Remove All Ads from XDA

 View Poll Results: Was this useful? Rate this thread and hit Thanks button if you liked it.

158 Vote(s)
22 Vote(s)

[Tutorial][07-17]How to unlock/root/s-off and revert back an Evo 3D(ShooterU)

207 posts
Thanks Meter: 178
Post Reply Email Thread

Please read the instructions completely and carefully before you attempt anything.



What ever you do with your device is your own responsibility. In no way shall I, any other member of XDA or HTC, be held responsible in case you brick, destroy your device or even cause any bodily injury to you, by following these instructions

Before you start meddling with your device, please read, search XDA for related information, use wiki.

Those people who are trying to gain S-off to flash ICS ROMs with sense 4.0... You do not have to flash the new firmware as a compulsion. The older Radio works well with the sense 4 ROMs. It is not an absolute necessity to upgrade the firmware. You can skip that. And you can flash any ROM in 4ext touch recovery even with S-ON. Proceed to S-off only if you accept the risks of bricking your device completely without any possibility of recovering it again. And also keep in mind, you will lose all your personal data on the device by following these instructions.


1. Windows running computer(PC).
2. HTC EVO 3D android smartphone.
3. USB cable that came with your Evo 3D.
4. Micro SD card with adequate space in it.(At least 4 GB)
5. Basic computer knowledge of how to open a command prompt and how to run commands in command prompt.
6. 7z / winrar archiver.

Prerequisites for doing anything with your device.

1. Download and install the HTC drivers.

(You can get this from HERE)

2. Unlock your device the htcdev way. Visit and follow the instructions.

You can take a preview of all the steps in attached zip below.

3. Read this post by flashmaniac,

4. Read this post by happyhallsy8

5. Uninstall the HTC sync application from your computer.

6. Download the adb and fastboot files attached below in fastboot-cmd.rar and extract this to the root of the C drive on your computer and rename the folder to Android.


You need to understand a few important terminologies before going forward:

1. Root: It is the basic file system of the android operating system on your device. This has all the important files and programs and drivers which make your device run. And to access this you need to have administrator privileges. Which is obtained by flashing a custom rom which gives you administrator privileges by default, or you need to flash superuser from a custom recovery and then install busy box.

2. Custome ROM: It is an installable zip archive which contains all essential programs and files found in the operating system released for your device by the manufacturer with some modifications so as to enhance the functionality according each individuals taste.

3. RUU/shipped ROM: RUU is an executable which re-installs the original manufacturer released version of the ROM onto your device.

4. Bootloader: It is the part of the firmware which resides in your device which runs the most basic function of starting the device and switches the control to the operating system once the bootstrap of the operating system has loaded on.

5. Locked bootloader: The device manufactures lock this firmware so that your device does not fail to boot and bad programs don't ruin the essential files.

6. adb: A program which can control your device when your device is connected to the computer through a USB cable.

7. cid: This is your manufacturer provided general hardware/firmware id.

8. Serial number: Unique identification number of your device.

9. Unlocking: Unlocking your device the HTCDEV way gives you ability to flash custom ROMS which are not authenticated by HTC and it does not enable you to flash custom kernels on to your devices.

10: Kernels: These are the files that determine how your device perfomes, so if you do not intend to meddle with your kernels, all you will ever need is unlocking the HTCDEV way

If you just want to flash a new ROM you do not need to s-off your device

S-off is required only to flash custom kernels

The instructions for each different procedure are posted in a new post.

Continued in the next post.
Attached Files
File Type: rar htcdev WAY.rar - [Click for QR Code] (1.13 MB, 3364 views)
File Type: rar fastboot_cmd.rar - [Click for QR Code] (677.1 KB, 3125 views)
The Following 45 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:45 AM |#2  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
Arrow Getting started... Up to flashing a rooted custom ROM
Now lets get started.

1. Unlock your device HTCDEV way. There are ways in which you can achieve S-OFF without unlocking your device first. Search for them in the forum. Unlocking HTCdev way has been shown to be consistently successful.

By unlocking HTCDEV way, you will loose all your personal data from your device, so please make a nandroid backup before doing this.

Also use any of the apps and contacts backup and restore apps available in the market and restore all your messages, contacts, apps and settings.

2. Download Clockworkmod recovery by clockworkmod. This tool is essential to flash any custom ROM. Copy this file to your adb folder on your cumputer, That is c:\android.

3. Download a fully rooted custom ROM like one from LeeDroid or any other custom ROM which is rooted.

4. Additionally you can download superuser rooting app.

5. Go to settings in your device, and select applications-->development-->check the USB debugging. Connect your device to your computer by USB cable.

6. Click start and run cmd prompt.

7. Enter the following code

cd\(Hit Enter button)
cd android(Hit Enter Button)
adb reboot bootloader(Hit Enter button)
The result will look like this.

8. Your device will boot into bootloader mode and it will show fastboot USB.

9. Now Enter this code

fastboot flash recovery cwm_4.0.1.4-shooteru.img
Wait for it to finish.

Once done, reboot your device.

Once rebooted, enter the code:
adb reboot recovery
You will enter the clockworkmod recovery.

10. Select the option mounts and storage.
next select mount USB storage.

Wait for your computer to recognize and install the driver, now copy and paste the which you downloaded earlier into the sdcard.

Also copy and paste the LeeDroid ROM which you downloaded into the root of your sdcard.

Right click your removable disk on the computer and select eject.

11. Select Unmount in the recovery on your phone. and then select go back.

12. Now on your computer, in the command prompt enter the following code

adb reboot recovery
13. Your device reboots into the recovery again.

14. Now select install zip from sd card.

then select choose zip.

Then choose the superuser zip and press power button to select.

Reboot the device normally and do the following.

adb shell (Hit enter, and you will see $, as shown below)
$su(hit enter)
#(Now you have to allow the superuser privileges on your device)
c:\Android>adb reboot(hit enter)
once the device is booted into android, visit the google play store, and search for busy box, download it and install, you will have root access.

Now your device is fully rooted.

15. Another way of rooting your phone is by flashing a pre-rooted rom. Download any Gingerbread rom which has been pre-rooted, copy that to your SD card, reboot into CWM recovery and select the rom you downloaded and flash it.

16. If the device gets stuck in the HTC white screen, then follow these steps.

a. Enter the following code in the command prompt.

adb reboot bootloader
Then go to the folder where you had downloaded the LeeDroid zip, you extract one particular file by the name boot (It is a .img type of file)

Now copy this file to the android folder in C:\ drive (C:\android)

Now in command prompt enter this code.

fastboot flash boot boot.img(Press enter)

fastboot reboot
You are done flashing a fully rooted custom ROM with latest superuser app.

Means you are fully rooted and unlocked and have a custom recovery through which you can flash any other ROM if you want to.


Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.
The Following 32 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:46 AM |#3  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
Downgrading your Hboot
Now that you have unlocked and got rooted, lets get your device S-off.

As I understand, till date this following way has been successful in getting your device HBoot down and achieve S-OFF, Important thing for that is to change your CID to a universal CID, that is HTC__001.

I do not know that MY way will work for every device, you are welcome to try my way, for at least the unbranded devices.

There are two ways of changing your device cid.

1. Through fastboot. Open the command prompt, connect your device by USB cable, check USB debugging is enabled. and enter the following code

adb reboot bootloader
wait till your device enters bootloader and shows fastboot USB, now enter the following code.

a. For unbranded devices.
fastboot oem writecid HTC__001

fastboot oem lock

fastboot oem reboot bootloader
Please note that in the cid there are 2 underscores before 001.

b. For branded devices such as Vodafone.
fastboot oem writecid VODAP001
fastboot oem lock
fastboot reboot bootloader

You can even change that CID to HTC__001.

Once you have achieved S-OFF you can change your cid back to original.

2. Manually.

For this you need to download xvi32 hex editor from here

Extract this anywhere, run the xvi32 and open mmcblk0p31.img which you had copied to your device sdcard.

Now change the cid as shown in these pictures.



Now save the file.

For branded devices.


Now save the file and exit.

Now go to adb shell and do as shown:

After this you can check your cid and it will show the changed cid and software build number.

You will get best results if you do this before you flash the custom ROM.

Now you can downgrade the Hboot also in two ways, one is automated as demonstrated by flashmaniac in his thread and the other one is manual.

Downgrading flashmaniac's way does not require you to unlock your device the HTCDEV way.

1. Flashmaniac's way.

Download his tool (Makes sure there are step1.exe, step2.exe and step3.exe in the folder).

Extract the entire folder to root of C drive on your computer.

Run step1.exe

If do not get any errors run step2.exe

Then run the step3.exe

Wait for it to flash the European version of RUU onto your device.

This RUU/ in the downloaded folder has the Hboot version 1.49.0007.

2. A little bit cumbersome and manual way of doing it,

Download the tools from Flashmaniac's thread. Extract the zip. Copy the mmcblk0p31.img to your sdcard.

Then run this code in adb. (Your device will be booted normally into android and USB debugging mode should be enabled)

c:\android>adb shell (Hit enter)
#dd if=/mnt/sdcard/mmcblk0p31.img of=/dev/block/mmcblk0p31 (Hit enter)
You will see copied successfully.

You might face problems here if you are not rooted fully or if your device is still locked.

Then you check the cid and if it shows non workable cid, then write the new cid and relock your device.
fastboot oem readcid
fastboot getvar cid
fastboot oem writecid HTC__001    (or)

fastboot oem writecid VODAP001
fastboot oem lock
Now boot your device into recovery:

fastboot reboot

adb reboot recovery

In your computer, from the tool folder downloaded from Flashmanic'c thread, rename the to PG86IMG

Copy this zip to your sdcard by mounting your sdcard in recovery.

Reboot into bootloader.
adb reboot bootloader
now check that your device bootloader shows as Relocked.

If it doesn't show Relocked.

Try this method to Relock it.

fastboot flash unlocktoken unlock_code.bin

Accept the disclaimer by HTC and let it reboot.

Now pull the battery, and then reboot into bootloader by pressing volume down button and then pressing the power button.(You should keep the volume down button pressed till you boot into the bootloader)

Now relock your bootloader again.
fastboot oem lock (hit enter)

fastboot reboot-bootloader(hit enter)
Now your device will start reading the zip then it will check it for a signature and will ask you if you want to flash.

select yes by pressing the volume up button.

Let it finish.

You may see some error in the end, stating fail. Don't worry.

Just reboot your device.

You are done.

Now you have a Hboot version 1.49.007.


Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.
The Following 22 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:46 AM |#4  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
Thumbs up Now Finally to S-OFF
Finally the much awaited S-OFF

The need to do all the above steps was to finally arrive here.

It is essential to make sure that, your device has a Hboot 1.49.007.

The whole point of this tutorial up to here has been this.

There is one way getting S-OFF on your device, that is by using the revolutionary tool.


Select the appropriate operating system.

The download will start as soon as you click on the operating system shown.

Enable USB debugging mode on your device and connect it to your computer by the USB cable.

[COLOR="rgb(75, 0, 130)"]Extract the downloaded zip from revolutionary site to your C drive.

Run the revolutionary.exe as administrator.

This will give you your device serial number.

Enter the serial number in the space given on the site and copy the S-off code generated, and paste it your notepad.

For the revelotutionary tool to work you must have an identifiable software build number on your device (You can change that in mmcblk0p31.img with a hex editor).. Better still just flash the European ROM with Hboot 1.49.007.. This is safer and avoids problems while running the revolutionary tool.

Now type the code in the program.

Hit enter and wait for it to finish.

If something goes wrong, or if it says failed.

Then recheck your device's boot loader is locked.

And try again and again till you succeed.

The second way is just download this supertool by frigid and run it and you are done.

Now your device has been successfully S-OFF.

Reboot your device.

Copy which ever custom ROM you want to your device's sdcard.

copy any kernel you want.

Then flash them using the CWM recovery in the recovery.

Or use the fastboot commands to flash the kernels and ROMs as you like.

Hope This tutorial will benefit all the noobs as well as members who face problems while trying to S-OFF their devices.


Clockworkmod, Chad.goodman, Flashmaniac, happyhallsy8, frigid, and many more.

Thank you guys.
The Following 18 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:47 AM |#5  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
For warranty issues you can revert back to your original version by following these steps

Visit this thread

Download the appropriate RUU version for your region.

Make sure that you have your original cid written back on your device.

You can do this by entering the following code
//to check the current cid//
C:\android>fastboot oem getvar cid

//to change the cid//

C:\android>fastboot oem writecid HTC__044
//You must enter your device cid which you wrote down before you changed it//
Repeat these steps two to three times and reboot into bootloader and re_lock your device

C:\android>fastboot oem lock
Run the .exe and follow the onscreen instructions.

If this does not work, then, RUN THE .EXE FILE and do as described below.

When the RUU asks you accept, minimize the RUU/drag it down.

Start the task manager on your computer, go to processes, look for a process which has a name ARUwizard, right click on that and select go to location.

Now you can see a zip archive called

Open that, and find the android-info.txt, extract it or just open it within winrar.

This will contain the cidnumber, note down the cidnum which was similar to your cid number, and note down the software build number.

Now make these changes in the mmcblk0p31.img with the help of xvi32 hex editor, copy back the file to your device in adb.

Instead, if you remember your original cid and software build number, you can write them back.

Please also remember to write the original cid of your device back in fastboot.

Copy that to the root of your sd card, and then reboot into bootloader and flash it in bootloader.

Now reboot the device and run the RUU, once done, do the following.

Enter this code in fastboot:
fastboot oem lock
Remember to lock your device bootloader first, before writing the secureflag 3, If you don't lock the bootloader, you will brick your device.

fastboot oem write secureflag 3

fastboot reboot-bootloader
You will see that your bootloader is S-ON and shows RELOCKED.

You are done.
The Following 21 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:48 AM |#6  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
Just in case I fall short of space
The Following 7 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 01:48 AM |#7  
dryogeshd's Avatar
OP Senior Member
Flag Bengaluru
Thanks Meter: 178
Just in case one more
The Following 4 Users Say Thank You to dryogeshd For This Useful Post: [ View ] Gift dryogeshd Ad-Free
8th March 2012, 04:10 AM |#8  
Account currently disabled
Flag Brisbane
Thanks Meter: 272
Donate to Me
Thanks for this...I already have a custom recovery, and a fully rooted rom...awaiting S-OFF instructions...

I assume that your instructions will work for CID: VODAP021... with HBOOT: 1.49.0013

The Following User Says Thank You to 4D3 For This Useful Post: [ View ] Gift 4D3 Ad-Free
8th March 2012, 11:55 AM |#9  
Lothaen's Avatar
Senior Member
Thanks Meter: 416
Thanks - Is it worth trying the touch version of Clockworkmod recovery?

also there's no point flashing the and then flashing a rooted rom on top as the would only give root on the current rom - which is then overwritten by the rooted (leeroid) rom
8th March 2012, 11:57 AM |#10  
Flashmaniac's Avatar
Senior Member
Flag Bremen
Thanks Meter: 474
sorry but this post is useless....
how to root is already explained... there are automated recovery flashers... there is an automatically way of gaining s-off.
you destroy the chance that people get the right tutorial on first try...
43D again.... you will never get S-OFF.

Originally Posted by Lothaen

Thanks - Is it worth trying the touch version of Clockworkmod recovery?

No... it's buggy as hell.
8th March 2012, 12:26 PM |#11  
Lothaen's Avatar
Senior Member
Thanks Meter: 416
Originally Posted by Flashmaniac

No... it's buggy as hell.

that's a shame - worked perfectly on the HTC Desire
Post Reply Subscribe to Thread

hboot downgrading, root, s-off, unlocking

Guest Quick Reply (no urls or BBcode)
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes