[HTC Wildfire S] yjwong:
Hi guys,

A good friend of mine recently requested me to help with rooting her Wildfire S A510e (purchased from SingTel, CID HTC__044). I managed to change her Wildfire S from S-ON to S-OFF via HTCdev. As far as I know, HTCdev isn't supposed to give you S-OFF but only to remove the NAND write locks on certain partitions.

Users: This is NOT for you. This is NOT a tutorial.​

I will not be responsible for any bricked WFS.​

Here's what happened, pretty long so I'm gonna break it down into multiple sections. Important points in red.

Replacing SingTel ROM with HTC EU ROM

The phone was originally running Android 2.3.3, ROM version 1.35.707.1, HBOOT 0.90.0000. This ROM version is not supported by HTCdev unlock yet.

Reboot to HBOOT on WFS. Choose FASTBOOT.

Connect WFS to computer via USB.

Downloaded the HBOOT RUU for "hTC Asia India" from HTCdev. Attempted to install the RUU but got a CID error.

Disconnected WFS from computer.

Rebooted normally on WFS.

Connect WFS to computer via USB (Disk Drive).

Created a goldcard by using SimpleGoldCard while WFS is mounted as Disk Drive. (this wipes your SD card)

Disconnect WFS from computer and reboot.

Connect WFS to computer via USB (Disk Drive).

Downloaded RUU_Marvel_S_HTC_Europe_2.13.401.2

Ran the RUU. Went into %temp%, found the relevant directory and copied rom.zip to the goldcard as PG76IMG.zip.

Disconnect WFS from computer.

Turn off WFS and rebooted into HBOOT.

Went into HBOOT -> Fastboot. RUU_Marvel_S_HTC_Europe_2.13.401.2 was installed successfully (Android 2.3.5, ROM version 2.13.401.2, HBOOT 0.90.0000).

Installing HTCdev Unlock

Rebooted WFS into HBOOT.

Connect WFS to computer via USB.

Downloaded the HBOOT RUU from HTCdev for "HTC EU".

Ran the HBOOT RUU. RUU installation gets stuck at 50% ("Flushing radio...") for about 20 minutes.

Decided that the RUU has hung so disconnected WFS from USB and did a battery pull

RUU offered to do a recovery but I clicked "Exit".

Turn on WFS in HBOOT mode.

S-OFF obtained!

I was pretty much at "dafuq?" at this stage. I didn't even need to upload the device identifier to HTCdev to get an unlock key. The device was already S-OFF (HBOOT shows it)!

HBOOT remained at 0.90.0000.

I verified the S-OFF by flashing ClockWorkMod which went without issues.

Possible theory of operation: (just my thoughts)

The HTCdev HBOOT RUU provides a temporary S-OFF in order to unlock the NAND

When the RUU is done, it is supposed to restore S-ON to the device.

However, since the process was hung, the RUU had no chance of restoring the device to S-ON.

Hence the WFS was left at S-OFF.

If there are any adventurous devs around who are willing to try to dissect the RUU, please do so, but standard disclaimer applies. Attempting to interrupt the HBOOT RUU flashing is pretty dangerous and WILL possibly brick your device! I will not be held responsible if you brick your WFS!

This seems to be a case of pure luck.

Addendum:

The HBOOT RUU contains 2 ZIP files: rom_01.zip, rom_02.zip

They are presumably flashed in-order.

rom_01.zip contains Radio_special_MARVEL_MR_47.23b.35.3035_7.54.39.08M_Signed_20111208.img

rom_02.zip contains hboot_1.08.0099_6e20b6fac09.nb0 and radio_47.23a.35.3035H_7.53.39.03M_MR.img

My friend has radio version 47.23b.35.3035_7.54.39.08M. From here, we can tell that rom_01.zip was successfully flashed but rom_02.zip wasn't. Also notice the "special" file name of the first radio image.

Addendum 2:

It appears that both radio ROMs have the same size but different md5sum. Can someone with S-ON try to flash Radio_special_MARVEL_MR_47.23b.35.3035_7.54.39.08M_Signed_20111208.img? (Again, standard disclaimer applies)