[HTC Wildfire S] no.human.being:
Ok, the moment of truth has come! :D

Unfortunately the process is not automated at all yet, so it's a bit of a lengthy procedure. We're gonna make this more "self-contained" once we verified it to work so that we attract more "beta testers" who are afraid of "bad usability". :D

You need to be on either HBOOT-1.08.0099 or HBOOT-1.09.0099 and be bootloader unlocked via HTCdev. You'll need a ClockworkMod recovery image on your computer (CWM recovery installed on the phone is not sufficient, but not a prerequisite either). And you'll need a working Android SDK with Fastboot.

Download the package I've attached to this post and extract the contents into the root of your phone's SD card.

Attach your device to the computer via USB and boot it into the bootloader's "Fastboot" mode. if you are on CyanogenMod there's a "Reboot --> Bootloader" option, if you are stock, you'll need to power the phone off, remove the battery, reinsert it again, then hold the phone's "Volume down" button and press "Power" while holding volume, then press "Power" once more once the bootloader appears to enter "Fastboot" mode.

You then open a command prompt, cd into "$ANDROID_SDK_PATH/platform-tools". I suppose you put the CWM recovery image into the same folder, as then you won't have to supply a path. Run one of the following commands depending on your HBOOT version.

If you are on HBOOT-1.08.0099:

./fastboot -c "mtdparts=msm_nand:0x00100000@0x1ff00000(misc),0x00500000@0x02fc0000(recovery),0x00340000@0x034c0000(boot),0x10400000@0x03800000(system),0x02300000@0x13c00000(cache),0x09600000@0x16900000(userdata),0x00a00000@0x15f00000(devlog),0x00080000@0x02b00000(hboot)" boot recovery-clockwork-5.0.2.8-marvel.img

If you are on HBOOT-1.09.0099:

./fastboot -c "mtdparts=msm_nand:0x000a0000@0x1ff60000(misc),0x00500000@0x026c0000(recovery),0x00340000@0x02bc0000(boot),0x10d60000@0x02f00000(system),0x02300000@0x13c60000(cache),0x09600000@0x16960000(userdata),0x00a00000@0x15f60000(devlog),0x00080000@0x02400000(hboot)" boot recovery-clockwork-5.0.2.8-marvel.img

The device should boot into recovery, but with its HBOOT mapped as mtd7 partition (this is why booting into the recovery that's on the device is not sufficient, even if you have CWM installed). On the recovery select "mounts and storage" --> "mount /sdcard" --> "+++++ Go Back +++++". Then you'll start adb and open a shell to the phone.

$ ./adb start-server
$ ./adb shell

If you're on Linux and did not configure adb for "non-root" access to the phone, you must execute the first command as "sudo". Either way will take you to a remote shell with the phone. On this remote shell you first confirm that the HBOOT is mapped as "mtd7".

~ # cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00040000 "misc"
mtd1: 00500000 00040000 "recovery"
mtd2: 00340000 00040000 "boot"
mtd3: 10400000 00040000 "system"
mtd4: 02300000 00040000 "cache"
mtd5: 09600000 00040000 "userdata"
mtd6: 00a00000 00040000 "devlog"
mtd7: 00080000 00040000 "hboot"
~ #

Then you "cd" to your SD card and list its contents using the "ls -l" command.

~ # cd /sdcard
/sdcard # ls -l
drwxrwxrwx 3 root root 4096 Jan 7 04:51 Android
drwxrwxrwx 5 root root 4096 Jan 9 17:46 DCIM
drwxrwxrwx 2 root root 4096 Jan 7 04:51 LOST.DIR
drwxrwxrwx 2 root root 4096 Feb 21 16:42 Music
drwxrwxrwx 3 root root 4096 Jan 25 13:42 clockworkmod
-rwxrwxrwx 1 root root 676927 Mar 5 01:03 inject
drwxrwxrwx 2 root root 4096 Mar 5 00:47 mtdutils
/sdcard #

These are the contents of my SD card. You see the file "inject" (which is the exploit) and the directory "mtdutils" (which contains utilities for erasing the phone's NAND). These belong to our exploit. Execute the exploit by supplying the following command.

./inject --disengage-the-safety /dev/mtd/mtd7

This should patch your HBOOT to S-OFF by an exploit that's probably quite similar to what Revolutionary is doing. When the exploit is through, you can leave the remote shell via

/sdcard # exit
$

This will take you back to your computer's shell. On the phone select "power off". This will power the device down. Remove the battery and reinsert it again, then boot it again into HBOOT mode by holding the "Volume down" key while pressing "Power". If your HBOOT says "MARVEL PVT SHIP S-OFF RL", we're gonna start celebrating tonight. :D