[HTC Wildfire S] no.human.being:
Not NBH but NHB. NBH is a file format in which ROM images are supplied. (e. g. "PG76IMG.NBH") :D

How you can dump the Radio is explained here.

Mind that the stuff after "mtdparts=msm_nand:..." supplied to the "fastboot" command depends on the partitioning of your NAND. So far we know of two variations that need different parametrization. Both variations are explained here. However, since you said the Radio version is 7.57, the partitioning will possibly be different from anything we've seen so far (so far we've only seen 7.53 and 7.54).

Because of this, I'd ask you to boot the phone into stock ROM then run the command "cat /proc/mtd" either via a terminal emulation app on the phone or via adb shell, then post the output here and we'll figure out the partitioning, because it's not a trivial procedure.

If you have to figure out the partitioning yourself, you need to do a "cat /proc/mtd" to get the partition sizes. Mind that all of the values are in hexadecimal. You start at 0x20000000 hexadecimal (which is the size of the NAND in bytes). We know that going by increasing physical addresses, the partitions lie in NAND in the following order.

mtd7 --> mtd1 --> mtd2 --> mtd3 --> mtd4 --> mtd6 --> mtd5 --> mtd0

Now you start at 0x20000000 and subtract the sizes of these partitions from "right to left".

So when you subtract the size of mtd0 from 0x20000000, you'll get the physical address where mtd0 starts. From this value you subtract the size of mtd5 to get the physical address where mtd5 starts. From this value you subtract the size of mtd6 to get the physical address where mtd6 starts. From this value you subtract the size of mtd4 to get the physical address where mtd4 starts. From this value you subtract the size of mtd3 to get the physical address where mtd3 starts. From this value you subtract the size of mtd2 to get the physical address where mtd2 starts. From this value you subtract the size of mtd1 to get the physical address where mtd1 starts. The mtd7 is the Radio and will always start at physical address 0x00000000.

Now you have all the physical starting addresses for all of the NAND partitions on the phone. Apart from that, you also need the partition sizes. Remember that "cat /proc/mtd" will output the size of each "visible" partition in hexadecimal. Sum all of these sizes up and subtract the sum from 0x20000000 (the size of the NAND's physical address space) to obtain the size of the Radio ("mtd7") which the "cat /proc/mtd" will not show since the Radio resides in "unmapped memory" that is not accessed by Android under normal circumstances.

Next you need to reorder the partitions by increasing partition number, so that the listing starts at mtd0, then mtd1, mtd2, mtd3 and so on up to mtd7. If you have that, building the kernel parameter to pass to the kernel via Fastboot is almost trivial. The notation is "mtdparts=msm_nand:<partition_size_of_mtd0>@<physical_starting_address_of_mtd0>(<partition_name_of_mtd0>),<partition_size_of_mtd1>@<physical_starting_address_of_mtd1>(<partition_name_of_mtd1>),...,<partition_size_of_mtd7>@<physical_starting_address_of_mtd7>(<partition_name_of_mtd7>)" all in hexadecimal prefixed with "0x". So first it's "mtdparts=msm_nand:" and then the size of mtd0 ("misc"), then an "@", then the physical starting address of mtd0 ("misc"), then an opening brace ("("), then the name of the partition ("misc"), then a closing brace (")"), then a comma (","), then the size of mtd1 ("recovery"), then an "@", then the physical starting address of mtd1 ("recovery"), then an opening brace ("("), then the name of the partition ("recovery"), then a closing brace (")"), then a comma (",") and so on until you finally reach at the size of mtd7 ("radio"), then an "@", the physical starting address of mtd7 ("radio"), which will be 0x00000000, then an opening brace ("("), then the name of the partition ("radio") and finally a closing brace (")"). Look at the examples for Radio 7.53 and Radio 7.54 I provided in the posts I was referring to. Of course your addresses will look different, but the length and formatting of the parameter string will be the same.

After you booted into Recovery with this command line, you can check that "cat /proc/mtd" outputs the partition sizes you expect and that there's now a "radio" partition that appears as "mtd7". Mount the SD card as storage and then dump the Radio using the command "cat /dev/mtd/mtd7 > /sdcard/radio_s-on.img". Afterwards unmount the SD card again and reboot. You can then mount the phone as mass storage and transfer the Radio image file to the PC over the phone's USB connection. Then S-OFF the phone using xtc-clip. Finally, perform the entire procedure again starting from booting the phone into CWM recovery using the Fastboot tool with the correct kernel parameters supplied and dump the Radio again using the command "cat /dev/mtd/mtd7 > /sdcard/radio_s-off.img". Reboot the phone and transfer this image to the PC again. The differences between both images might shed light on where the actual secu_flag lies in the phone's NAND.