[HTC EVO 3D] Khilbron:
Ok, so over on the Shift forums, they stumbled upon a way to downgrade your device to allow nand unlocking. *All credit goes to ScaryGhoul, and Otaking71*

Basically by using a temproot method (which the 3D has), and using a misc.img partition from another phone (The Tbolt for this instance), they were able to trick the Hboot security check into allowing older RUU's to be run against the device.

According to Scary, and Otaking the dev work behind this should work for other devices, as long as you are able to identify which BLK houses the hidden partition that Hboot uses to check everything it flashes. As they outlined it is usually "misc", or hboot -1, in the case of the Evo shift, their Hboot partition is mmcblk0p18, so since the hidden partition is hboot -1, it would be mmcblk0p17.

Following their theory, If someone is willing to try this we would need to know which partition the Evo 3D uses for Hboot, we would also need to know if the 3D uses emmc or mtd blocks. If it is emmc the same commands with the proper mmc blocks will work, if it is mtd, we would need to reference the original EVO 4G root method to figure out how to force the hboot to bypass the security checks.

Here is the full post laying out the ground work necessary, including reference to the original Evo 4G root method. http://xdaforums.com/showthread.php?t=1255474

If this works, then it will allow us to run the original RUU for the Evo 3D, essentially downgrading the device from Hboot 1.5 to Hboot 1.30, which then allows the device to be rooted with Revolutionary instead of being forced to use HTC's Unlock method.

Is there anyone out there willing to help dig into this, to see if we can roll back the Hboot of the Evo 3D to allow revolutionary to root it?

---------- Post added at 05:46 PM ---------- Previous post was at 05:29 PM ----------

The direction I am going with this is, If we can force the Hboot to allow downgrades, then that should mean that we should technically be able to force the hboot to downgrade itself, theoretically taking the hboot from 1.50 to 1.30 or 1.40 depending on whichever one you can get your hands on. Also here is some more info added to the whole wrack your brain process this is becoming. Also please ignore my odd way of thinking, I'm trying to think whether or not this is possible, while at the same time gathering data and trying to formulate a process to make it work. I could be entirely wrong about the whole thing, but you never know until you have it looked into and reviewed.

So first step to digging, It looks like the Evo 3D does indeed have emmc partitions http://xdaforums.com/showthread.php?t=1197315

Which makes using their method easier to accomplish.

We should also be able to use the misc.img file from the Tbolt that they used, as long as the size doesnt conflict with the 3D, the version is lower than that of the 3D, so it is still staying true to their groundwork.

So now knowing all of this, we just need someone willing to perform this to try and see if the HBoot can be downgraded accordingly since sofar everything is appearing to line up nicely.

The other question I would then propose is, If this is possible, could it work for 3D's that were unlocked using HTC's method. ie. Unlock with HTC's method, flash a rooted ROM, perform the hboot security bypass using the misc.img file. Then run an RUU that is from the 1.30 or 1.40 HBoot to return the device back to stock, after re-root using revolutionary.

One final thing, The only reason I am bringing this straight to the community without diving into it myself, is that I presently don't have a 3D to work with, but at the same time was tasked by several people that Have 3D's that took the OTA to HBoot 1.50, to see if there was a way to revert the process. That and I have no idea which mmcblk is the hboot partition for the 3D.