Good and EVOTutorials

How to gain S-OFF on GSM HTC EVO 3D with newer HBOOTs

Htc-evo-3d-gsm-europe-550x385 If you have yourself a rooted GSM HTC EVO 3D with a newer HBOOT and are sick and tired of being left with S-ON, I have a solution for you. That’s right, pack away your Flash Image GUI because this tutorial will show you how to get full S-OFF on your SIM card-lovin’ EVO 3D. First and foremost: what is S-OFF? Well, with S-ON and the HTC Unlock method, you have limitations for the files you can flash. Sure, you can flash ROMs and you are indeed rooted, but you can’t flash kernels or custom recoveries. S-OFF gives you full flashing access, which is really good! Note that this method may not work on all GSM HTC EVO 3Ds and I haven’t tested it personally. For more support and to see if your EVO is supported, head to the original thread at the bottom of the post. If you have a CDMA (i.e., Sprint) EVO 3D, please stop reading and do not attempt this method. If you’re still here, then let’s S-OFF your GSM EVO 3D. This method is slightly advanced (like Revolutionary) and most beginner users may want to shy away. This tutorial is written for a Windows 7 PC. Please use it at your own risk! What You Need

  1. Official firmware with the S-OFF-able 1.49.0007 HBOOT: HERE (make sure it is named PG86IMG.zip)
  2. The xvi32 hex editor: HERE
  3. ADB and Fastboot for those who don’t have it: HERE

What You Do First

  1. Unlock and subsequently root your GSM EVO 3D using the HTC Unlock method.
  2. Turn USB debugging on (under Settings > Applications > Development).
  3. Plug your EVO 3D into your PC and put it in Charge Only mode.
  4. Extract the ADB and Fastboot file to your the root of your C:/ drive.
  5. Hit the Start button on your computer, type in “cmd” in the search box and then hit Enter; this will open a Command Prompt window.
  6. Run the following two commands:

    cd c:/adb

    adb shell dd if=/dev/block/mmcblk0p31 of=/mnt/sdcard/mmcblk0p31.img

6c8c47a5f9c34e3725c081c048dd3271 Do not close out of Command Prompt. Switch your phone to Disk Drive mode. What You Do Next

  1. Extract the xvi32 hex editor wherever and open the mmcblk0p31.img file.
  2. Using xvi32, change your version number from 1.22.720.1 (or whatever it is) to 1.20.720.1.

A0c2a86fabf917602dbb82a1a6a93d82 9189c93246269b689b7f399d094ea3e4 Switch your phone back to Charge Only mode. Back in Command Prompt, run the following commands (do not insert the parenthetical comments):     adb shell dd if=/mnt/sdcard/mmcblk0p31.img of=/dev/block/mmcblk0p31     adb reboot-bootloader (your phone will reboot to the Bootloader)     fastboot oem writecid HTC__001 (this changes your CID)     fastboot oem lock (this temporarily re-locks your Bootloader) What You Do Last

  1. Power off your EVO 3D, pull out the battery for a few seconds, then reboot your phone.
  2. Once it is rebooted, copy the PG86IMG.zip file to the root of your SD card.
  3. Reboot into the Bootloader: either with Advanced Power Menu (Restart > Bootloader) or by turning your phone off and using Vol Down + Power Button once off (make sure Settings > Applications > Fastboot is unchecked for this method of accessing the bootloader).
  4. Press Vol + twice to install the PG86IMG.zip when prompted by the Bootloader. You now have HBOOT 1.49.0007.
  5. Unlock your phone with HTC Unlock method one last time.
  6. Gain S-OFF using Revolutionary (this link is for the HTC EVO 4G, but will work fine for your EVO 3D).

[xda-developers]

Pocketables does not accept targeted advertising, phony guest posts, paid reviews, etc. Help us keep this way with support on Patreon!
Become a patron at Patreon!

Sam Sarsten

Sam Sarsten is a former contributing editor at Good and EVO, which was merged with Pocketables in 2012.

Avatar of Sam Sarsten

20 thoughts on “How to gain S-OFF on GSM HTC EVO 3D with newer HBOOTs

  • Avatar of byg.nick

    I, like you, wish that this was something that we could do on our CDMA phones… (actually my Wife’s phone running 1.50 as i am S-off and 1.40 thanks to Revolutionary)

    from what I understand, people who are much smarter than I are currently looking at this method to see if any parts could be adapted to the CDMA version of the 3d….. Either that or Evil needs to figure out root on this thing soon… *fingers crossed*

    Reply
  • Avatar of adam P

    rite!! sucks i have 1.50 and been waiting since i got this phone.. i thought evil had it around thanksgiving time??? i hoping someone will crack it..

    Reply
  • Good to see GSM press!

    Reply
  • Why I get error..? as below
    c:adb>adb shell dd if=/dev/block/mmcblk0p31 of=/mnt/sdcard/mmcblk0p31.img
    /dev/block/mmcblk0p31: cannot open for read: Permission denied

    Reply
  • Rahim: Hello u must root your phone.

    Next syntax is:
    adb shell {Enter}
    su {Enter}
    dd if=/dev/block/mmcblk0p31 of=/mnt/sdcard/mmcblk0p31.img {Enter}

    How easy, that? :-)

    Reply
  • Avatar of Mohamed

    does this remove the water marking done by HTC or not?

    Reply
  • hi Vita
    question on ur post:
    I have the same problem as Rahim,
    This is what u said and what i tried to do.
    Next syntax is:
    adb shell {Enter}
    su {Enter}
    dd if=/dev/block/mmcblk0p31 of=/mnt/sdcard/mmcblk0p31.img {Enter}

    This is what i get:
    c:adb>adb shell
    adb server is out of date. killing…
    * daemon started successfully *
    $ su
    su
    su: permission denied
    $

    I have HBOOT 1.49.0018 any idea’s?

    Reply
  • I get this problem
    c:adb>adb shell
    adb server is out of date. killing…
    * daemon started successfully *
    $ su
    su
    su: permission denied
    $

    I have unlocked Hboot-1.50.0000 s-on

    Please help!

    Reply
  • i have problem when i put
    fastboot oem writecid HTC__01

    fail: [writecid] invalid cid
    OKAY [ 0.11s]
    finished. total time: 0.12s

    Reply
  • Can u pl explain me how I do this part

    <>

    Reply
  • Extract the ADB and Fastboot file to your the root of your C:/ drive.

    Reply
  • dear when I get mmcblk0p31.img file n when I open it, it’s showing all 0 0 0 0 0 0 not values are coming for change plz help

    Reply
  • Avatar of bhargav

    when i do this

    adb shell {Enter}
    su {Enter}
    dd if=/dev/block/mmcblk0p31 of=/mnt/sdcard/mmcblk0p31.img {Enter}

    it says

    32+0 records in
    32+0 records out
    16384 bytes transferred in 0.002 secs (8192000 bytes/sec)

    but its just 16kb file what to do ??

    device info:
    htc evo 3d gsm hboot 1.53
    unlocked and installed superuser i.e rooted

    ‘m a noob plz help me on this i need to get s-off eagerly

    Reply
    • This article is two and a half years old. I’m pretty sure it’s not valid any more. Might want to check the EVO 3D GSM forums at xda-developers.com as I can’t imagine in 2.5 years HTC hasn’t changed something.

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *