[G2 and Desire Z General] Nipqer:
I know some people out there will use the new "official" htcdev.com unlock option for the G2/DZ, but they will still need to do **** to get root or flash custom roms.

I REALLY RECOMMEND USING THE XDA METHOD OF ACQUIRING ROOT AND S-OFF

S-OFF is possible! We can relock the bootloader to allow a downgrade

Go to FASTBOOT USB mode (where you got the unlock token code, and unlocked the bootloader)

fastboot oem lock

You can then downgrade by following this guide

And get S-OFF with this guide

DO NOT LOCK THE BOOTLOADER IF YOU DON'T WANT TO ROOT PROPERLY!

LOCKING THE BOOTLOADER WILL CAUSE THE REST OF THIS GUIDE TO FAIL!

-------------------------------------------------------------------------------------------------------------------

-------------------------------------------------------------------------------------------------------------------

First, some background as to why these methods are needed.

The HTC 'official' unlock method lets /system be written (given root access) in any mode.

The boot partition, and recovery are only writeable in fastboot mode though. So we need to flash a recovery through fastboot, flash a custom rom, then flash its boot image to be able to boot it.

GAINING ROOT ON STOCK ROM

Gaining Temp Root

DHD USERS WITH SENSE 3.x WILL HAVE TO USE TACOROOT

1. Download the attached files, unzip them, and place the files in your platform-tools folder. To elaborate, place the fre3vo file inside of the fre3vo.zip file in your platform-tools directory.

2. Run the following command to verify the exploit has access to what it needs. (Only the first line is the command. The second line should be the result returned if all goes well.)

> adb shell cat /dev/msm_rotator
[I]/dev/msm_rotator: invalid length[/I]

4. If you received the same message, you're good to continue on. If not... I'd recommend going back to #g2root and asking them. (I am just passing along the information after all).

5. Run the following commands from your platform-tools directory.

> adb push fre3vo /data/local/tmp
> adb shell
$ chmod 777 /data/local/tmp/fre3vo
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF

6. After you enter that command, with luck you should see something similar to the last few lines in the following displayed. (It may take a minute or two. From what I can tell, this appears to be the quickest method as the exploit seems to be found in the latter regions.)

[I]Buffer offset: 00000000
Buffer size: 8192
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba90000...
Potential exploit area found at address fbb4d600:a00.
Exploiting device...[/I]

7. If you did get kicked out of adb shell, open it again. You should now see the lovely # instead of $, thus granting you temp root. Go ahead and exit out of shell to proceed to the next stage.

> adb shell
# exit

Getting Perm-Root

1. Download the attached file, "Vision-fre3vo-temp-root.zip".

2. Extract the contents to your platform-tools directory.

3. Run the following commands in command prompt while in platform-tools directory:

> adb push su /data/local/tmp/
> adb push busybox /data/local/tmp/
> adb push fixsu.sh /data/local/tmp/
> adb install SuperUser.apk
> adb shell chmod 755 /data/local/tmp/fixsu.sh
> adb shell chmod 755 /data/local/tmp/busybox
> adb shell /data/local/tmp/fixsu.sh

Note: If you get permission denied errors on busybox when trying to run fixsu.sh, please let me know.

4. Reboot phone, you should now have perm-root.

FLASHING A CUSTOM ROM

Flashing a custom recovery

Note: this only needs to be done once

1. Download a custom recovery: Latest Clockworkmod, Clockworkmod Touch, 4ext Touch

2. Place the recovery img in the folder with fastboot.exe (which you used to unlock your device), rename the recovery to recovery.img

3. Reboot phone to fastboot mode: Either pull battery and hold TRACKPAD and press power, or run 'adb reboot bootloader' from a cmd/terminal

4. Run

> fastboot flash recovery recovery.img

[I]sending 'recovery' (4930 KB)...
OKAY [ 0.851s]
writing 'recovery'...
OKAY [ 0.819s]
finished. total time: 1.670s[/I]

Flashing a custom rom

1. Download the rom.zip you wish to run.

2. Extract boot.img from the zip and place it in the folder with fastboot.

3. Copy the rom.zip to your sdcard

4. Flash the rom.zip from your sdcard

5. Reboot to fastboot mode (as above)

6. Run from a cmd/terminal

> fastboot flash boot boot.img

[I]sending 'boot' (4096 KB)...
OKAY [ 0.711s]
writing 'boot'...
OKAY [ 1.085s]
finished. total time: 1.798s[/I]

7. Reboot, you will now have a custom rom!

Credits:

Setherio, seeing as I ripped off half his guide.

Pierre_ja, helping figure out how to go about this.

If you get stuck with any of this, join #G2ROOT on freenode

-Nipqer