How to S-OFF, Flash Custom Recovery and Root your HTC Android Phone – For Dummies

[Updated] 26/10/2013 : HTC Desire S is a relatively older model now and is no longer supported. Easiest and Recommended way to root the device would be to use SuperOneClick. You can follow the steps and download the required executables from this XDA Developers thread

If you still want to root it using old fashioned way, feel free to scroll down.

[Updated] 17/03/2012 : Included Rooting via HTCDev Bootloader Unlocking + Android Flasher Utility. Jump to Update Recently i attended Droidcon India 2011 and had a quick chat with a team installing CyanogenMod for interested attendees there. I finally decided to give it a shot. In this part of tutorial I’ll explain till rooting of the phone. *WARNING: This will void your Manufacturer’s Warranty

What is S-OFF (Security Off)

HTC recently added an extra layer of security on their Android Phones, NAND Security. S-ON basically means read-lock on /system , /recovery partition etc.

What is Flash Custom Recovery

Custom Recovery allows you to do advanced tasks like recovery,  installation etc on your Android device that are not possible with the available stock recovery. We are going to use ClockworkMod Recovery for the purpose.

What is Rooting

Rootingis a process that allows users to gain root-access. Its similar to JailBreak in iOS.

1. Revolutionary Method

Always have Backups!

Before proceeding, you should backup as much data as possible (Just in case). As an extra precaution, make a copy of your SD Card as well.

Revolutionary Tool

We are going to use Revolutionary Tool, which is a complete solution for gaining S-OFF, Custom Recovery and Rooting. Revolutionary currently supports the following Android phones and HBOOT versions: (as per RootWiki)

  • HTC Desire (bravo) 0.93.0001, 1.02.0001
  • HTC Desire CDMA (bravoc) 1.06.0000
  • HTC Wildfire (buzz) 1.01.0001
  • HTC Aria (liberty) 1.02.0000
  • HTC Incredible S (vivo) 1.09.0000 and 1.13.0000
  • HTC Droid Incredible 2 (vivow) 0.97.0000 (Gingerbread only!)
  • HTC Desire S (saga) 0.98.0000 and 0.98.0002
  • HTC View (express) 1.09.0000 and 1.13.0000
  • HTC Flyer (flyer) 1.10.0000, 1.11.0003
  • HTC Sensation (pyramid) 1.17.0006, .0008, .0011 and .0012, 1.18.0000
  • HTC Evo 3D (shooter) 1.30.0000 and 1.40.0000
  • HTC EVO 3D GSM (shooteru) 1.49.0007, 1.49.0008
  • HTC Thunderbolt (mecha) 1.04.0000, 1.05.0000
  • HTC EVO 4G (supersonic) 2.15.0001, 2.16.0001
  • HTC myTouch Slide 4G (doubleshot) 1.44.0007

Revolutionary will permanently unlock NAND write protection by default on the following phones:

  • HTC Sensation (pyramid)
  • HTC Evo 3D (shooter)
  • HTC EVO 3D GSM (shooteru)
  • HTC myTouch Slide 4G

*In case you have a different HBOOT version, Revolutionary method is not supported as of now. Scroll down for the HTCDev Boot Unlocker Method.

FastBoot, HTC Sync and USB Debugging

  • If you have HTC Sync installed, Please remove it. It may cause a few issues.
  • Install these FastBoot Drivers as given on RootWiki.
  • Disable FastBoot on Phone. Click on Settings > Power > FastBoot
  • Enable USB Debugging on your Android Phone. Click on Settings > Applications > Development > Turn USB Debugging ON.

HBOOT Version and Device Serial No.

  • To get the HBOOT Version, start your device in Bootloader*. Turn off your phone, now Pressing the Volume Down button start the Phone. You will boot into bootloader (FastBoot must be disabled). Note down the HBOOT Version. You will also notice S-ON written on Top. Reboot now.
  • Serial No. is written behind battery. or you can see it from Settings >> About Phone >> Phone Identity.

*I’m using HTC Desire S, method may differ for different models. Google up!

Gaining S-OFF

  • Download the Revolutionary Tool. You need Beta key as well. Fill up the form on the site with HBOOT Version and Serial Key, it will generate one for you.
  • Unzip and run the utility (For Windows – Make sure you have administrative access). Enter the beta key correctly (case sensitive).
  • Withing minutes your Phone will reboot in FastBoot. You can notice on top, Revolutionary written in pink. and S-OFF below it, which means we have gained S-OFF.

Flash ClockworkMod Recovery

  • The Revolutionary Tool, next will prompt to download and flash ClockworkMod Recovery. Press Y to start* the installation.
  • Command prompt will automatically close within a minute indicating that the installation is done. (You are still on the BootLoader screen)
  • Reboot your Phone. (Use volume keys / power button to navigate the BootLoader)

* Alternatively you can install ROM Manager(rooted phone), which will install ClockworkMod Recovery

Root Access (SuperUser)

  • Download the zip file given on the RootWiki Page.
  • Place the zip file on your SD Card and Reboot the phone in BootLoader >> Recovery.
  • You will see custom ClockworkMod Recovery screen.
  • Go to ‘install zip from sd card’ >> ‘choose zip from sd card’ >> Choose the downloaded zip file on sd card >> Apply >> Confirm
  • Installation will finish within seconds. Go back twice. Reboot.
  • You now have root access on your droid. Congratulations!

Must Installs

  • ROM Manager – To backup your current stock ROM (available on the device). We will install CyanogenMod in our next Tutorial.
  • Titanium Backup – To backup all user+system apps etc on your device

For more visit: The 10 Best Android Apps that make Rooting your Phone Worth the Hassle (via In case you are looking to root any other phone, have a look at The Always Uo-To-Date Guide to Rooting Any Android Phone (via DesireFanatics have an awesome video elaborating the process from start to end

2. HTCDev Boot Unlocker Method

HTC released Firmware Over-the-air (FOTA) Upgrade for few Models (like Desire S), and thus the HBOOT Versions have changed. Revolutionary does not support all HBOOT versions as of now, so above method will fail. Example: HTC Desire S (India) has HBOOT 2.00.0002 after the FOTA Update

HTCDev BootLoader

  • You can unlock your BootLoader using the official HTC Site. Desire S is not listed in unlockable phones list, but it perfectly works. Choose HTC Desire in dropdown and proceed.
  • Warning: After unlocking the bootloader, the phone does a factory reset. Backup all your personal data prior to running the procedure.

FastBoot, HTC Sync and USB Debugging

Install HTC Drivers, Disable FastBoot and Enable USB Debugging (Same as above, check Revolutionary Method for the details). Make sure your MicroSD card is formatted.

SuperUser (SU) and Android Flasher

ClockworkMod / 4EXT Recovery

You need a Custom Recovery to flash your device. Download ClockworkMod Recovery (You can just download the recovery instead of entire ROM Manager) or 4EXT Recovery. Personally, I prefer CWM over 4EXT.

Gaining Root

  • Extract the AndroidFlasher and run (as administrator) the exe file. Choose Desire S (or any other) phone. In the Recovery section browse for the recovery.img file (see the previous step).
  • Device will reboot into bootloader. Navigate to recovery. The ClockworkMod Recovery screen will appear. Go to “Install from SD card” and choose the file from the SD card.

Thats it. You now have Rooted your device (SuperUser access), though it is still S-ON.

Difference between S-OFF and S-ON

1. For installing any other custom ROM, you need to use fast boot to flash the kernel (boot.img)

2. Cannot change Radio, which anyways you rarely need to do so.
In case you are looking to unroot and go back to stock ROM. Check out my post on How to Unroot, S-ON, Remove Revolutionary and ClockworkMod Recovery.
DeviceHTC Desire S SAGA PVT S-ON
ROM:Stock ROM (Android 2.3.5 Sense 3.0)
HBOOTHBOOT 2.00.2000
Software Version:2.15.720.3
Which method did you use? Do share with us in the comments!
Tagged , , , , , , , , , , , , , , , , , , , , ,