EVERYTHING EVO - Latest Rooting | NAND | Flashing Roms | Wipe

**FastRX8** · #1 (**permalink**) 06-05-2010, 08:58 AM

*** Tutorials have been moved to Post #2 or Post #3 for HBOOT 2.02

***Root for Gingerbread 2.3 is now available(HBOOT 2.16)***
[ROOT] EVO 4G Gingerbread 2.3 Root Tutorial (Windows)

*** Important Note about Rooting ***
There are 2 basic options for rooting your phone.

1) If your phone has Gingerbread 2.3 and HBOOT 2.16, you need the new method [ROOT] EVO 4G Gingerbread 2.3 Root Tutorial (Windows)
So, if you just got a new/replacement EVO and it came w/ Gingerbread 2.3, or you did the OTA that Sprint sent out, chances are you need this method. You'll need to double check your HBOOT version first. If you have HBOOT 2.16, you need this method. Check the FAQ to see how to look up your HBOOT.

2) If you do not have Gingerbread 2.3, I recommend using the One-Click method. [GUIDE] One Click How to Root EVO with Unrevoked 3.21
It won't teach you anything about Android, and it won't teach you how to do a nandroid backup, which is always highly recommended, and it won't teach you how to install a custom rom, but it will give you root access.
I'm not going to write instructions for it. Quite honestly, if you need instructions for something that simple, you're in way over your head.
So, if you just want to get root access quick, follow the One-Click Method. Then you come back to this tutorial for info on loading a custom rom or doing a nandriod back up.

***********F.A.Q.***********

Q. What is Rooting?
A. Root is the user name or account that by default has access to all commands and files on Linux, Android or other Unix-like operating system. It is also referred to as the root account, root user and the superuser.

Q. Why would I want to Root my EVO?
A. Rooting gives you full control over the phone. It allows you to run programs that require root permission, like "Wireless Tether for Root Users" or "Titanium Backup." It also allows you to backup/restore your rom and to load custom roms or different radios.

Q. Does Rooting void my warranty?
A. Yes, if you root your phone, "technically" speaking, you did void your warranty. However, if you need to return your phone to Sprint, you can put the phone back to stock/unrooted by flashing a stock rom. http://shipped-roms.com/shipped/Supersonic/

Q. Can I unroot my phone if I change my mind or if I need to take it in for service?
A. Yes, check the bottom of Post#2 the section titled **UN-ROOTING**

Q. Just got my EVO and it has all the latest updates. Can I still root my phone?
A. You need to verify which version of Gingerbread you have, then you can decide which method to use for rooting.

Q. My EVO has HBOOT 2.16, can I still root my phone?
A. That means you have Gingerbread 2.3. Follow this link - [ROOT] EVO 4G Gingerbread 2.3 Root Tutorial (Windows)

Q. How do I know what HBOOT Version I have?
A. Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."
While holding "Volume DOWN", push the "Power" button so the phone turns on.
Near the top it will display your HBOOT ####. This is your version.

Q. How do I know what Software Version I have?
A. Go to Menu>Settings>About Phone>Software Information and look at the Software Number. This is your version.

Q. How do I know what Radio Version I have?
A. Go to Menu>Settings>About Phone>Software Information and look at the Baseband Number. This is your radio version.

Q. How do I know what Hardware Version I have?
A. Go to Menu>Settings>About Phone>Hardware Information and look at the Hardware Version. This is your radio version.

Q. What is Full-Root vs. just Rooting Part 1?
A. Full-Root is the steps that give you full control over all the files on the phone. Part 1 (Section 1) only gives you Superuser Permissions but Part 2 (Section 2) allows you to actually write/change system files.
Here's a PC analogy -
Part 1 would let you install apps and remove those apps (but only those apps you installed). You can't change files on the C: drive, only files on your external storage.
I.E. You could install Firefox and then remove it. But you can't remove MS Paint or Internet Explorer because they are on the C drive and you don't have access to it.
Part 2 also lets you change files that came w/ your operating system.
I.E. You could install Firefox and then remove it. You could also choose to remove preloaded programs like MS Paint or Internet Explorer. You could even go to the C drive and delete every important file on there and ruin your pc.

Q. What does Rooting Part 1 only do?
A. Part 1 (Section 1) of the Rooting process is just to give you Superuser Access. In other words, you can install/run a program that requires special permission. The problem is that it won't give you a Superuser Permission Icon. Many of the programs that need root access also need the SU Icon. Without the icon, they won't work. If you only do Part 1 (Section 1) of the tutorial, YOU WILL HAVE PROBLEMS. You need to do a full-root in order to take advantage of all the benefits of rooting.

Q. What does Rooting Part 1 only NOT do?
A. If you only did Part 1, and nothing else, then;
It does not allow you to remove OEM installed apps. Like Sprint TV or NASCAR or Sprint Navigation.
It does not allow you to install programs on your sdcard.
It does not allow you to install custom roms.
It does not allow you to install newer radios.
To do any of these things, you need to do a full-root using Section 1 & 2 or Section 5, depending on what version your EVO is on.

Q. Can I remove Sprint apps?
A. Yes, if you have full-root access. However, this tutorial is not about how to become an android chef, it's about getting root access and backing up/restoring and flashing new roms. If you don't like the Sprint apps, there are other instructions on how to get rid of them, but you will need full-root access. Or, there are several custom roms that have them removed already.

Q. How can I tell if I rooted my EVO correctly?
A. Super easy way to figure out if you're rooted.

Make sure USB Debugging is on.
Menu>Settings>Applications>Development>USB Debugging should be checked
Connect your phone using "Charge Only"
Open a "Run" window and type "c:\evo-recovery\adb-windows shell"

If you get a "$" you're not rooted

If you get a "#" you're rooted

Click -->here<-- to see a picture of this.

Additional note: If you're on 1.47.651.1 and you believe you're rooted, you'll see the "$" first, type "SU" and hit enter. You'll get a pop-up on your phone for Superuser Permissions to "Allow" or "Deny" access. Click "Allow". If it changes to a "#" you're rooted. If you get "permission denied" you're not rooted.

Q. How can I tell if I have full-root access?
A. Go to the Market and install/open "Quick Boot" by Sirius Applications Ltd. Choose "Recovery." If you're phone boots into the recovery screen w/ the menu options, you have full-root, if you get stuck at the /!\ screen, you do not have full-root access yet.

Q. Getting an error on step 5N, what should I do?
A. Some people get an error at step 5M that says:

Code:

/sdcard/part1: cannot create /data/app-cache/com.android.browser/BEC48C17295CAF9
F550BCD500A0A6F03
/data/app-cache/com.android.browser/DE25D64D198E4BF84672045F0EAEE6CE
/data/app-cache/com.android.browser/EAFCD74DF11E57A3571B1E4D0B768134/foo: directory nonexistant
reboot and run part2

tophyr figured out a solution and posted it --->HERE<---
In an attempt to keep this guide complete, I'll just copy his directions in this post.

I don't have the exact directory names, but the process to get beyond where you're stuck is this: (Type the bold parts, my comments are in the italics)

Code:

cd /data/data/com.android.browser/flashlite
mv sharedobjects sharedobjects-
The move command may fail - don't worry if it does
ln -s /data/app-cache/com.android.browser/ sharedobjects
cd /app-cache/com.android.browser
ls

Here you should see at least one directory looking like 'BEC48C17295CAF9F550BCD500A0A6F03'. If there are multiple, repeat the following three lines for each. If there are not any, then refresh the website and/or find a new flash app (perhaps a game like mentioned above, or something) and repeat the 'ls' command after the app loads. You should then see a directory like the above.

Code:

cd <long-ass-directory> (You can use wildcards.. if it starts with B like the above, do 'cd B*'
cat /system/bin/rsync /system/bin/rsync /system/bin/rsync > foo
cd ..

These pretty much take care of what part1 tries to do, but likely fails to, if it's unable to outright delete the relevant directories. After running these commands manually, reboot the phone and follow the steps for part2 and beyond, and it *should* work. Did for me.

***********End of F.A.Q.***********

***********Videos***********

**Rooting - Full Root Parts I & II - Wipe - Flash - Without a PC or ADB Shell**
There are notes throughout the video that tell you what step of the video you are watching. If you do this, you can then use Rom Manager from the Market for any other things you need regarding roms. (i.e. Nand Backup/Restore, Flash newer roms/radios)
http://www.youtube.com/watch?v=DzEot2oYKbw

These older videos are here for reference if anyone wants to use the PC method.

The first video shows me doing the Rooting/Recovery/Nand Backup/Wipe/Flash.
After I loaded a custom rom, I use Rom Manager to load a custom rom again. Rom Manager works great, but I would suggest everyone do the manual method the first time. Once you're on a custom rom, Rom Manager is definitely the way to go.
**Rooting - Recovery - Nand Backup - Wipe - Flash - Rom Manager**
http://www.youtube.com/watch?v=Oja2a6O96wQ

The second video is my doing part 2 of the rooting process. This will give you full system access. This part is not absolutely necessary, but it does allow you to use the Nand Restore option to replace all your settings the way you had them. Plus, it gives you full control of the phone from the phone. No need to connect to pc next time you want to load a new rom.
**Full Root - Unlocking NAND Protection**
http://www.youtube.com/watch?v=tUXTB0eydwE

**FastRX8** · #2 (**permalink**) 06-05-2010, 08:59 AM

I know there are several methods/guides to rooting the EVO. I didn't create any of these methods. I started this because this was my first experience w/ Android and trying to root. I had some trouble because there are certain steps that are probably obvious to Android regulars or guys that did a lot of research, but it was not obvious to me.

This is written for someone who is an ANDROID n00b and has absolutely no idea where to began. If you're a PC n00b and the idea of unzipping a file is foreign to you, this thread is not for you. Just enjoy the EVO Stock. It's a great phone and you won't be disappointed. Now, if you're comfortable around a pc and can follow instructions, this guide should be helpful. I've broken down every step.

*********** F.A.Q. and Videos - See Post #1 ***********

This guide includes;
ROOTING Part I and Part II (Full Root) - Use this if you're on software version 1.32.651.1 or 1.32.651.6.
Section 1 - This part gives you basic root access.
Section 2 - This part unlocks NAND and gives you full control. There are 2 versions of Section 2. Either one works.

Version 1 - No PC needed. No ADB Shell needed.

Version 2 - Using a PC and ADB Shell

Nand Backup and Nand Restore - 2 options with Rom Manager and w/o Rom Manager
Section 3 - Rom Manager Nand Backup/Restore
Section 4 - Manual Nand Backup/Restore

ROOTING AFTER OTA 1.47.651.1 (Full Root) - Use this if your phone had the OTA done and you're on version 1.47.651.1
Section 5 - This part includes all the steps to get full root including NAND Unlock. In other words, full control.

Froyo 2.2 Rooting If your phone has Froyo 2.2 and you're on version 3.26.651.6 use the method from XDA described here ---> How to root Android 2.2 on the EVO 4G

UN-ROOTING - Use this if you need to unroot your phone for any reason.
Section 6 - Instructions to unroot your phone

Here's the steps written in Android n00b language for the PC.

**********ROOTING Part I and Part II (Full Root)**********
Thanks to toastcfh
This is for Full Root access. I dropped the instructions for partial root because they are not needed. With Full Root available, there is no need to only do a partial root. Even if all you want is permissions to load a custom rom, you'll need to have a backup in case something goes wrong and you can't use the backup if you're not fully rooted. So, follow these simple steps and you'll have everything you need.

Before you start
Before you start anything, your phone needs to be able to connect to the pc. If you haven't done so before, install HTC Sync. There is a folder on the sdcard that contains a version of HTC Sync or you can download a newer version from their site. It doesn't matter which version because you're not going to use it. We just need the drivers installed so the phone can communicate with the PC.
Next, make sure "USB Debugging" is turned ON.
Menu>Settings>Applications>Development>USB Debugging
If it's turned on, every time you connect your phone to the PC, you'll see "/! USB Debugging connected" in the notifications on the phone.

Items you'll need
1- PC36IMG.zip (Place this on your sdcard)
2- eng-PC36IMG.zip - Mirror 1 - (Place this on your sdcard)
3- Full Root files.zip - This zip contains 3 files you will extract to your sdcard (flash_image, mtd-eng.img, recovery.img)
Now you sdcard should look like this -

4- evo-recovery - Extract this folder to your C:\ drive so you should see C:\evo-recovery

5- Any custom rom you want to load. If you don't want a custom rom, then at least install the rooted version of the Sprint Rom --> here <-- (place this rom on your sdcard too)

Section 1 -
1A) Connect your EVO to the PC and select "disk drive" so that you can see your storage card from the "My Computer" window

1B) Copy the file PC36IMG.zip and eng-PC36IMG.zip to the storage card. Don't unzip it and don't put it in a folder. Just copy the files.

1C) Take the "Full Root Files.zip" you downloaded and unzip all 3 files to the storage card. Don't put them in a folder.
At this point, you should have 5 new files on your storage card as shown in the picture above under items needed.

1D) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."

1E) While holding "Volume DOWN", push the "Power" button so the phone turns on. You don't need to hold the "Power" button, but you do need to hold the "Volume DOWN" button. This will bring you straight to the bootloader screen which says
-FASTBOOT
-RECOVERY
-CLEAR STORAGE
-SIMLOCK
-HBOOT USB

Just wait for a minute. It will read your storage card. This takes about 30secs and there is a progress bar on the top right. It's reading the PC36IMG.zip file you placed on the card.

1F) Once that's done, it says, "Do you want to start update?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and then wait.

1G) Once that's done, it says, "Update Complete. Do you want to reboot device?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and you will reboot.

Now just be patient. It will take a while to start up the first time, but when it's done, you'll be at the setup screen you saw the first time you turned on the device. Skip all the account setups and whatever else. You just want to get to the Home screen so you can go to the next step.

Now you're phone is partially rooted, but we're not stopping there.

Section 2 Version 1 - No PC Needed -

2A) Go to the Market and download/install EStrongs File Explorer. Just search for "EStrong" pick "Estrongs File Explorer." Then download/install Barcode Scanner by ZXing. Just search for "Barcode."

2B) Open Barcode Scanner and scan the QR code below. Select "Open Browser" then download/install. Note: This will allow you to install Android Terminal Emulator by Jack Palevich. I couldn't find it in the market, so I'm using this method.

2C) Open Estrongs File explorer. Long-press on the files to rename the file "PC36IMG.zip" --> "root-PC36IMG.zip" and then rename "eng-PC36IMG.zip" --> "PC36IMG.zip"

2D) Open "Android Terminal Emulator" that you installed in step 2B, and type the following commands. Hit Enter after each line.

Code:

su
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img

If you typed each line correctly, you won't see any changes, you'll just go down to the next line w/ a "#"

2E) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."

2F) While holding "Volume DOWN", push the "Power" button so the phone turns on. You don't need to hold the "Power" button, but you do need to hold the "Volume DOWN" button. This will bring you straight to the bootloader screen which says
-FASTBOOT
-RECOVERY
-CLEAR STORAGE
-SIMLOCK
-HBOOT USB

Just wait for a minute. It will read your storage card. This takes about 30secs and there is a progress bar on the top right. It's reading the PC36IMG.zip file you placed on the card.

2G) Once that's done, it says, "Do you want to start update?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and then wait.

2H) Once that's done, it says, "Update Complete. Do you want to reboot device?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and you will reboot.
Skip all the account setups and whatever else. You just want to get to the Home screen so you can go to the next step.

2I) Once your back to the home screen, go back to the Market place, go to downloads, and you should still see Estrongs and Android Terminal. You need to download/install them again.

2J) Open Estrongs File explorer. Long-press on the file to rename the file "PC36IMG.zip" --> "eng-PC36IMG.zip"

2K) Open "Android Terminal Emulator" that you installed in step 2B, and type the following commands. Hit Enter after each line.

Code:

su
cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img

If you typed each line correctly, you won't see any changes, you'll just go down to the next line w/ a "#"

2L) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."

2M) While holding "Volume DOWN", push the "Power" button so the phone turns on. You don't need to hold the "Power" button, but you do need to hold the "Volume DOWN" button. This will bring you straight to the bootloader screen which says
-FASTBOOT
-RECOVERY
-CLEAR STORAGE
-SIMLOCK
-HBOOT USB

Just wait for a minute. It will read your storage card. It won't find the PC36IMG.zip file because it was renamed. When it's done searching, use "Volume DOWN" to highlight "Recovery" and "Power" button to select it.

The phone will reboot into Recovery Mode.

2N) From the list, use "Volume DOWN" to highlight "Wipe" and "Power" button to select it.

2O) In the Wipe menu you're going to use the "Volume DOWN" to highlight "Wipe data/factory reset" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe data/factory reset" twice.

2P) Use the "Volume DOWN" to highlight "Wipe Dalvik-cache" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe Dalvik-cache" twice.

Now push "Power" button to return to the previous menu.

2Q) Use the "Volume DOWN" to highlight "Flash zip from sdcard" and "Power" button to select it.
At this point every zip file on the root of your sdcard will show. Make sure you know which one you want to flash.

2R) Use the "Volume DOWN" to highlight your rom or radio file and "Power" button to select it, then "Power" button again to confirm. Sit back and wait. Mine took about 2mins.

When it's done, hit "Power" button to "Reboot system now" and enjoy your rooted EVO w/ a custom rom.

Section 2 Version 2 - Using the PC -

2A) Connect your EVO to the PC and select "disk drive" so that you can see your storage card from the "My Computer" window

2B) Rename the file "PC36IMG.zip" --> "root-PC36IMG.zip" and then rename "eng-PC36IMG.zip" --> "PC36IMG.zip"

2C) Disconnect the EVO from the USB, wait about 5seconds, then reconnect the EVO but this time select "Charge Only"
Note: Make sure you have USB Debugging turn on
Menu>Settings>Applications>Development>USB Debugging

2D) Open a "run" window by hitting the Windows key + "R" in the command line type (or cut/paste)

Code:

c:\evo-recovery\adb-windows shell

then hit "OK"

2E) In the window that opens, type (do not cut/paste this) Hit Enter after each line.

Code:

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img

If you typed each line correctly, you won't see any changes and the line will just repeat once when you hit enter. Each command takes a second or two.

2F) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."

2G) While holding "Volume DOWN", push the "Power" button so the phone turns on. You don't need to hold the "Power" button, but you do need to hold the "Volume DOWN" button. This will bring you straight to the bootloader screen which says
-FASTBOOT
-RECOVERY
-CLEAR STORAGE
-SIMLOCK
-HBOOT USB

Just wait for a minute. It will read your storage card. This takes about 30secs and there is a progress bar on the top right. It's reading the PC36IMG.zip file you placed on the card.

2H) Once that's done, it says, "Do you want to start update?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and then wait.

2I) Once that's done, it says, "Update Complete. Do you want to reboot device?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and you will reboot.
Skip all the account setups and whatever else. You just want to get to the Home screen so you can go to the next step.

2J) Once your back to the home screen, the EVO should be connected as "Charge Only"
Note: Make sure you have USB Debugging turn on
Menu>Settings>Applications>Development>USB Debugging

2K) Open a "run" window by hitting the Windows key + "R" in the command line type (or cut/paste)

Code:

c:\evo-recovery\adb-windows shell

then hit "OK"

2L) In the window that opens, type (do not cut/paste this) Hit Enter after each line.

Code:

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img
reboot recovery

If you typed each line correctly, you won't see any changes and the line will just repeat once when you hit enter. Each command takes a second or two. The last command will reboot your phone into recovery mode.

2M) From the list, use "Volume DOWN" to highlight "Wipe" and "Power" button to select it.

2N) In the Wipe menu you're going to use the "Volume DOWN" to highlight "Wipe data/factory reset" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe data/factory reset" twice.

2O) Use the "Volume DOWN" to highlight "Wipe Dalvik-cache" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe Dalvik-cache" twice.

Now push "Power" button to return to the previous menu.

2P) Use the "Volume DOWN" to highlight "Flash zip from sdcard" and "Power" button to select it.
At this point every zip file on the root of your sdcard will show. Make sure you know which one you're using.

2Q) Use the "Volume DOWN" to highlight your rom or radio file and "Power" button to select it, then "Power" button again to confirm. Sit back and wait. Mine took about 2mins.

When it's done, hit "Power" button to "Reboot system now" and enjoy your rooted EVO w/ a custom rom.

******** Nand Backup and Nand Restore********
There are 2 options for making backups and restoring.
1) The easy method is to use Rom Manager. Install Rom Manager from the Market.
2) Put your phone into Recovery Mode and do all the steps manually.

Section 3 - Rom Manager Nand Backup/Restore -
3A) Go to the Market and download/install "Rom Manager" by ClockworkMod and then open it.
There is a free one and a donation one.

3B) Once it's opened, select "Flash ClockworkMod Recovery"

3C) Confirm your phone is an HTC Evo (CDMA)
Wait a couple minutes while it does it thing. When it's finished you'll get a "Successfully flashed ClockworkMod recovery!"

3D) Select "Backup Current Rom" and you'll have the option of naming it. Default is the Date and Time (2010-06-23-22.25.19) YYYY-MM-DD-HH-MM-SS
And that's it. Rom is backed up. If you try to flash another rom and don't like it or you make changes and mess something up, you can just restore the backup you just made and be right back where you were.

3E) To restore the Rom, select "Manager and Restore Backups"

3F) Select the Rom from the list of available backups. (You'll have the option to Restore/Rename/Delete)

3G) Choose Restore and select which parts you want to restore. All of them are checked by default.
You're choices are;
Restore Boot
Restore System
Restore Data
Restore Cache
Restore SD-Ext

Selecting all them will do a complete restore of your rom. I haven't experimented to see what the different parts do.

Section 4 - Manual Nand Backup/Restore -
You'll need to put your phone into Recovery mode first.

4A) Connect the EVO to the pc and select "Charge Only"

4B) Open a "Run" window by hitting the Windows key + "R" in the command line type (or cut/paste) then hit Enter

Code:

c:\evo-recovery\adb-windows reboot recovery

This will reboot the phone directly into Recovery Mode if you've done Rooting Part I & II

4C) Use the "Volume DOWN" to highlight "Backup/Restore" push the "Power" button to select it.

4D) Use the "Volume DOWN" to select "Nand backup" push the "Power" button to select it.

4E) You'll be asked if you want to create a Nandroid backup. Press "Power" button to confirm any other key to abort.
While it's creating a backup, it will say "Performing Backup" and show dots "....." across the bottom of the screen. It will fill-up about 3 rows of dots before it's done.
And that's it. Rom is backed up. If you try to flash another rom and don't like it or you make changes and mess something up, you can just restore the backup you just made and be right back where you were.

4F) To restore the Rom, do steps 4A-4C (skip 4D/4E) and use the "Volume DOWN" to select "Nand restore" push the "Power" button to select it.

4G) Use the "Volume DOWN" to select "HTXXXXXXXXXXX" (this will be your device #) push the "Power" button to select it.

4H) Use the "Volume DOWN" to select "BDS-XXXXXXXX-XXXX" (this will be the date of your backup) push the "Power" button to select it and "Power" to confirm it.
When it's done restoring, push "Power" twice to reboot.

******** ROOTING AFTER OTA 1.47.651.1 (Full Root)********
Thanks to SteelH

This is for Full Root access after someone has applied the OTA 1.47.651.1. If you accepted the OTA or it was done for you when you bought your phone, use this guide. To check which version you're on, go to Menu>Settings>About Phone>Software Information>Software Number. If it says "1.47.651.1" this section is for you.
If you're on version "1.32.651.1" or "1.32.651.6" then use the ****ROOTING Part I and Part II (Full Root)**** instructions in section 1 & 2.

NOTE: Yes there are a lot of steps. Read through them once before you try it. The only tricky part is step 5Q. I actually had to reboot my phone and do 5Q again because I was too slow the 1st attempt. Other than that step, it's all pretty easy.

Before you start
Before you start anything, your phone needs to be able to connect to the pc. If you haven't done so before, install HTC Sync. There is a folder on the sdcard that contains a version of HTC Sync or you can download a newer version from their site. It doesn't matter which version because you're not going to use it. We just need the drivers installed so the phone can communicate with the PC.
Next, make sure "USB Debugging" is turned ON.
Menu>Settings>Applications>Development>USB Debugging
If it's turned on, every time you connect your phone to the PC, you'll see "/!\ USB Debugging connected" in the notifications on the phone.

Items you'll need
1- eng-PC36IMG.zip - Mirror 1 - (Place this on your sdcard and rename it PC36IMG.zip)
2- Rooting OTA Files.zip - This zip contains 5 files you will extract to your sdcard (flash_image, mtd-eng.img, part1, part2, recovery.img)
Now you sdcard should have these files -

3- evo-recovery - Extract this folder to your C:\ drive so you should see C:\evo-recovery

4- Any custom rom you want to load. If you don't want a custom rom, then at least install the rooted version of the Sprint Rom --> here <-- (place this rom on your sdcard too)

Section 5 -
5A) Connect your EVO to the PC and select "disk drive" so that you can see your storage card from the "My Computer" window

5B) Copy the file eng-PC36IMG.zip to the storage card, make sure to rename it PC36IMG.zip. Don't unzip it and don't put it in a folder. Just copy the file and rename.

5C) Take the "Rooting OTA files.zip" you downloaded and unzip all 5 files to the storage card. Don't put them in a folder.
At this point, you should have 6 new files on your storage card as shown in the picture above under items needed.

5D) Select Menu>Settings>Privacy>Factory data reset>Reset phone>Erase everything
Now you're phone is being reset. Once you're back to the home screen, continue to the next step (you don't need to fill in your account info, just skip past the setup to get to the home screen)

5E) Connect the EVO to the pc and select "Charge Only"
Note: Make sure you have USB Debugging turn on
Menu>Settings>Applications>Development>USB Debugging

5F) Open a "run" window by hitting the Windows key + "R" in the command line type (or cut/paste)

Code:

cmd

then hit "OK"

5G) In the window that opens, type (or cut/paste this) then hit Enter

Code:

cd c:\evo-recovery

Now you should be a prompt that says "c:\evo-recovery>"

5H) Now type (or cut/paste this) then hit Enter

Code:

adb-windows shell

Now you should be a "$" prompt

5I) Now type (do not cut/paste this) then hit Enter

Code:

sh /sdcard/part1

If you typed it correctly, you won't see any changes and the line will just repeat once, when you hit enter.
Then you will get a message that says "power down your phone from the power menu and re-run"

5J) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off." At this point, DO NOT TURN THE PHONE BACK ON!

On your pc you should have the cmd window open and once the phone is off, you will be at the "c:\evo-recovery>" prompt again. This next step will help you later. Do it now, while the phone is off, and it will make things easier later on.

5K) At the "c:\evo-recovery>" prompt, type (or cut/paste this) then hit Enter

Code:

adb-windows shell /data/local/part2

Because the phone is off, this will not work. You should get a message that says "error: device not found"

Now turn your phone back on. Once it's on the home screen continue with the next step. You should still be at the "c:\evo-recovery>" prompt.

5L) Now type (or cut/paste this) then hit Enter

Code:

adb-windows shell

Now you should be a "$" prompt

5M) Now type (do not cut/paste this) then hit Enter

Code:

sh /sdcard/part1

If you typed it correctly, you won't see any changes and the line will just repeat once, when you hit enter.
Then you will get a message that says "visit Adobe - Flash Player : Settings Manager - Website Storage Settings panel in the EVO Internet browser app"

The website you visit doesn't matter. It just needs to be a flash site that will trigger the exploit. Here's what I used.

5N) Open the Internet browser on your phone and go to this website "www.tinyurl.com/evo1234"
Once the page tries to load, the info on the pc will change. It will say "refresh that page or reopen it, reboot and run part2"
On your phone's browser, you need to refresh the page.

Note: Some people get an error at this point that says:

Code:

/sdcard/part1: cannot create /data/app-cache/com.android.browser/BEC48C17295CAF9
F550BCD500A0A6F03
/data/app-cache/com.android.browser/DE25D64D198E4BF84672045F0EAEE6CE
/data/app-cache/com.android.browser/EAFCD74DF11E57A3571B1E4D0B768134/foo: directory nonexistant
reboot and run part2

If you get this error, check the FAQ in post #2 for "Getting an error on step 5N"

5O) In the address bar of your phone's browser, on the far right, is the refresh icon. (Looks like 2 arrows in a circle) Hit refresh.

After the page reloads on the phone, go back to the command prompt on your pc. Make sure you're prepared for 5Q before you do 5P.

5P) Now type (do not cut/paste this) then hit Enter

Code:

reboot

You're phone will reboot.
As soon as the phone turns back on, while it's still booting up and is on the "HTC EVO 4G" screen, you need to do step 5Q.

Remember in step 5K when you typed "adb-windows shell /data/local/part2" That was done so that now you don't have to type it again.
On your keyboard, you can use the "UP" arrow key to cycle through commands you previously typed in the command window. For step 5Q, you'll need to hit the "UP" arrow key until you get to "adb-windows shell /data/local/part2" that you typed earlier. Should only be "UP" arrow once or twice.

5Q) While the phone is booting up, on your keyboard hit the "UP" arrow key until you see the "adb-windows shell /data/local/part2" you typed in 5K. Once you see that, hit enter.

If you get a message that says "error: device not found" do it again. "UP" arrow once and hit enter. Keep doing this while the phone is booting up until you get a message that says "part 2 is scanning." This will not work until your phone connects to the pc. You have a very short window from the time it connects until it passes the "HTC" welcome screen. I just kept entering it over and over until it worked. I actually entered it 10x's before the phone actually connected and the command worked.

Alternately, if you have sounds enabled on your pc, you'll hear when the phone connects again and you can enter the code once it connects, but you have a small window of time.

If you miss your window, then it will just sit at the "part 2 is scanning" for a long time and your phone will go to the home screen.
Just power off the phone, and start again from this step. Remember to enter the code over and over while the phone is booting up.

If it works, you'll initially get a message that says "part 2 is scanning" then after a short time (mine took about 15secs) you'll get a message that looks similar to this

Code:

/app-cache/com.android.browser/BEC48C17295CAF9F550BCD500A0A6F03/.foo.PWsZ8k
crw-rw-rw- root     root      90,   2 2010-07-05 19:37 mtd1

That was the hard part. The rest is easy.

5R) Now type (or cut/paste this) then hit Enter

Code:

adb-windows shell

Now you should be a "$" prompt

5S) Now type (do not cut/paste this) Hit Enter after each line.

Code:

cat /sdcard/flash_image > /data/local/flash_image
chmod 755 /data/local/flash_image
/data/local/flash_image misc /sdcard/mtd-eng.img

If you typed each line correctly, you won't see any changes and the line will just repeat once when you hit enter. Each command takes a second or two.

5T) Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."

5U) While holding "Volume DOWN", push the "Power" button so the phone turns on. You don't need to hold the "Power" button, but you do need to hold the "Volume DOWN" button. This will bring you straight to the bootloader screen which says
-FASTBOOT
-RECOVERY
-CLEAR STORAGE
-SIMLOCK
-HBOOT USB

Just wait for a minute. It will read your storage card. This takes about 30secs and there is a progress bar on the top right. It's reading the PC36IMG.zip file you placed on the card.

5V) Once that's done, it says, "Do you want to start update?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and then wait.

5W) Once that's done, it says, "Update Complete. Do you want to reboot device?" Volume UP=YES Volume Down=NO. Hit "Volume UP" and you will reboot.

5X) Once your back to the home screen, the EVO should be connected as "Charge Only"
Note: Make sure you have USB Debugging turn on
Menu>Settings>Applications>Development>USB Debugging

5Y) Open a "run" window by hitting the Windows key + "R" in the command line type (or cut/paste)

Code:

c:\evo-recovery\adb-windows shell

then hit "OK"

5Z) In the window that opens, type (do not cut/paste this) Hit Enter after each line.

Code:

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img
reboot recovery

If you typed each line correctly, you won't see any changes and the line will just repeat once when you hit enter. Each command takes a second or two. The last command will reboot your phone into recovery mode.

5AA) From the list, use "Volume DOWN" to highlight "Wipe" and "Power" button to select it.

5AB) In the Wipe menu you're going to use the "Volume DOWN" to highlight "Wipe data/factory reset" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe data/factory reset" twice.

5AC) Use the "Volume DOWN" to highlight "Wipe Dalvik-cache" and "Power" button to select it, then "Power" button again to confirm. Once it's done, repeat this step so you "Wipe Dalvik-cache" twice.

Now push "Power" button to return to the previous menu.

5AD) Use the "Volume DOWN" to highlight "Flash zip from sdcard" and "Power" button to select it.
At this point every zip file on the root of your sdcard will show. Make sure you know which one you're using.

5AE) Use the "Volume DOWN" to highlight your rom or radio file and "Power" button to select it, then "Power" button again to confirm. Sit back and wait. Mine took about 2mins.

When it's done, hit "Power" button to "Reboot system now" and enjoy your rooted EVO w/ a custom rom.

********UN-ROOTING********

This information was copied from The Droid Demos page
He also has a youtube video tutorial

Items you'll need
1- Unrevoked S-On Tool
2- PC36IMG.zip

Section 6 -

Simple Instructions -
If you're comfortable with everything Android related(flashing, recovery, etc.) then its just 2 simple steps:

1) If you used Unrevoked Forever at any time, flash unrevoked-forever-son.zip from recovery until hboot shows S-ON
2) Flash the PC36IMG.zip from hboot

Detailed Instructions -
If you have used Unrevoked forever, start here
6A) Make sure you have downloaded the files linked above. Do not extract them

6B) Connect your phone to your computer via USB and change to "Disk Drive" by dragging down from the notification bar.

6C) If you have NOT used Unrevoked Forever, skip to the instructions below. If you have, transfer unrevoked-forever-son.zip to the root of your sdcard. Do NOT transfer the PC36IMG yet. It'll only cause a hassle and make this take longer.

6D) Once complete, power off the phone

6E) reboot into the recovery by holding VOL DOWN + POWER until it boots to the white screen. Then select RECOVERY.

6F) Depending on what recovery you're using, you need to flash a zip. Select the unrevoked-foreverson.zip that you just transferred and complete the flash.

6G) When complete, power off the phone. Reboot into the bootloader by holding VOL DOWN + POWER until it boots to the white screen. If it says S-ON at the top, select RECOVERY and skip to step 6I. If it says S-OFF, repeat steps 6E-6G Until it does.

If you have not used Unrevoked forever, start here

6H) Power off the phone and reboot into the recovery by holding VOL DOWN + POWER until it boots to the white screen. Then select RECOVERY.

6I) Connect via USB. There is an option for this in both Amon RA and Clockwork.

6J) Transfer the PC36IMG.zip to the root of your sdcard.

6K) EJECT THE PHONE FROM THE COMPUTER and then turn off USB in Recovery

6L) Power off the phone and reboot into the bootloader by holding VOL DOWN + POWER until it boots to the white screen.

6M) It should check the PC36IMG.zip and then ask you YES/NO to apply the update. Press VOL UP for YES

6N) Once complete, Press VOL UP to reboot.

You are now unrooted!

**FastRX8** · #3 (**permalink**) 06-05-2010, 08:59 AM

*****Rooting HBoot 2.02 S-OFF (Unrevoked now works for HBOOT 2.02 and it's easier)*****

*** Important Note about HBoot 2.02 S-OFF ***
Before you use this method you need to make sure you know which version you have. This is for phones that are Hardware version 0004 and HBOOT is 2.02.
To check your hardware version, go to Menu>Settings>About Phone>Hardware Info
To check your HBOOT do this;
Power-off your phone by holding the power-button for several seconds. The top choice is "Power Off."
While holding "Volume DOWN", push the "Power" button so the phone turns on.
Near the top it will display your HBOOT Version. If it says "2.02" then you need this section (Section 7) to root your phone.

This is a copy of the instructions by zikronix found here - [ROOT][GUIDE] HBoot 2.02 S-OFF - Fresh Like Pine Cones Edition - Updated 12/08/10
There is more info in his original thread, including a FAQ and troubleshooting tips. I'm only copying the basic instructions here to keep this thread complete. If you want more step-by-step instructions, try post #1197 in that thread.

Beyond that, I can't really offer much more support. I've never tried this method since my phone is hardware version 0003 and HBoot is not 2.02, I'll probably never actually try this method.

If you get stuck and have a question, please be sure to reference the step # you're having trouble with. And now, on w/ the post...

*Copied post from zikronix below*

UPDATE: THERE WAS AN ISSUE WITH THE RECOVERIES. WE HAD TO HAVE A BETA MADE AND TEST. USING ANY OTHER METHOD TO TURN S-OFF OR ANY OTHER RECOVERY COULD LEAVE YOU WITHOUT THE ABILITY TO FLASH A ROM

IM GOING TO REPEAT MYSELF FOR THE SLOW PEOPLE....USING ANY OTHER RECOVERY SUCH AS CLOCKWORK OR OTHER VERSIONS OF AMON_RA WILL NOT WORK. USING ANOTHER RECOVERY COULD COST YOU YOUR 4G RSA KEYS AND BREAK 4G PERMANENTLY. THIS IS BECAUSE THEY ARE NOT CODED FOR THE NEW PARTITIONS IF IT DOES ITS PURE LUCK!

Credit goes to:
amoamare (Initial method)
toast (fake recovery and script)
unrevoked (thanks for your app)
amon_ra (fixed custom recovery)
chris1683 (thanks for the rom) (sprintlovers)
TrevE (Testing)
Chubbzlou (Testing)

and who ever else I missed

Help me finance my Vette!
zikronix

Downloads:
================================================== ====
V8 - Now Inlcudes a rooted rom and updated radios. No other changes were implemented.

Download Here: hboot202-s_off-V8.zip
MD5: 7d494ee7804a4122e5be1e969ec6893d

RECOVERY FIX FOR THOSE WHO CANT FLASH ROMS (THIS IS ALREADY INCLUDED IN THE PACKAGE ABOVE AND IS FOR PEOPLE WHO ALREADY HAVE ROOTED OR HAVE A BROKEN RECOVERY):

Download Amon_RA Custom Recovery Here: PC36IMG_Recovery.zip

Section 7 -

Lets Get Rooted!
================================================== ====

Before you start
Extract to a folder of your choice. I recommend the root of C:\ into a folder of your choice or on the desktop. Make sure you have the drivers installed for your phone (recommended: SDK Drivers, unrevoked hboot drivers) and USB debugging is on. If possible master reset your phone. At the least reboot the damn thing. This was setup for people running windows, if you have access to it do it on a 32bit version. Use the adb.exe included with the package

7.1) Make sure usb debugging is on, and plug in your phone, DO NOT MOUNT USB
7.2) Open a command prompt and change to wherever you extracted the files
7.3)Type the following (this must be excuted from the folder you extracted to)

Code:

adb push root/unrevoked-forever.zip /sdcard/
adb push root/mtd-eng.img /sdcard/
adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip
adb push root/flash_image /data/local/
adb push root/rageagainstthecage /data/local/tmp

7.4) No Errors hopefully. Now lets change some permissions

Code:

adb shell 
chmod 0755 /data/local/tmp/rageagainstthecage
chmod 0755 /data/local/flash_image

7.5) You shouldnt see any confirmations or any messages. You should still be in the shell. Now its times for the magic....lets root that shell

Code:

./data/local/tmp/rageagainstthecage

7.6) It should kick you out and display some messages on the screen...just not errors. Lets double check that root! Type the following:

Code:

adb shell

You Should see a "#". This means you have root if you see a "$" or some other error message. Reboot your phone, check your drivers, usb debugging and cable and start over. If you got a "#" You can Proceed. You should still be in the shell at a "#" sign

7.7) Once you're at the "#" sign, type:

Code:

./data/local/flash_image misc /sdcard/mtd-eng.img
sync

7.8) Now we are going to reboot your phone into the boot loader to flash the first PC36IMG.zip. You should still be in the shell so type:

Code:

reboot bootloader

7.9) Once your phone is in the bootloader highlight bootloader, and press the power button. It will load the PC36IMG File. When it ask you to flash press VOL-UP. You will notice that it says bootloader bypassed and maybe some other errors. Dont worry this is normal. Once the flash of the file is done it will ask to reboot, Select NO by Pressing VOL-DOWN. Now some people have gotten some errors here and there during the flashing just continue as normal.

7.10) You should still be in the bootloader at this point. Scroll down to recovery and press the power button. When you see the red triangle. Type the following:

Code:

adb push recovery /
adb shell busybox --install /sbin
adb shell nohup /sbin/recovery &

With any luck you should be at a recovery (green screen with text)

7.11) Select enable USB-MS. This will mount your sdcard. Look in the root of your sdcard and you should have two files. One named PC36IMG.zip and one named PC36IMG-MR.zip. Rename the file named PC36IMG.zip to PC36IMG-ENG.zip and then rename PC36IMG-MR.zip to PC36IMG.zip when your done follow the instructions on your phone to disable usb (press power) then proceed to step 12

7.12) Now Select flash zip from the menu and choose unrevoked-forever.zip. Wait for it to complete. Select Reboot from the menu.

Now pay attention. It might kick you back into:

BOOLOADER: See 7.12A
ROM: See 7.12B
WHITE HTC SCREEN: See 7.12C

7.12A) Ok so you got kicked to the boot loader. It should scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 7.13

7.12B) Ok so the phone booted into a rom. Power the phone off. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 7.13

7.12C) Ok so the phone is stuck at a white htc screen. Power the phone off by pulling the battery. Then repower the phone on pressing power and vol-down at the same time. It should take you into the bootloader and scan your card and find the PC36IMG.zip chose yes to flash this file and when it ask you to reboot....reboot by pressing vol-up....Proceed to step 7.13

7.13) Ok your phone is rooted now, and you should be inside the rom. The rom you just flashed is Sprint Lovers 12/05/10 build rom with the modified recovery. Download a rom of your choice copy it to the root of your sd card and flash it. But type the following first

Code:

adb push recovery /
adb shell busybox --install /sbin
adb shell nohup /sbin/recovery &

7.14) You Should be in the recovery menu now (green text screen). Do a backup by navigating the menu. Once thats done, follow the on screen instructions and reboot or flash a rom of your choice. Reboot. If you flashed a different custom rom than the one thats included in the package cool. If not no big deal eitherway. Do a PRL/Profile update while in the rom after the phone is done rebooting. Your Done.

7.15) Read the FAQ for questions

**WarChild** · #4 (**permalink**) 06-05-2010, 08:59 AM

Wow thanks. thats gonna help A LOT!

CW

**p-slim** · #5 (**permalink**) 06-05-2010, 09:04 AM

Actually the revoked website is up and all you have to do is download the apk and it will root for you i think, I'm already rooted so I didn't try it unrevoked.com

**chino331** · #6 (**permalink**) 06-05-2010, 09:06 AM

wow... very thorough, got my Evo rooted easily with your directions. thanks!

Mswezey · #7 (**permalink**) 06-05-2010, 09:39 AM

Great post!

kgbcapthowdy · #8 (**permalink**) 06-05-2010, 10:30 AM

i found this at xda, took 10 mins. super easy

Originally Posted by Alexithymia

Ok, Rooted ROM in 20 steps:

This is summarizing the steps from another xda thread (cant link as i am a new member) into a failsafe rooting procedure for me on VISTA:

1 Get the files on the link provided. Now copy over PC36IMG.zip to your sdcard on your EVO
2 Turn your Phone off
3 Hold VOL DOWN and continue holdint while turning the phone on. When the white screen comes on you can let go.
4 The phone will check the .zip file and run automatically. At two points it will ask for user input. Say yes both times by pressing VOL UP as directed on the screen.
5 Saying YES the second time will reboot your phone. Yay you're rooted. But you won't have superuser access with this rom. Therefore:
6 As soon as you are able after booting change the name of PC36IMG.zip to something else. Developers suggest "root-PC36IMG." Which is what I did (I renamed through mounting the disc drive via windows)
7 Now power your phone down and reboot holding volume down again. This time your phone will try to load something and fail (at least it did in my case)
8 It will provide you with options. Use the volume keys to navigate to "RECOVERY" and use the power button to accept
9 Your phone will display "HTC EVO 4G" then turn to a black screen with an exclaimation point in a triangle.
10 Connect your phone to your computer. In the evo-recovery files you downloaded, run recovery-windows.bat as administrator (by right clicking and choosing the option)
11 A command prompt will pop up and stream files to your phone. This in turn will enable options on your phone.
12 go to backup/restore using the same navigating you have been.
13 Choose nand backup and then confirm. This backs up your NAND in case you EFF things up. It will be stored in a folder on your SD card as NANDROID. be sure to keep a copy safe somewhere.
14 when its done return to the main system recovery menu and enable "USB-MS" which will mount your SD card. Copy over your Supersonic_1.32.651.1_rooted.zip courtesy of Flipz to the root of your SD and then untoggle "USB-MS"
15 Now navigate to "Wipe" in the recovery menu
16 navigate to 'Wipe data/factory reset" and confirm the selection
17 navigate to "Davlik-cashe" and wipe that as well
18 return to recovery main menu and choose "flash zip from sdcard"
19 Choose Supersonic_1.32.651.1_rooted.zip or the rooted rom of your choice and let it install. Choose to reboot your phone. (IF YOU SKIP STEPS 16 AND 17 YOU WILL BE STUCK IN AN INFINITE BOOT AFTER INSTALLING THE ROOTED ROM. This can be remedied by returning to recovery mode (after pulling your batery to stop the loop) and following steps 16 and 17)
20. Superuser access is now available.

Hope that helps