[HTC Wildfire S] no.human.being:
Currently we don't care about that at all. We regard an unlocked bootloader as a prerequisite. However, the bootloader can be unlocked without HTCdev's involvement by patching "misc" after installing the HTCdev HBOOT (1.08.0099 or 1.09.0099). Installation happens via RUU iirc? In "misc" (mtd0), there's a "big endian" (most significant bit first) 32-bit word that's either 0xffffffff ("LOCKED (OOW)"), 0x48544355 ("UNLOCKED") or 0x4854434c ("RELOCKED"). The "misc" partition can be accessed from within stock ROM if you're root.

So the way from a stock phone (HBOOT 0.90.0000, stock ROM) to S-OFF without unlock token from HTC is probably.

1. Flash HBOOT-1.08.0099 or HBOOT-1.09.0099 via RUU.

2. Gain temporary root access (zergRush?).

3. Run an app as root that writes 0x48544355 to a specific offset in the "misc" partition. I'm not sure about the offset, but, obviously, you can easily find it out of you're unlocked by dumping your "misc" and looking for the word 0x48544355 in the dump. :D After this step you're bootloader unlocked.

4. Boot our "custom OS" (e. g. Recovery) via Fastboot that maps and patches the HBOOT. No need to install it to the phone, you just need to boot it once and HBOOT can boot kernels that are loaded into RAM. Currently you have to connect to the phone via adb shell and run the exploit, but we could automate this by putting the exploit into the bootup scripts (e. g. "linuxrc") of the OS.

However, all we're doing here is step 4. We simply require that your bootloader is unlocked, no matter how you got to that point. Later when the two efforts are finished, we'll be able to get from "stock" to "S-OFF" without the token from HTCdev, but currently you'll probably be required to get the unlock token from HTCdev. So for the S-OFF effort, we just don't care about how unlocking works, we simply require that the bootloader was unlocked "somehow".

They also patch the HBOOT in NAND. I'm not sure how they gain access to it, since HBOOT-0.90.0000 doesn't have Fastboot support and thus they can't boot a custom kernel on it and AlphaRev did it prior to the release of the HBOOTs that have Fastboot support. So they somehow seem to be able to modify the page tables to "map" the HBOOT while the "stock" operating system is booted or they can somehow talk to the Radio and make it flash the HBOOT. The "GFree" exploit (that is open source) somehow seems to manage to map the "Radio partition" while stock ROM is booted. Don't know how it works though. It contains this very obscure "needle and haystack"-algorithm that I have no idea what it really does, but it somehow seems to map the "Radio partition" without needing to boot a custom kernel. It only works on the firmware for the MSM8255 though iirc. However, the firmware for the other chips probably have similar vulnerabilities, so it'll most likely be possible to implement a similar algorithm for them. But as I don't understand exactly how it works, it's difficult to say how much adjustment it will need in order to get it working on the firmware for the other chips.

We don't need to take the "misc" from a "donor", as we already know what is changed on "misc" by unlocking, so we just need a tool that does these changes without HTC's involvement. Should not be too complicated, as long as the stock ROM kernel lets us write to "misc". I'm not sure whether it does, but at least "misc" is mapped. :D

Also how do you want to "fake S-OFF"? We need an unlocked bootloader in order to map the HBOOT. We can't patch HBOOT to S-OFF when it is not mapped. Therefore we need to unlock the bootloader

fist

and

then

we obtain S-OFF. Currently we simply regard an unlocked bootloader as a prerequisite, so you need to register at HTCdev. But there's another development effort going on that's going to unlock the bootloader without the token from HTCdev by patching "misc".

Yes. Seems to be an installer. There's also a "tar archive only" version though. I "installed" (extracted :D ) that one.