[HTC Wildfire S] theq86:
When I flashed 1.30.401.0 (hboot 0.9) it bypassed installation. so unfortunately there's really no way.

I found out something new:

Yes, after changing misc from L to U, RUU refused flashing. this is evidence for the ruu checks the status here.

However:

After I changed L to U and went into HBOOT, it told me UNLOCKED.

This is evidence the HBOOT ALSO looks @misc partition

Then I experimented a bit.

BL unlocked + rooted + Root Explorer + rw mounted system partition = write access to /system, that's known.

So I changed misc from U to L again, went to hboot, rebooted.

HBOOT reported Relocked. Then I was not able to access /system anymore

So I inverted my steps. I changed misc from L to U, and it worked again.

Strange conclusion: The unlocking mechanism works like the following:

HBOOT reads misc, changes status as stated in misc.

Means, unlocking works after a reboot and a visit to the hboot screen.

I will now go a step further.

I will completely downgrade to 2.13.401.2 (hboot 1.08.0000 not unlockable)

then I will take a look at the misc partition again.

Pittily I have ot your 1.66 RUU with hboot 1.03. and downloading would take hours.

So, here my plan:

downgrade to a standard not unlockable hboot 1.08.0000,look at misc partition of that version, try to unlock that your way. (if a HTCL is included in the downgraded misc)

If I get it to work, you can check again the trick with 1.03.0000.

gonna flash now and tell you afterwards

---------- Post added at 04:12 PM ---------- Previous post was at 03:28 PM ----------

Okay, the misc partition on a downgraded wfs (2.13.401.2, hboot 1.08.0000) contains HTCL

HTCU, however does not make the bootloader unlocked.

Conclusion 1: To unlock bootloader, you MUST have the unlockable HBOOT

Conclusion 2: Has your device been unlocked, you can change the state manually, by changing misc. partition, remove battery, reboot hboot, reboot android. hboot will do the change.

Question: Can we unlock even a phone which has not unlocked before (thus showing LOCKED (OOW)?

We can not be sure. I homehow doubt, that the unlock.bin and the identifier token are useless.

if it were so, it would mean that only if the code matches the token the misc partition is changed. maybe HTC did not know we have a way to change misc partition ourselves and thought, that this were enough, but ...

As we now also know, the fact that the device has been unlocked before is also written to the unmapped area to persist between flashes.

Also we do not know, why the unlocking proces will wipe the data.

What we now need, is a stock phone never ever unlocked before. See it's misc partition if there is a HTCL stub (because it can be that this is generated only on phones that had unlocked before, on a completely locked phone it could make hboot crash).

Then we will flash the unlockable htcdev HBOOT. We will not go further in the htcdev process. Afterwards, again, we must read out the misc partition, looking if it has the HTCL)

First then, we could try to change to HTCU. And if that works, we have prooven your theory.

But, as I already said, I somehow doubt that the unlock code is so useless.

See, the process we could see now is:

* hboot reads misc partition

* according to L or U hboot changes unlock state

But in real, I think the process is as follows:

* hboot looks, if the unlock code has been flashed. (it is somehow flashed into the radio area while unlocking, thus, the hboot even after down and upgrading itself will know if the device was unlocked before)

* hboot looks, if the unlock code matches the device identifier.

* if, and only if the code matches the identifier (which is the case on once unlocked phones, because the unlock code also persists down and upgrades) it reads the misc partition and applies the status.

This is the most probable behavior.