How to S-OFF, Flash Custom Recovery and Root your HTC Android Phone – For Dummies
[Updated] 17/03/2012 : Included Rooting via HTCDev Bootloader Unlocking + Android Flasher Utility. Jump to Update Recently i attended Droidcon India 2011 and had a quick chat with a team installing CyanogenMod for interested attendees there. I finally decided to give it a shot. In this part of tutorial I’ll explain till rooting of the phone. *WARNING: This will void your Manufacturer’s Warranty
What is S-OFF (Security Off)
HTC recently added an extra layer of security on their Android Phones, NAND Security. S-ON basically means read-lock on /system , /recovery partition etc.
What is Flash Custom Recovery
Custom Recovery allows you to do advanced tasks like recovery, installation etc on your Android device that are not possible with the available stock recovery. We are going to use ClockworkMod Recovery for the purpose.
What is Rooting
Rootingis a process that allows users to gain root-access. Its similar to JailBreak in iOS.
1. Revolutionary Method
Always have Backups!
Before proceeding, you should backup as much data as possible (Just in case). As an extra precaution, make a copy of your SD Card as well.
- If you have synced contacts at Google account, Good! else export all Phone contacts to SD card.
- Use SMS Backup & Restore to backup all your SMS and Call Backup & Restore to backup all call records (available).
- You can backup all your application APKs as well using Astro File Manager.
Revolutionary Tool
We are going to use Revolutionary Tool, which is a complete solution for gaining S-OFF, Custom Recovery and Rooting. Revolutionary currently supports the following Android phones and HBOOT versions: (as per RootWiki)
- HTC Desire (bravo) 0.93.0001, 1.02.0001
- HTC Desire CDMA (bravoc) 1.06.0000
- HTC Wildfire (buzz) 1.01.0001
- HTC Aria (liberty) 1.02.0000
- HTC Incredible S (vivo) 1.09.0000 and 1.13.0000
- HTC Droid Incredible 2 (vivow) 0.97.0000 (Gingerbread only!)
- HTC Desire S (saga) 0.98.0000 and 0.98.0002
- HTC View (express) 1.09.0000 and 1.13.0000
- HTC Flyer (flyer) 1.10.0000, 1.11.0003
- HTC Sensation (pyramid) 1.17.0006, .0008, .0011 and .0012, 1.18.0000
- HTC Evo 3D (shooter) 1.30.0000 and 1.40.0000
- HTC EVO 3D GSM (shooteru) 1.49.0007, 1.49.0008
- HTC Thunderbolt (mecha) 1.04.0000, 1.05.0000
- HTC EVO 4G (supersonic) 2.15.0001, 2.16.0001
- HTC myTouch Slide 4G (doubleshot) 1.44.0007
Revolutionary will permanently unlock NAND write protection by default on the following phones:
- HTC Sensation (pyramid)
- HTC Evo 3D (shooter)
- HTC EVO 3D GSM (shooteru)
- HTC myTouch Slide 4G
*In case you have a different HBOOT version, Revolutionary method is not supported as of now. Scroll down for the HTCDev Boot Unlocker Method.
FastBoot, HTC Sync and USB Debugging
- If you have HTC Sync installed, Please remove it. It may cause a few issues.
- Install these FastBoot Drivers as given on RootWiki.
- Disable FastBoot on Phone. Click on Settings > Power > FastBoot
- Enable USB Debugging on your Android Phone. Click on Settings > Applications > Development > Turn USB Debugging ON.
HBOOT Version and Device Serial No.
- To get the HBOOT Version, start your device in Bootloader*. Turn off your phone, now Pressing the Volume Down button start the Phone. You will boot into bootloader (FastBoot must be disabled). Note down the HBOOT Version. You will also notice S-ON written on Top. Reboot now.
- Serial No. is written behind battery. or you can see it from Settings >> About Phone >> Phone Identity.
*I’m using HTC Desire S, method may differ for different models. Google up!
Gaining S-OFF
- Download the Revolutionary Tool. You need Beta key as well. Fill up the form on the site with HBOOT Version and Serial Key, it will generate one for you.
- Unzip and run the utility (For Windows – Make sure you have administrative access). Enter the beta key correctly (case sensitive).
- Withing minutes your Phone will reboot in FastBoot. You can notice on top, Revolutionary written in pink. and S-OFF below it, which means we have gained S-OFF.
Flash ClockworkMod Recovery
- The Revolutionary Tool, next will prompt to download and flash ClockworkMod Recovery. Press Y to start* the installation.
- Command prompt will automatically close within a minute indicating that the installation is done. (You are still on the BootLoader screen)
- Reboot your Phone. (Use volume keys / power button to navigate the BootLoader)
* Alternatively you can install ROM Manager(rooted phone), which will install ClockworkMod Recovery
Root Access (SuperUser)
- Download the zip file given on the RootWiki Page.
- Place the zip file on your SD Card and Reboot the phone in BootLoader >> Recovery.
- You will see custom ClockworkMod Recovery screen.
- Go to ‘install zip from sd card’ >> ‘choose zip from sd card’ >> Choose the downloaded zip file on sd card >> Apply >> Confirm
- Installation will finish within seconds. Go back twice. Reboot.
- You now have root access on your droid. Congratulations!
Must Installs
- ROM Manager – To backup your current stock ROM (available on the device). We will install CyanogenMod in our next Tutorial.
- Titanium Backup – To backup all user+system apps etc on your device
For more visit: The 10 Best Android Apps that make Rooting your Phone Worth the Hassle (via LifeHacker.com) In case you are looking to root any other phone, have a look at The Always Uo-To-Date Guide to Rooting Any Android Phone (via LifeHacker.com) DesireFanatics have an awesome video elaborating the process from start to end
2. HTCDev Boot Unlocker Method
HTC released Firmware Over-the-air (FOTA) Upgrade for few Models (like Desire S), and thus the HBOOT Versions have changed. Revolutionary does not support all HBOOT versions as of now, so above method will fail. Example: HTC Desire S (India) has HBOOT 2.00.0002 after the FOTA Update
HTCDev BootLoader
- You can unlock your BootLoader using the official HTC Site. http://htcdev.com/bootloader/. Desire S is not listed in unlockable phones list, but it perfectly works. Choose HTC Desire in dropdown and proceed.
- Warning: After unlocking the bootloader, the phone does a factory reset. Backup all your personal data prior to running the procedure.
FastBoot, HTC Sync and USB Debugging
Install HTC Drivers, Disable FastBoot and Enable USB Debugging (Same as above, check Revolutionary Method for the details). Make sure your MicroSD card is formatted.
SuperUser (SU) and Android Flasher
- Superuser is the app that manages what apps on your rooted device have access to su. Download the superuser.zip file and place it on MicroSD Card.
- Download the Android Flasher (AF) Utility.
ClockworkMod / 4EXT Recovery
You need a Custom Recovery to flash your device. Download ClockworkMod Recovery (You can just download the recovery instead of entire ROM Manager) or 4EXT Recovery. Personally, I prefer CWM over 4EXT.
Gaining Root
- Extract the AndroidFlasher and run (as administrator) the exe file. Choose Desire S (or any other) phone. In the Recovery section browse for the recovery.img file (see the previous step).
- Device will reboot into bootloader. Navigate to recovery. The ClockworkMod Recovery screen will appear. Go to “Install from SD card” and choose the su-3.0.7-efgh-signed.zip file from the SD card.
Thats it. You now have Rooted your device (SuperUser access), though it is still S-ON.
Difference between S-OFF and S-ON
1. For installing any other custom ROM, you need to use fast boot to flash the kernel (boot.img)
Pingback: How to Unroot, S-ON, Remove Revolutionary and ClockworkMod Recovery - HTC Desire S | BOTS World