Root [CDMA] Perm rooting the Evo 3D with S-OFF

[novox77]

UPDATE (July 29, 2011):

S-OFF Exploit has been released!
The exploit is called 'Revolutionary,' and it is packaged by the unrevoked and AlphaRevX teams. Here is the official page for the exploit: Revolutionary

Here's a rundown of what you need to do:

0) read the revolutionary documentation page here:
public:revolutionary [RootWiki]

1) you need to have USB debugging enabled on the phone: Settings > Applications > Development > USB debugging (check the checkbox)

2) you need to make sure you have the fastboot drivers installed for your phone. The revolutionary site links to it on their documentation page.

3) download revolutionary and extract everything in the .zip file into a temp folder anywhere you want. Plug in your phone to the PC via the usb cable. Note that the revolutionary website brings you to a page where you can generate a beta key. You'll use this a bit later.

4) make sure windows isn't complaining about drivers at this point. If so, you need to resolve that before moving on.

5) run the revolutionary executable file. A DOS window will appear. It will auto-detect your phone's serial number. Go back to the beta key generation form on the revolutionary website and generate your key using that serial number (without space characters). Enter in your generated key into the prompt in the revolutionary DOS window.

6) sit back and watch the phone load up HBOOT a few times. On the 3rd time, you will have S-OFF. On the fourth and final time, it will be bannered with a magenta Revolutionary label.

7) say yes to download and flash clockworkmod recovery.

Note: some people (including myself) had an issue where clockworkmod was not flashed. Others are reporting no issues at all; they have clockworkmod. If you don't have a recovery image after running Revolutionary, you will need to manually flash one. See this thread for a detailed guide on how to do this:
http://androidforums.com/evo-3d-all...nually-flash-recovery-image-via-fastboot.html

8) at this point, the Revolutionary tool will complete and close. For the final step in the rooting process, you need to flash the superuser binary .zip file with your new recovery image. The .zip file can be downloaded on the Revolutionary documentation page. This .zip file adds superuser to your existing ROM. All of your apps and data will be preserved.

Congrats, you are now fully rooted! Might want to go into recovery and do a NANDroid backup!

And remember, now that you are rooted, do NOT accept any more OTA updates from HTC! You'll be getting updates by manually flashing a rooted version of the OTA ROM. Accepting an OTA while rooted may cause you to loose root, or worst case, brick your phone.

If you are concerned about accidentally accepting an OTA, there's a way to disable the notifications: Settings > System Updates > HTC software update > Scheduled check (uncheck this box).


And now that we have full root, you may find yourself needing to boot into the bootloader (HBOOT) often. Here's how to do it for the Evo 3D:
http://androidforums.com/evo-3d-all-things-root/362270-how-boot-into-bootloader-hboot.html


If you read all this and are still scratching your head, take a look here for a good rooting vocabulary primer:
http://androidforums.com/evo-4g-all-things-root/129648-quick-intro-rooting-those-new-rooting.html



More to come...




Historical information:

Spoiler

-------------------------------
UPDATE (July 19, 2011):
The Evo 3D's sister phone, the Sensation, was successfully hacked by team AlphaRevX. Here's a video showing a Sensation being given commands via USB from a desktop (not pictured), and note when S-ON changes to S-OFF, and then later, the purple watermark giving credit to AlphaRevX. This is promising news for the Evo 3D unlocking effort.

AlphaRevX - HTC Sensation (Pyramid) HBOOT 1.17.0011 S-OFF - YouTube

*edit*
Now, a screenie showing an Evo 3D with S-OFF on a SHIP HBOOT:
xda-developers - View Single Post - Sensation given S-Off by AlphaRev, Evo 3D coming soon?



Source threads:
Sensation given S-Off by AlphaRev, Evo 3D coming soon? - Page 4 - xda-developers
Root: shaking something loose [WIP] - Page 66 - xda-developers

-------------------------------
UPDATE (July 12, 2011):
Building upon the Fre3vo exploit, eugene373 over at xda has come up with a clever way to keep root somewhat persistent. He's announced the final version:
(TOOL) Perma-Temp Root Final! 100% Stable *7/12*/2011* - xda-developers
Keep in mind that this is still a temp-root; if you reboot, you lose it, but unlike before, the root is maintained as long as you don't reboot. Bootloader status remains unchanged (S-ON).

For a guide on how to apply the various temp root solutions out there, see this thread:
http://androidforums.com/evo-3d-all-things-root/373898-evo-3d-temp-rooting.html#post2942011
courtesy of wake69.

-------------------------------
UPDATE (July 10, 2011):
HTC has released an official statement via facebook about its intention on rolling out OTAs for unlocking the bootloader. See here:
https://www.facebook.com/note.php?note_id=10150305151453084

What's all the hoohaw about "locked bootloaders?" See here:
http://androidforums.com/evo-3d-all-things-root/342046-encrypted-bootloader-properly-defined.html

Still not happy with HTC's decision? Here's their contact info:
http://androidforums.com/evo-3d-all-things-root/342244-htc-petitions-change-bootloader-policy.html

-------------------------------
UPDATE (JULY 7, 2011):
All dev efforts are currently to get S-OFF (removing NAND protection). Take a look at the following thread for the latest brainstorming; this is as technical as it gets. If you're just now joining us, just follow the tail end of the thread for the latest.
Root: shaking something loose [WIP] - xda-developers

-------------------------------
UPDATE (July 1, 2011):
agrabren has released the exploit for a temp root:
[GUIDE] Fre3vo / Fre3dom Official Thread - xda-developers

Keep in mind that this root is not sticky; you lose it if you reboot. Also, NAND protection is still on (S-ON) so some root apps, including Titanium Backup, may not function correctly.

-------------------------------
UPDATE (June 30, 2011 4pm ET):
Evo 3D has been successfully temp rooted on both release and OTA versions!
Now we wait for the sticky root exploit to be made public. Stay tuned.

IRC transcript with the developer who found the exploit is here:
http://androidforums.com/evo-3d-all...dev-agrabren-describing-new-root-exploit.html


Other notable threads to follow:
[FAQ/Summary] HTC EVO 3D DEV FAQ's, Root Status, etc.
[WIP][S-OFF] Got Root?

The ROM (we have a while to go before you can flash this, but here it is):
Evo 3d Stock rooted rom

Phandroid Announcement:
HTC EVO 3D Gets Root Courtesy of Team Win


I'll clean all this up once the dust settles.

-------------------------------
UPDATE (June 30, 2011):
A hole, albeit a very unstable one has been found. It may or may not turn into a root exploit.
-------------------------------

The bootloader that came with the latest OTA (v1.40) is still cryptographically signed.

 

[LBPHeretic]

The "revolutionary" thing has been revealed: public:revolutionary [RootWiki] .

The Sprint HTC EVO 3D apparently now has S-OFF. This is pretty awesome.

 

[novox77]

moved your post into a new thread because I think you deserve some credit for being the first to announce this here

excellent news! looks like the tool they are developing is flexible enough to be applied to multiple phones, much like unrevoked back in the day.

Ok, let's get cracking.

 

[I.B. Pimpin]

Real talk. Now what does that mean? Can I overclock now?

 

[novox77]

Real talk. Now what does that mean? Can I overclock now?

lol, one step at a time this is the path to a fully and permanantly rooted phone. Therefore, overclocking and pretty much everything else normally associated with rooted phones, are going to be at our disposal.

 

[LBPHeretic]

moved your post into a new thread because I think you deserve some credit for being the first to announce this here

excellent news! looks like the tool they are developing is flexible enough to be applied to multiple phones, much like unrevoked back in the day.

Ok, let's get cracking.

Thanks, novox77! I really appreciate that.

This news has really made my day. I am a root and flashoholic!

 

[jonsarik]

How do I determine which version of HBOOT my Evo 3D is running? I tried searching online with little luck so far.

Edit: Never mind. Just found out how. For newbs like me, go http://androidforums.com/evo-3d-all-things-root/362270-how-boot-into-bootloader-hboot.html

 

[strat1227]

moved your post into a new thread because I think you deserve some credit for being the first to announce this here

haha I must be chopped liver

 

[LBPHeretic]

How do I determine which version of HBOOT my Evo 3D is running? I tried searching online with little luck so far.

Edit: Never mind. Just found out how. For newbs like me, go http://androidforums.com/evo-3d-all-things-root/362270-how-boot-into-bootloader-hboot.html

Take a look at this thread here: http://androidforums.com/evo-3d-all-things-root/362270-how-boot-into-bootloader-hboot.html . It is a well written instruction list on how to get into HBOOT. Typed up by our very own novox77.

EDIT: Ah, you discovered it right after I posted.

 

[novox77]

haha I must be chopped liver

wow, just noticed you did beat out LBP... chopped liver, indeed! and apologies for the oversight.

 

[LBPHeretic]

wow, just noticed you did beat out LBP... chopped liver, indeed! and apologies for the oversight.

Yeah, he beat me by five minutes. I missed his post too even though I posted right below it.

I was so excited I just posted as fast as I could. Haha.

 

[LBPHeretic]

Real talk. Now what does that mean? Can I overclock now?

I think one has been able to overclock the Sprint HTC EVO 3D for a while now as seen in this thread: http://androidforums.com/evo-3d-all-things-root/370988-evo-3d-overclocked-1-7-ghz.html .

The S-OFF milestone will allow the Sprint HTC EVO 3D to be permanently rooted, and then custom ROMs and kernels can be flashed. It is a great achievement.

 

[Rofflecakes]

Hurray, it worked =D

Few problems I had that others could run into:
1. I never uninstalled HTC sync which wouldn't let me start the program properly. Uninstalled it, and it worked perfectly.

2. Once I got S-OFF it asked if I wanted to install Clockwork recovery, and I said yes, but it failed. I had to download it separately, and flash it myself. Link for the recovery, and the guide to flashing it if needed-

Recovery- http://dl.dropbox.com/u/13152450/recovery/4.0.1.4/cwm-4.0.1.4-shooter.img
Guide- [Info] After AlpharevX: install Clockworkmod, root & more - xda-developers

Then you can root, using the download from this link

http://goo-inside.me/superuser/su-2.3.6.3-efgh-signed.zip

After I started phone up, it had to reactivate, and I had to sign back into my gmail, but it seems to be working perfectly as far as I can tell. The only issue I am having is the overclock I had on it from temp root doesn't seem to be working, and when I tried to redo it, it failed. I'm not worried as I'm sure there will be other solutions soon.

Edit: Nevermind, it seems Novox already posted about this. My mistake, I was on this page and hit refresh without checking the other threads.

 

[novox77]

Edit: Nevermind, it seems Novox already posted about this. My mistake, I was on this page and hit refresh without checking the other threads.

redundancy at this point never hurts. Nice, you found the direct link to clockworkmod. I would also recommend trying out TeamWin's recovery. It's really nice.

 

[novox77]

Updated OP with the new 'Revolutionary' full root procedure.

S-OFF, recovery, superuser.

we have full root.

 

[EarlyMon]

Remember to uninstall temp root su-zip (so you don't confuse yourself) and to turn off Fastboot (so it's just easier to get into recovery menus).

For good measure, I uninstalled my temp root superuser. Just because. Anyway, no big deal, this process installs the newer (correct here) one.

I got CWM no problem. I suppose I should upgrade. Except I've always liked ClockworkMod and I'm not sure I want twrp just yet.

I did find that rebooting caused my particular copy to go into hands-free activation mode with Sprint, followed by PRL update, followed by Firmware update check. No issues, I played guinea pig, but best to not proceed on Firmware update check and to now turn off OTA update checking. Remember to update the profile after this.

Had some icons black upon s-off reboot, second reboot fixed those (prior to su-zip application).

Found my su-zip had the wrong MD5 on download - second one was ok, later found first one was way wrong size (6k vs. 296,742 bytes).

Here is the correct sum:
MD5sum: a2844ac335a5c1cfdb9bea2fc041b415


Check it using Astro File Manager, long press file, Details.

Also - if your copy process also gives a dot version of su-zip (.su-yaddayadda.zip) - delete it using Astro.

Just ran a few root apps - I'm in, for about a half hour now.

Gotta split for a while, remember - going slow and not panicking is your friend.

~~~~~~

I lost my phone functions, intercept recording said my authentication code could not be verified. Well - these things happen.

Performing hard reset now (##786# then MSL - repeats hands-free activation). Probably should have used Titanium Backup, but I was all-in for a complete do-over anyway, so that was a choice.

 

[ovrrdrive]

I had the same thing with the reactivation and PRL updates, and I also instictively cancelled the firmware check. Upon boot I had to relog into my email accounts and after that everything seemed great. I just flashed the su and am about to start playing...

 

[ovrrdrive]

One issue encountered by many (including myself) is that after getting root the phone won't connect calls anymore. It gives an error code 16 when you try. Just wait for a CSR to answer and reset something on their end. She told me it was a security feature added on their end to verify the handset before allowing it to conedt to the network or something. She reset me and I'm working fine now.

They are going to be pretty busy over there for a few days.

One drawback is that they're going to be able to track who roots through this...

 

[EarlyMon]

Been on the phone with Sprint for a while - check your phone really works.

Mine's working now.

Key in all root operations - don't panic.

BTW - Just as you'd expect from perm root: SU survived the hard reset and reprovisioning.

Apps auto downloading.



Happy dance in progress.

 

[wake69]

is any one having issues with tb not findonf root? all of my other root apps are working but tb. using my backup for now

nm found fix here:
http://forum.xda-developers.com/showthread.php?t=1192452

 

[ovrrdrive]

There's a thread on tb on xda to get it working... I'm going to have to break down and buy that one I guess.

 

[ovrrdrive]

Yep, I had to get mine reset too.

 

[ovrrdrive]

is any one having issues with tb not findonf root? all of my other root apps are working but tb. using my backup for now

nm found fix here:
[FIX] Titanium Backup not working after S-OFF/Root - xda-developers

Here's the fix...

After obtaining S-OFF and permanent root, I was still having trouble getting Titanium Backup to work.
Here's what I had to do to fix it:
I had used this to obtain temp root in the past: http://forum.xda-developers.com/show....php?t=1151735
Those steps had me create this directory: /data/bin/
Within that directory, I had sqlite, su, etc. so I simply deleted all the files in that folder, rebooted, and Titanium Backup now works!
I hope it helps everyone else.

 

[I.B. Pimpin]

S Off and TWRP recovery and then flashed SuperUser. This is awesome.

 

[brownhornet]

One drawback is that they're going to be able to track who roots through this...

And honestly im thinking this is the main reason they did it.