[HTC Wildfire S] no.human.being:
Ok, I did another exploit that you can use for dumping arbitrary devices to a file on the SD card.

The code is as follows:

/*
* Dumping the contents of a (device) file onto a (regular) file
* To be executed after obtaining temproot via zergRush
*/

#include <stdio.h>
#include <stdlib.h>
const int BLOCKSIZE = 4096;
char* buf;

void waitthis(int sec)
{
int i;

for (i = sec; i >= 0; i--)
{
printf("%d ", i);
sleep(1);
}

printf("\n");
}

int dump(char* source, char* target)
{
printf("Dumping '%s'...\n", source);
int size = 0;
unsigned long offset = 0;
waitthis(5);
printf("Opening %s\n", source);
FILE* fdRead = fopen(source, "rb");

if (fdRead == NULL)
{
printf("Opening %s failed!\n", source);
return(-1);
}

printf("%s open\n", source);
printf("Opening %s\n", target);
FILE* fdWrite = fopen(target, "wb");

if (fdWrite == NULL)
{
printf("Opening %s failed!\n", target);
return(-1);
}

printf("%s open\n", target);
size = fread(buf, 1, BLOCKSIZE, fdRead);

do
{
printf("Reading from '%s', offset: %x\n", source, offset);
fwrite(buf, size, 1, fdWrite);
offset += size;
size = fread(buf, 1, BLOCKSIZE, fdRead);
}
while (!feof(fdRead));

fwrite(buf, size, 1, fdWrite);
fflush(fdWrite);
printf("End of '%s' at address: %x\n", source, offset);
fclose(fdWrite);
fclose(fdRead);
return(0);
}

int main(int argc, char** argv)
{

if (argc == 3)
{
int size;
unsigned long offset;
int i;
int result = 0;
printf("Allocating memory for buffer ...\n");
buf = (char*)malloc(BLOCKSIZE * sizeof(char));
dump(argv[1], argv[2]);
printf("Freeing memory allocated for buffer ...\n");
free(buf);
printf("Done! Please shut down your phone and remove the battery to clean up the mess that this exploit might have left.\n");
}
else
{
printf("Usage: dump <source> <target>");
}

return(0);
}

A compiled version is attached to this post. To perform the dumps, please do the following:

1. Extract the zip and you'll find a file named "dump" (without extension) inside. This is the ARM executable built from the C code shown above. Put the file into "~/android-sdk/platform-tools", where "~/android-sdk" is the path where you installed the Android SDK. Download the zergRush exploit from here and put it in the same directory.

2. Enable USB-Debugging on your phone and connect it to your computer via the Micro-USB cable.

3. Open a shell on your computer and change into the "~/android-sdk/platform-tools" directory, then do:

$ sudo ./adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
$ ./adb push dump /data/local/dump
1181 KB/s (664186 bytes in 0.549s)
$ ./adb push zergRush /data/local/zergRush
1102 KB/s (23060 bytes in 0.021s)
$ ./adb shell

4. Now you're inside a remote shell with your phone. Run the zergRush exploit on the phone.

$ cd /data/local
$ ./zergRush

5. When you get a permissions error, do the following.

$ chmod +x zergRush
$ ./zergRush

6. The zergRush exploit should now run on the phone. When it is through, the remote shell session will close and you will return to your computer's shell. Do the following on your computer's shell:

$ ./adb remount
$ ./adb shell
#

7. Now you're back on your phone and the hash ("#") sign at the command prompt indicates that your remote shell is now running with root privileges. Do the following on your phone's shell:

# cd /data/local
# ./dump /dev/mtd/mtd0 /mnt/sdcard/mtd0.img

8. When you get a permissions error, do the following.

# chmod +x dump
# ./dump /dev/mtd/mtd0 /mnt/sdcard/mtd0.img

This will dump the "mtd0" partition (also called "misc"-partition) to a file called "mtd0.img" on the SD card. Make sure you provide the two arguments in the correct order. The syntax is "./dump <SOURCE> <TARGET>". A device file should always be the source and never the target argument, the target should always be a file on the SD card. If you provide a device file as a target, you might write crap into the phone's NAND memory and potentially brick it or cause data loss.

The "misc"-partition ...

8. When the dump of "mtd0" is through, dump the other devices as well.

# ./dump /dev/mtd/mtd1 /mnt/sdcard/mtd1.img
# ./dump /dev/mtd/mtd2 /mnt/sdcard/mtd2.img
# ./dump /dev/mtd/mtd3 /mnt/sdcard/mtd3.img

"mtd1" is the "recovery"-partition.

"mtd2" is the "boot"-partition.

"mtd3" is the "system"-partition.

"mtd4", "mtd5" and "mtd6" could contain sensitive information ("mtd4" contains cached data, which could essentially be everything, "mtd5" contains user data, "mtd6" contains log files).

9. Leave the remote-shell of the phone and you'll be back on your computer.

# exit

10. Shut down the ADB debugger.

$ sudo ./adb kill-server

11. Shut down the phone, re-insert the battery and boot it again to clean up the mess, that the exploits might have left.

12. Disable USB-debugging and mount the SD card as a storage device on the computer to download the memory images you just created from the phone. Put them in a folder called "s-on" or something like that so that you know these were created while the phone was still S-ON and you can keep them seperate from the dumps you will perform after the S-OFF. Perhaps remove the dumps from the SD card of the phone after you have them on the computer so that you can be sure that the dumps from the second run are in fact new.

13. Do the S-OFF with the xtc-clip

14. Verify that the phone is S-OFF and before you do anything else to the phone (clear memory, flash custom recovery/ROM, etc.) perform the entire procedure again, but put the dumps into a different folder on the computer called "s-off".

15. Put both folders containing the dumps into a ZIP archive and provide it to us.

16. Recieve a bazillion of "Thanks"-clicks in the forum and our biggest appreciation. :D

Thank you very much in advance for your efforts.