[HTC Wildfire S] munjeni:
I don't know! I moved/increased recovery partition to offset 0 with lenght 0x2840000, but that not working but I expected it will work (I was wrong)! I think, maybe I not patched hboot corecly in order to do that hack... so idea is totaly unsucesfull.

Playing now with fastboot command mb (memory dump in byte mode) and eb (memory write in byte mode)... found something interested there. Hboot loading offset in aria is 0x9d000000. Using linux machine and TJ tutorial about comunication with radio I connected device to linux machine usb port, switched to hboot_usb_plug, unloaded qcserial module by sudo modprobe -r qcserial, loaded generic usbserial module by sudo modprobe usbserial vendor=0x0bb4 product=0x0c94, connected screen to ttyUSB0 by screen -L /dev/ttyUSB0, and finaly got generic usb serial conection to hboot protocol. Now I am conected to hboot. Writing command h got a lot of available commands (thats the same as a fastboot oem ?). Next thing. Back to command fastboot oem mb and eb. In windows machine I can not use fastboot oem eb 0x9d000000 because it stop on

hboot>eb 9D000000
Address Value
------- -----

and I was not abble to anter anything to terminal, its still like freze. But in linux machine and using command screen I am abble to enter values normaly (one by one)... see log:

hboot>mw 9D000000
memory dump
9D000000: EA000012 32302E36 | ....20.6
9D000008: 3030312E 00000032 | 001....2
9D000010: 37323237 4C505320 | 7227LPS
9D000018: 00000000 E1A00000 | ........
9D000020: 50494853 00000000 | PIHS....
9D000028: E1A00000 E1A00000 | ........
9D000030: 4F4F4248 32372D54 | OOBH27-T
9D000038: 00003732 E1A00000 | ..72....
9D000040: 74726964 35342D79 | trid54-y
9D000048: 38396662 00003137 | 89fb..17
9D000050: E10F0000 E3801080 | ........
9D000058: E129F001 EE110F30 | .).....0
9D000060: E3800102 EE010F30 | .......0
9D000068: E3A00000 EE070F9A | ........
9D000070: EE110F10 E3800602 | ........
9D000078: EE010F10 E3A00000 | ........
9D000080: EE070F9A E3A00102 | ........
9D000088: E3800016 EE0F0F92 | ........
9D000090: E28F0000 EB0000DD | ........
9D000098: 40000000 12C00000 | @.......

hboot>ew 9D000000
Address Value
------- -----
9D000000 EA000012->EA000012

9D000004 32302E36->32302E36

9D000008 3030312E->3030312E

9D00000C 0032->00000032

9D000010 37323237->37323237

9D000014 4C505320->4C505320

9D000018 0000->00000000

9D00001C E1A00000->E1A00000-

9D000018 0000->0000

9D00001C E1A00000->

9D000020 50494853->

9D000024 0000->

9D000028 E1A00000->

9D00002C E1A00000->

9D000030 4F4F4248->

9D000034 32372D54->

9D000038 3732->

9D00003C E1A00000->

9D000040 74726964->

9D000044 35342D79->

9D000048 38396662->

9D00004C 3137->

9D000050 E10F0000->

9D000054 E3801080->

9D000058 E129F001->

9D00005C EE110F30->

9D000060 E3800102->

When I enter ew (writing in litle endian mode to hboot in memory) or eb (writing in byte mode) using csreen and linux machine I got "current data" and "->" -> mean "enter new data", so I can enter hex data one by one to input "->"

hboot>ew 9D000000
Address Value
------- -----
9D000000 EA000012->

9D000000 EA000012->here I need to write something and than pres enter until I get next part of line (memory) for example 9D000004 32302E36->... its something like part by part writing (see previous log to understand)... for example ew 9d000000:

hboot>ew 9D000000
Address Value
------- -----
9D000000 EA000012->EA000012

address in memory is 9d000000, current data (in hex) is ea000012, input -> (enter new data), here you can write new data, than press enter to go to next line/part...

Question is: is that mean we can patch hboot by self in memory by writing byte by byte to him using comand eb or ew ??? My battery is empty now but this is realy very interested and I will play now with this :) for example will try to change hboot version that is displayed on phone display