stock 2.3.4 latest OTA update from HTC

4) Register at htcdev.com

5) Unlock the bootloader by choosing HTC Evo 3D for Sprint and follow instructions

6) Once you have unlocked bootloader flash clockwork recovery by downloading the following file:

http://download.clockworkmod.com/recoveries/recovery-clockwork-5.0.2.0-speedy.img

Place file in adb "platform-tools" folder.

From the adb folder run "fastboot flash recovery recovery-clockwork-5.0.2.0-speedy.img"

7) adb reboot recovery

8) You will see the beautiful clockwork recovery screen.

9) Goto mounts/storage, mount usb storage

10) Download su from the following location:

http://downloads.androidsu.com/superuser/Superuser-3.0.7-efghi-signed.zip

11) Go back, install zip from sdcard, choose the superuser zip.

12) Reboot, open market, search for super user and install it.

13) Open superuser app go to preferences and choose update su binary.

14) Download terminal emulator and run "su" to test if you have root. $ should turn to #.

15) Place misc.img and PG06IMG.zip on sdcard using windows explorer or "adb push /sdcard/file.xxx" via usb. Again, please note that PG06IMG.zip is case sensitive.

16) Unplug the phone from USB.

17) Remove the battery cover and flash misc.img using the following command via terminal emulator or you can use adb shell with the phone hooked up via USB. Personally I feel more comfortable running this from terminal emulator on the phone:

Code:
dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
and press enter.

18) REMOVE THE BATTERY WITHOUT SHUTTING DOWN THE PHONE as soon as you run the misc.img command. DO NOT SHUTDOWN OR POWER OFF.

19) Hold volume down button and hold the power button for one second and release while still holding the volume down button.

Phone should find PG06IMG.zip and RUU to Android 2.2. From here you can flash engineering s-off bootloader. For instructions on flashing the engineering s-off bootloader skip to the rooting Android 2.2 section.


Again before you ask, make sure you have a freshly formatted FAT32 microSD card. If your phone can't find the zip, you are doing something wrong, your SD card isn't formatted in FAT32, you aren't using CWM, or you need to try another SD card.

You will have to manually upgrade to the new cellular radio after obtaining s-off and downgrading to Froyo again.

Radio flashing instructions here:

http://xdaforums.com/showthread.php?t=1479466

=================================================================================================================================================

ROOTING ANDROID 2.3.3:

Note: If you are running Android 2.3.3 YOU MUST follow the instructions below to get downgraded to 2.2 and from 2.2 you can get full s-off root!

1) (ANDROID 2.3.3 ONLY) Obtain temproot using Fre3vo:

Code:
TEMP ROOT Instructions:


    Download http://tinyw.in/1lI

    Unzip if required and put in your ADB folder

    Launch command prompt (or terminal on mac/linux) and navigate to your ADB PLATFORM-TOOLS folder (note: ALL FILES MUST BE COPIED TO THE PLATFORM-TOOLS FOLDER)

   1) adb push fre3vo /data/local/tmp/ 

   2) adb shell

   3) chmod 777 /data/local/tmp/fre3vo

    /data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF (if this doesn't work, try rebooting phone)


Download these 2 files here and put them in your ADB directory:

su-3.0-alpha7:
http://www.mediafire.com/?81pxf3wp4pnhh1k
Superuser3-beta1.apk:
http://www.mediafire.com/?4djxewue85lgl0c

or here if link is broken:
http://xdaforums.com/showthread.php?p=14927732#post14927732


Code:
TEMP ROOT Instructions (continued):

    Exit back to command prompt if you aren't there already

    adb push Superuser3-beta1.apk /data/app/

    adb push su-3.0-alpha7 /data/local/tmp

    adb shell (should now see # instead of $)

    cd /data/local/tmp

    chmod 777 su-3.0-alpha7

    ./su-3.0-alpha7

    cd /

    mount -o remount,rw -t rootfs rootfs /

    rm vendor

    mkdir vendor

    mkdir vendor/bin

    cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su

    chmod 4755 /vendor/bin/su



You now have temp root. Disregard any notification about outdated SU binary. Root will go away if you reboot. If you reboot your phone you can obtain root again by just running the following

    adb shell
    chmod 777 /data/local/tmp/fre3vo
    /data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
    adb shell (should now see # instead of $)
    cd /data/local/tmp
    chmod 777 su-3.0-alpha7
    ./su-3.0-alpha7
    cd /
    mount -o remount,rw -t rootfs rootfs /
    rm vendor
    mkdir vendor
    mkdir vendor/bin
    cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su
    chmod 4755 /vendor/bin/su

2) To check that you have temp root run "adb shell" and you should get a #. Be sure to check your phone for a super user confirmation when running adb shell to allow it. If you don't get one and get # instantly that's fine.

3) Exit adb and mount your phone's sdcard as USB storage.

4) Copy misc.img to the phone via windows explorer/finder/etc.

links to misc.img here:

http://www.box.net/shared/0l8ex73zne0tfr10ob69
http://dl.dropbox.com/u/15373824/misc.img
MD5Sum: c88dd947eb3b36eec90503a3525ae0de

5) Unplug your phone from the computer

6) Download terminal emulator from market, type "su" and go from $ to #

7) After you get # in terminal emulator type the following:

Code:
dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
and press enter.

8) Once this is done you are ready to downgrade to 2.2

9) 2 ways to downgrade to 2.2. RUU or PG06IMG.zip.

a) RUU is slower, but easier
b) PG06IMG.zip might not work on a lot of sdcards.

Anyways here are the instructions on downgrading to 2.2 if you don't want to run RUU

1) Copy PG06IMG.zip to the SDcard via windows explorer/finder/etc just like the misc.img.

2) Using adb type "adb reboot bootloader" and IMMEDIATELY UNPLUG PHONE FROM USB

3) The phone will reboot. Select bootloader by pressing the power button. The phone will search for a few files and will eventually find PG06IMG.zip REMEMBER THE FILENAME IS CaSe SEnSiTiVE AND THE ".ZIP" PART MUST BE LOWER CASE. SO FILENAME SHOULD BE EXACTLY PG06IMG.zip

If the you see a status bar on the top right corner of the screen it has found the file.

4) If your phone cannot find the PG06IMG.zip check filename case sensitivity and/or try a different sdcard and/or download of the file was corrupted.

JUST RUN FROYO RUU. IT'S EASIER IF YOU CAN'T FIGURE THIS OUT.

5) Press volume up to accept the update and come back to your phone in 15 mintes. It should tell you to press the power to key to reboot. Once it does that you are now on Android 2.2 and can do the normal root steps from the bcnice guide (which I will write out here anyway).


Official ruu file for downgrading to 2.2 - http://www.multiupload.com/15N2D30H6C MD5SUM: a4b880954d2ac29d5bdf0dade9dede3c

PG06IMG for hboot downgrading to 2.2 -

http://dl.dropbox.com/u/41040697/PG06IMG.zip
Mirror for PG06IMG - http://dl.dropbox.com/u/15373824/PG06IMG.zip
Mirror for PG06IMG: http://dev-host.org/xmlaaco0s2ph/PG06IMG.zip
MD5SUM: d20be478fd860b80f5e800c958f79077

====================================================


ROOTING ANDROID 2.2:



1) Download this file (shift-root.zip) http://www.mediafire.com/?h568sgdmkb1dkis
mirror: http://www.multiupload.com/VZOSJHIZYA

2) Extract it to the root of the sdcard of your phone

3) GET TEMPROOT USING VISIONARY, NOT Z4ROOT. I HAD PROBLEMS WITH Z4ROOT.

Visionary instructions:

a) Go to phone settings and allow installation from unknown sources and enable USB debugging.

b) Download visionary at the following link:
http://www.filesonic.com/file/1974858134/com.modaco.visionaryplus.r14.apk

c) Copy the visionary apk file you just download to the same folder as adb..
(i.e. C:\program files\android-sdk\platform-tools)

d) run adb install -r com.modaco.visionaryplus.r14.apk

e) Should work. If you do not see the app, reboot your phone.

f) After phone reboots run visionary, get temproot.

g) run adb shell, and then then run the command "su" (without quotes) and look at your phone. Click allow for the superuser prompt and then verify $ goes to #

h) move on to next step, do not exit adb shell yet

4) Verify md5sum of hboot bin files from shift-root.zip

Run the following commands with adb shell:

Code:
md5sum /sdcard/hboot_orig.bin
md5sum /sdcard/hboot_eng.nb0

386c19451e8dd18f9b98fad6b11be4c0 hboot_orig.bin
60ec1006e6ec2e8acb370d6aad35b17e hboot_eng.nb0

WARNING: If these do not match do not continue redownload the files then check the md5's again


6) If md5sum's match run this command:

DO NOT FAT FINGER THIS COMMAND. YOU COULD BRICK YOUR PHONE. I WILL NOT BE HELD RESPONSIBLE FOR THIS.

Code:
dd if=/sdcard/hboot_eng.nb0 of=/dev/block/mmcblk0p18

You just flashed the eng spl!!! Now lets make sure it took.

7) Check the md5 of new flash hboot and restore if necessary. Run this command to pull the newly flashed hboot to your sdcard

Code:
dd if=/dev/block/mmcblk0p18 of=/sdcard/hboot_check.nb0

now we check the md5 to see if it matches

Code:
md5sum /sdcard/hboot_check.nb0

It should read 60ec1006e6ec2e8acb370d6aad35b17e

8) If the md5sum matches then congratulations its safe to reboot!! Before you do reboot please make sure you run rm /sdcard/PG06IMG.zip

Check hboot and perm root!

1) ok now reboot your phone into bootloader by running "adb reboot bootloader" or by removing the battery and reinserting it then hold the vol down button and press the power button.

3) Look at the top and make sure it says s-off

4) If so reboot the phone back into android

5) put the phone into airplane mode

6) Temp root with visionary (again)

7) After temp root then attempt to perm root with Visionary

8) Your phone will reboot and you are now officially perm rooted any changes you make will now stick on reboot

9) Download Rom manager from market and flash latest clockwork recovery (USE WIFI).

10) adb reboot recovery (or use ROM manager) to get into recovery and flash your ROMs! (Basic instructions and links below). But there you go! Enjoy!

HOWTO flash a ROM:

1) Download ROM zip file, copy to phone and boot in to clockwork recovery.

2) If AOSP you will want to wipe data/factory reset, wipe cache partition, advanced wipe dalvik cache, and wipe /system and /data. Then you will want to choose "install zip from sdcard", flash aosp rom zip file, and flash gapps zip. You should also flash a custom kernel if you plan on doing so during this step.

3) If flashing SENSE based ROM, just flash the zip file. If you want to flash a custom kernel I recommend dodge kernel 1.6, flash this right after you flash the ROM zip file. Follow the same steps as AOSP for wiping cache,dalvik, etc. Before flashing rom.

4) Reboot phone, wait 10 minutes, and enjoy!




BACKING UP YOUR PHONE:

2 methods. You should use BOTH.

1) TITANIUM BACKUP available from market. PURCHASE the full version. WELL WORTH THE MONEY!

2) NANDROID from Clockwork recovery.

a) boot in to recovery
b) goto backup and restore
c) run backup


Links to popular ROMS that are in current development:

AOSP:

UKE (Ultimate kanged edition)
http://forum.sdx-developers.com/index.php?topic=17393.0

Cyanogenmod 7 stable:
http://xdaforums.com/showthread.php?t=1297572

Cyanogenmod 7 nightlies + changelog:
http://cm-nightlies.appspot.com/?device=speedy

Cyclonic
http://xdaforums.com/showthread.php?t=1257777

MIUI (no 4g)
http://xdaforums.com/showthread.php?t=1337185


SENSE:

Supreme Sense
http://xdaforums.com/showthread.php?t=1201233

Mikshifted-G
http://xdaforums.com/showthread.php?t=1150481

gingerbread-shift-deck
http://xdaforums.com/showthread.php?t=1092261

Synergy
http://xdaforums.com/showthread.php?t=1237957

NFX.Speedy.Kingdom
http://xdaforums.com/showthread.php?t=1316368

Latest google apps:
http://xdaforums.com/showthread.php?t=1311342

RADIOS

CELLULAR:

1.07:
http://xdaforums.com/showthread.php?t=934285

1.08:
http://xdaforums.com/showthread.php?t=1082192

1.08.01.0111
http://xdaforums.com/showthread.php?t=1479466

WIMAX:

27167:
http://xdaforums.com/showthread.php?t=934287

27240:
http://xdaforums.com/showthread.php?t=1082192

EVO SHIFT WIKI
http://xdaforums.com/wiki/HTC_Speedy

More howto's coming to this thread later.

credits:
toastcfh
bcnice20
otaking71
ScaryGhoul
newkidd
dodgecjr
JoeyKrim
crump84
ChaoticSheep
riggsAndroid
ariel_
CrashV2010
sparksco
strapped365


#htc_evo_shift

whoever the hell else
 
Last edited:

disco_y2k

Senior Member
Nov 18, 2007
149
26
VICODAN, just 1 quick question, where is the ADB folder? on the phone or on the PC?

thanks again,

cheers,
disco
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
VICODAN,
i am stuck on this step:
adb push Superuser3-beta1.apk /data/app/

i keep getting the following message:
C:\Program Files\Android\android-sdk\platform-tools>adb push Superuser3-beta1.apk /data/app/
failed to copy 'Superuser3-beta1.apk' to '/data/app//Superuser3-beta1.apk': Permission denied

---------------------------------------------------------------------------
BELOW IS LOG FROM COMMAND PROMPT WINDOW

C:\Program Files\Android\android-sdk\platform-tools>adb push Superuser3-beta1.apk /data/app/
failed to copy 'Superuser3-beta1.apk' to '/data/app//Superuser3-beta1.apk': Permission denied

C:\Program Files\Android\android-sdk\platform-tools>cd C:\Program Files\Android\android-sdk\pla
tform-tools

C:\Program Files\Android\android-sdk\platform-tools>adb push fre3vo /data/local/tmp/
204 KB/s (9796 bytes in 0.046s)

C:\Program Files\Android\android-sdk\platform-tools>cd C:\Program Files\Android\android-sdk\pla
tform-toolssdb shell
The system cannot find the path specified.

C:\Program Files\Android\android-sdk\platform-tools>adb shell
$ chmod 777 /data/local/tmp/fre3vo
chmod 777 /data/local/tmp/fre3vo

chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
/data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 2fd00000
smem_len: 300000
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 800
bits_per_pixel: 32
activate: 16
height: 80
width: 48
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Frame Buffer handle: 9
Buffer offset: 002ee000
Buffer size: 8192
Scanning region fbb80000...
Scanning region fbc70000...
Scanning region fbd60000...
Scanning region fbe50000...
Scanning region fbf40000...
Scanning region fc030000...
Scanning region fc120000...
Scanning region fc210000...
Scanning region fc300000...
Scanning region fc3f0000...
Scanning region fc4e0000...
Scanning region fc5d0000...
Scanning region fc6c0000...
Scanning region fc7b0000...
Scanning region fc8a0000...
Scanning region fc990000...
Scanning region fca80000...
Scanning region fcb70000...
Scanning region fcc60000...
Scanning region fcd50000...
Scanning region fce40000...
Scanning region fcf30000...
Scanning region fd020000...
Scanning region fd110000...
Scanning region fd200000...
Scanning region fd2f0000...
Scanning region fd3e0000...
Scanning region fd4d0000...
Scanning region fd5c0000...
Scanning region fd6b0000...
Scanning region fd7a0000...
Scanning region fd890000...
Scanning region fd980000...
Scanning region fda70000...
Scanning region fdb60000...
Scanning region fdc50000...
Scanning region fdd40000...
Scanning region fde30000...
Scanning region fdf20000...
Scanning region fe010000...
Scanning region fe100000...
Scanning region fe1f0000...
Scanning region fe2e0000...
Scanning region fe3d0000...
Scanning region fe4c0000...
Scanning region fe5b0000...
Scanning region fe6a0000...
Scanning region fe790000...
Scanning region fe880000...
Scanning region fe970000...
Scanning region fea60000...
Scanning region feb50000...
Scanning region fec40000...
Scanning region fed30000...
Scanning region fee20000...
Scanning region fef10000...
Scanning region ff000000...
Scanning region ff0f0000...
Scanning region ff1e0000...
Scanning region ff2d0000...
Scanning region ff3c0000...
Scanning region ff4b0000...
Scanning region ff5a0000...
Scanning region ff690000...
Scanning region ff780000...
Scanning region ff870000...
Scanning region ff960000...
Scanning region ffa50000...
Scanning region ffb40000...
Scanning region ffc30000...
Scanning region ffd20000...
Scanning region ffe10000...
Scanning region fff00000...
Scanning region ffff0000...
$ exit
exit

C:\Program Files\Android\android-sdk\platform-tools>adb push Superuser3-beta1.apk /data/app/
failed to copy 'Superuser3-beta1.apk' to '/data/app//Superuser3-beta1.apk': Permission denied

C:\Program Files\Android\android-sdk\platform-tools>adb push su-3.0-alpha7 /data/local/tmp
1389 KB/s (22228 bytes in 0.015s)

C:\Program Files\Android\android-sdk\platform-tools>adb shell
$


thanks again!

cheers,
disco
 
  • Like
Reactions: Kannz2

siroliver0

Member
Mar 2, 2008
8
1
Code:
md5sum /sdcard/hboot_orig.bin
md5sum /sdcard/hboot_eng.nb0
[code]
should be 


[code]
md5sum /sdcard/Shift/hboot_orig.bin
md5sum /sdcard/Shift/hboot_eng.nb0
[code]
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
VICODAN,
i have made alot of progress, thanks for the tip!

- i have 2.2 installed
- com.modaco.visionaryplus.r14.apk installed
- shift-root files on sdcard

but i am stuck again, when i got to visionary in apps, when i select temproot now, it says says rooting device with the little yellow icon, then screen goes black except for taskbar at the top??

if i leave the phone like that and start adb shell, i still get $ not #

i assume i am still supposed to have the phone in 'charging only' mode right?

any ideas?

thanks again bro!





############### IGNORE ABOVE I GOT IT WORKING ###################



THANKS AGAIN!



cheers,
disco


cheers,
disco
 

Attachments

  • disco-evo-shift-2.2.jpg
    disco-evo-shift-2.2.jpg
    13.1 KB · Views: 303
Last edited by a moderator:

disco_y2k

Senior Member
Nov 18, 2007
149
26
VICODAN,
everything worked! thank you for putting together the write-up and thanks to all of the developers for making it possible!

now to choose a ROM, hehehehe




cheers,
disco
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
VICODAN
can you give me your opinion on which way i should go with a new ROM? AOSP or SENSE?

thanks again bro!


cheers,
disco
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
kool i will try those.

has anyone had trouble with activation after root? when i try to make a call i get "error 16" message from sprint?

thanks again

cheers,
disco
 

disco_y2k

Senior Member
Nov 18, 2007
149
26
i called sprint and they said it is some new security feature and they fixed it without problems.


cheers,
disco
 

Top Liked Posts

  • There are no posts matching your filters.
  • 42
    -1) Check your phone's version in settings -> About phone.

    2.2: Whew! Life is easy, skip to the bottom of this thread for rooting 2.2 after completing the prerequisites.

    2.3.3: Skip to the 2.3.3 section after completing the prerequisites.

    2.3.4: Follow every step from step 0. Skip 2.3.3 section.

    PREREQUISITES:

    0) A PRECAUTIONARY THING TO NOTE: YOU WILL BE ON BASEBAND 1.07 AND WIMAX 27167 AFTER ROOTING! YOU SHOULD FLASH 1.08.01.0111 AND WIMAX 27240 AFTER ROOTING. ALSO NOTE THAT BEFORE YOU FLASH THE RADIOS MAKE SURE YOU ARE STILL ON STOCK 2.2 TO AVOID BOOT CORRUPTION AND MORE WORK. AFTER FLASHING THE RADIOS YOU SHOULD REFLASH CLOCKWORK RECOVERY, WIPE CACHE, WIPE DALVIK, FORMAT /SYSTEM, WIPE DATA/FACTORY RESET AND REFLASH YOUR ROM OF CHOICE!

    1) Install HTC Sync and Android SDK with platform tools so you have adb!

    Android SDK available HERE:
    http://developer.android.com/sdk/index.html

    INSTALL PLATFORM-TOOLS ONLY!


    HTC Sync available HERE (only needed on windows):
    http://dl4.htc.com/setup_3.0.5557.exe

    DOWNLOAD THE Shift rootkit here EVERYONE NEEDS THIS:

    MIRROR1:
    http://www.sendspace.com/file/tjnn1b
    MIRROR2:
    http://d-h.st/m8U
    MIRROR3 (BROKEN RIGHT NOW):
    http://www.goo-inside.me/roms/VICODAN/shift-rootkit.rar

    2) Check your phone's Android version. If 2.2 skip to rooting Android 2.2 section. If 2.3.4 continue to the next step. If 2.3.3 skip to 2.3.3 section.

    WARNING: THIS VOIDS YOUR WARRANTY AND YOU WILL LOSE ALL DATA IN UNLOCKING THE BOOTLOADER


    3) Watch these 4 videos before starting:

    Here are all 4 video howtos on rooting from 2.3.4:



    ===============================================

    ROOTING ANDROID 2.3.4:


    3) Be running stock 2.3.4 latest OTA update from HTC

    4) Register at htcdev.com

    5) Unlock the bootloader by choosing HTC Evo 3D for Sprint and follow instructions

    6) Once you have unlocked bootloader flash clockwork recovery by downloading the following file:

    http://download.clockworkmod.com/recoveries/recovery-clockwork-5.0.2.0-speedy.img

    Place file in adb "platform-tools" folder.

    From the adb folder run "fastboot flash recovery recovery-clockwork-5.0.2.0-speedy.img"

    7) adb reboot recovery

    8) You will see the beautiful clockwork recovery screen.

    9) Goto mounts/storage, mount usb storage

    10) Download su from the following location:

    http://downloads.androidsu.com/superuser/Superuser-3.0.7-efghi-signed.zip

    11) Go back, install zip from sdcard, choose the superuser zip.

    12) Reboot, open market, search for super user and install it.

    13) Open superuser app go to preferences and choose update su binary.

    14) Download terminal emulator and run "su" to test if you have root. $ should turn to #.

    15) Place misc.img and PG06IMG.zip on sdcard using windows explorer or "adb push /sdcard/file.xxx" via usb. Again, please note that PG06IMG.zip is case sensitive.

    16) Unplug the phone from USB.

    17) Remove the battery cover and flash misc.img using the following command via terminal emulator or you can use adb shell with the phone hooked up via USB. Personally I feel more comfortable running this from terminal emulator on the phone:

    Code:
    dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
    and press enter.

    18) REMOVE THE BATTERY WITHOUT SHUTTING DOWN THE PHONE as soon as you run the misc.img command. DO NOT SHUTDOWN OR POWER OFF.

    19) Hold volume down button and hold the power button for one second and release while still holding the volume down button.

    Phone should find PG06IMG.zip and RUU to Android 2.2. From here you can flash engineering s-off bootloader. For instructions on flashing the engineering s-off bootloader skip to the rooting Android 2.2 section.


    Again before you ask, make sure you have a freshly formatted FAT32 microSD card. If your phone can't find the zip, you are doing something wrong, your SD card isn't formatted in FAT32, you aren't using CWM, or you need to try another SD card.

    You will have to manually upgrade to the new cellular radio after obtaining s-off and downgrading to Froyo again.

    Radio flashing instructions here:

    http://xdaforums.com/showthread.php?t=1479466

    =================================================================================================================================================

    ROOTING ANDROID 2.3.3:

    Note: If you are running Android 2.3.3 YOU MUST follow the instructions below to get downgraded to 2.2 and from 2.2 you can get full s-off root!

    1) (ANDROID 2.3.3 ONLY) Obtain temproot using Fre3vo:

    Code:
    TEMP ROOT Instructions:
    
    
        Download http://tinyw.in/1lI
    
        Unzip if required and put in your ADB folder
    
        Launch command prompt (or terminal on mac/linux) and navigate to your ADB PLATFORM-TOOLS folder (note: ALL FILES MUST BE COPIED TO THE PLATFORM-TOOLS FOLDER)
    
       1) adb push fre3vo /data/local/tmp/ 
    
       2) adb shell
    
       3) chmod 777 /data/local/tmp/fre3vo
    
        /data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF (if this doesn't work, try rebooting phone)


    Download these 2 files here and put them in your ADB directory:

    su-3.0-alpha7:
    http://www.mediafire.com/?81pxf3wp4pnhh1k
    Superuser3-beta1.apk:
    http://www.mediafire.com/?4djxewue85lgl0c

    or here if link is broken:
    http://xdaforums.com/showthread.php?p=14927732#post14927732


    Code:
    TEMP ROOT Instructions (continued):
    
        Exit back to command prompt if you aren't there already
    
        adb push Superuser3-beta1.apk /data/app/
    
        adb push su-3.0-alpha7 /data/local/tmp
    
        adb shell (should now see # instead of $)
    
        cd /data/local/tmp
    
        chmod 777 su-3.0-alpha7
    
        ./su-3.0-alpha7
    
        cd /
    
        mount -o remount,rw -t rootfs rootfs /
    
        rm vendor
    
        mkdir vendor
    
        mkdir vendor/bin
    
        cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su
    
        chmod 4755 /vendor/bin/su
    
    
    
    You now have temp root. Disregard any notification about outdated SU binary. Root will go away if you reboot. If you reboot your phone you can obtain root again by just running the following
    
        adb shell
        chmod 777 /data/local/tmp/fre3vo
        /data/local/tmp/fre3vo -debug -start fbb58a00 -end FFFFFFFF
        adb shell (should now see # instead of $)
        cd /data/local/tmp
        chmod 777 su-3.0-alpha7
        ./su-3.0-alpha7
        cd /
        mount -o remount,rw -t rootfs rootfs /
        rm vendor
        mkdir vendor
        mkdir vendor/bin
        cat /data/local/tmp/su-3.0-alpha7 > /vendor/bin/su
        chmod 4755 /vendor/bin/su

    2) To check that you have temp root run "adb shell" and you should get a #. Be sure to check your phone for a super user confirmation when running adb shell to allow it. If you don't get one and get # instantly that's fine.

    3) Exit adb and mount your phone's sdcard as USB storage.

    4) Copy misc.img to the phone via windows explorer/finder/etc.

    links to misc.img here:

    http://www.box.net/shared/0l8ex73zne0tfr10ob69
    http://dl.dropbox.com/u/15373824/misc.img
    MD5Sum: c88dd947eb3b36eec90503a3525ae0de

    5) Unplug your phone from the computer

    6) Download terminal emulator from market, type "su" and go from $ to #

    7) After you get # in terminal emulator type the following:

    Code:
    dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17
    and press enter.

    8) Once this is done you are ready to downgrade to 2.2

    9) 2 ways to downgrade to 2.2. RUU or PG06IMG.zip.

    a) RUU is slower, but easier
    b) PG06IMG.zip might not work on a lot of sdcards.

    Anyways here are the instructions on downgrading to 2.2 if you don't want to run RUU

    1) Copy PG06IMG.zip to the SDcard via windows explorer/finder/etc just like the misc.img.

    2) Using adb type "adb reboot bootloader" and IMMEDIATELY UNPLUG PHONE FROM USB

    3) The phone will reboot. Select bootloader by pressing the power button. The phone will search for a few files and will eventually find PG06IMG.zip REMEMBER THE FILENAME IS CaSe SEnSiTiVE AND THE ".ZIP" PART MUST BE LOWER CASE. SO FILENAME SHOULD BE EXACTLY PG06IMG.zip

    If the you see a status bar on the top right corner of the screen it has found the file.

    4) If your phone cannot find the PG06IMG.zip check filename case sensitivity and/or try a different sdcard and/or download of the file was corrupted.

    JUST RUN FROYO RUU. IT'S EASIER IF YOU CAN'T FIGURE THIS OUT.

    5) Press volume up to accept the update and come back to your phone in 15 mintes. It should tell you to press the power to key to reboot. Once it does that you are now on Android 2.2 and can do the normal root steps from the bcnice guide (which I will write out here anyway).


    Official ruu file for downgrading to 2.2 - http://www.multiupload.com/15N2D30H6C MD5SUM: a4b880954d2ac29d5bdf0dade9dede3c

    PG06IMG for hboot downgrading to 2.2 -

    http://dl.dropbox.com/u/41040697/PG06IMG.zip
    Mirror for PG06IMG - http://dl.dropbox.com/u/15373824/PG06IMG.zip
    Mirror for PG06IMG: http://dev-host.org/xmlaaco0s2ph/PG06IMG.zip
    MD5SUM: d20be478fd860b80f5e800c958f79077

    ====================================================


    ROOTING ANDROID 2.2:



    1) Download this file (shift-root.zip) http://www.mediafire.com/?h568sgdmkb1dkis
    mirror: http://www.multiupload.com/VZOSJHIZYA

    2) Extract it to the root of the sdcard of your phone

    3) GET TEMPROOT USING VISIONARY, NOT Z4ROOT. I HAD PROBLEMS WITH Z4ROOT.

    Visionary instructions:

    a) Go to phone settings and allow installation from unknown sources and enable USB debugging.

    b) Download visionary at the following link:
    http://www.filesonic.com/file/1974858134/com.modaco.visionaryplus.r14.apk

    c) Copy the visionary apk file you just download to the same folder as adb..
    (i.e. C:\program files\android-sdk\platform-tools)

    d) run adb install -r com.modaco.visionaryplus.r14.apk

    e) Should work. If you do not see the app, reboot your phone.

    f) After phone reboots run visionary, get temproot.

    g) run adb shell, and then then run the command "su" (without quotes) and look at your phone. Click allow for the superuser prompt and then verify $ goes to #

    h) move on to next step, do not exit adb shell yet

    4) Verify md5sum of hboot bin files from shift-root.zip

    Run the following commands with adb shell:

    Code:
    md5sum /sdcard/hboot_orig.bin
    md5sum /sdcard/hboot_eng.nb0

    386c19451e8dd18f9b98fad6b11be4c0 hboot_orig.bin
    60ec1006e6ec2e8acb370d6aad35b17e hboot_eng.nb0

    WARNING: If these do not match do not continue redownload the files then check the md5's again


    6) If md5sum's match run this command:

    DO NOT FAT FINGER THIS COMMAND. YOU COULD BRICK YOUR PHONE. I WILL NOT BE HELD RESPONSIBLE FOR THIS.

    Code:
    dd if=/sdcard/hboot_eng.nb0 of=/dev/block/mmcblk0p18

    You just flashed the eng spl!!! Now lets make sure it took.

    7) Check the md5 of new flash hboot and restore if necessary. Run this command to pull the newly flashed hboot to your sdcard

    Code:
    dd if=/dev/block/mmcblk0p18 of=/sdcard/hboot_check.nb0

    now we check the md5 to see if it matches

    Code:
    md5sum /sdcard/hboot_check.nb0

    It should read 60ec1006e6ec2e8acb370d6aad35b17e

    8) If the md5sum matches then congratulations its safe to reboot!! Before you do reboot please make sure you run rm /sdcard/PG06IMG.zip

    Check hboot and perm root!

    1) ok now reboot your phone into bootloader by running "adb reboot bootloader" or by removing the battery and reinserting it then hold the vol down button and press the power button.

    3) Look at the top and make sure it says s-off

    4) If so reboot the phone back into android

    5) put the phone into airplane mode

    6) Temp root with visionary (again)

    7) After temp root then attempt to perm root with Visionary

    8) Your phone will reboot and you are now officially perm rooted any changes you make will now stick on reboot

    9) Download Rom manager from market and flash latest clockwork recovery (USE WIFI).

    10) adb reboot recovery (or use ROM manager) to get into recovery and flash your ROMs! (Basic instructions and links below). But there you go! Enjoy!

    HOWTO flash a ROM:

    1) Download ROM zip file, copy to phone and boot in to clockwork recovery.

    2) If AOSP you will want to wipe data/factory reset, wipe cache partition, advanced wipe dalvik cache, and wipe /system and /data. Then you will want to choose "install zip from sdcard", flash aosp rom zip file, and flash gapps zip. You should also flash a custom kernel if you plan on doing so during this step.

    3) If flashing SENSE based ROM, just flash the zip file. If you want to flash a custom kernel I recommend dodge kernel 1.6, flash this right after you flash the ROM zip file. Follow the same steps as AOSP for wiping cache,dalvik, etc. Before flashing rom.

    4) Reboot phone, wait 10 minutes, and enjoy!




    BACKING UP YOUR PHONE:

    2 methods. You should use BOTH.

    1) TITANIUM BACKUP available from market. PURCHASE the full version. WELL WORTH THE MONEY!

    2) NANDROID from Clockwork recovery.

    a) boot in to recovery
    b) goto backup and restore
    c) run backup


    Links to popular ROMS that are in current development:

    AOSP:

    UKE (Ultimate kanged edition)
    http://forum.sdx-developers.com/index.php?topic=17393.0

    Cyanogenmod 7 stable:
    http://xdaforums.com/showthread.php?t=1297572

    Cyanogenmod 7 nightlies + changelog:
    http://cm-nightlies.appspot.com/?device=speedy

    Cyclonic
    http://xdaforums.com/showthread.php?t=1257777

    MIUI (no 4g)
    http://xdaforums.com/showthread.php?t=1337185


    SENSE:

    Supreme Sense
    http://xdaforums.com/showthread.php?t=1201233

    Mikshifted-G
    http://xdaforums.com/showthread.php?t=1150481

    gingerbread-shift-deck
    http://xdaforums.com/showthread.php?t=1092261

    Synergy
    http://xdaforums.com/showthread.php?t=1237957

    NFX.Speedy.Kingdom
    http://xdaforums.com/showthread.php?t=1316368

    Latest google apps:
    http://xdaforums.com/showthread.php?t=1311342

    RADIOS

    CELLULAR:

    1.07:
    http://xdaforums.com/showthread.php?t=934285

    1.08:
    http://xdaforums.com/showthread.php?t=1082192

    1.08.01.0111
    http://xdaforums.com/showthread.php?t=1479466

    WIMAX:

    27167:
    http://xdaforums.com/showthread.php?t=934287

    27240:
    http://xdaforums.com/showthread.php?t=1082192

    EVO SHIFT WIKI
    http://xdaforums.com/wiki/HTC_Speedy

    More howto's coming to this thread later.

    credits:
    toastcfh
    bcnice20
    otaking71
    ScaryGhoul
    newkidd
    dodgecjr
    JoeyKrim
    crump84
    ChaoticSheep
    riggsAndroid
    ariel_
    CrashV2010
    sparksco
    strapped365


    #htc_evo_shift

    whoever the hell else
    4
    Just a heads up man, a couple of the old links you posted are dead.

    Sent from my PG06100 using Tapatalk
    4
    Yes its on the root of my sdcard.
    And i already did the pasting of the htc code they sent. That all went well im rooted with the clockwork recovery. Im now stuck on flashing the misc.img using the following command via terminal emulator. I type the following code "dd if=/sdcard/misc.img of=/dev/block/mmcblk0p17" in but it says its not recognizing it. My android folders is on my C: drive so im doing everything else correctly just 17 is stumping me.

    Um, it kinda sounds like adb is not in your path command line or you need to cd to the same folder where adb and fastboot are at which by default for the sdk is in the platform-tools folder. For example mine is just simply C:\Android\platform-tools. Since adb is in my command path I don't have to cd but you may need to cd C:\Android\platform-tools or whatever the path to your android sdk is.

    Also Vicodan I found out you don't need root to flash misc.img. once you flash the recovery you can boot straight into recovery, type adb shell and it gives you root access with the "#" symbol ;)
    Then run # mount /sdcard
    In order to be able to flash the misc.img from the sdcard.

    Once you do that just make sure PG06IMG.zip is on the root of sdcard (transfer over in recovery if need be), then pull the battery to boot into bootloader to downgrade. Saves an extra step of having to boot up with root just to loose it all over again after the downgrade.
    4
    Good God, why are you guys still going without a one click root? Got enough steps in the OP there? I dont want to sit here for an hour and watch this guy fumble his camera over 4 videos. Christ O mighty

    If it is that big of a deal, why are you not creating it yourself? Is it because you do not have the ability to? Because you lack the skills required to do so? Exactly, you are here to sponge off everyone else s hard work just like the majority of people here, so stfu already and go back into your hole. Quit your whining and crying unless you are ready to step up to the plate and do something constructive.
    3
    Are you starting to feel like a broken record lol? I mean how hard can it be to watch videos, and have a ton of people trying to help? :rolleyes:

    Sent from my PG06100 using xda premium

    :angel: :rolleyes:

    prolly gunna go through the entire thrad and add a faq