[HTC EVO 3D] joefanelli:
I was originally going to just pass this info along for Closeone to put in his thread but he talked me into writing this little how-to. Thanks Closeone!

DISCLAIMER: I am not responsible for anything that may happen with your phone using the method described herein. QPST and QXDM are very, very powerful and can break a phones carrier info if not used properly.

YOU HAVE BEEN WARNED!​

This method only works if you use QPST to backup your carrier info BEFORE downgrading and/or using revolutionary to root/S-OFF AND you take special note of your MEID and ESN.

BACKGROUND:

I am a boost mobile user with a flashed HTC Evo 3D and although I did downgrade perfect to HBOOT 1.4 S-OFF using the tools and methods found here on XDA (Thanks Unknownforce and Closeone!), it also wiped my flash info. I learned all this by being especially paranoid after hearing the same garbage some others have heard about not being able to flash roms on a Carrier flashed phone. Of course I didn’t get my hands on the donor phone that was used so I reverse engineered the flashing process by doing online digging and research.

Ok so on with the show!

Things you’ll be needing:

HTC Diagnostic drivers

CDMA Workshop 2.7+

QPST 2.7 Build 355

QXDM 3.9.19

Android SDK

HxD Hex editor

APN Backup and Restore

------------------------------------------------------------------------------------

Using APN Backup and Restore, backup your APN. This is your MMS info.

While using QPST, QXDM or CDMA Workshop we will be keeping the Evo 3D in Diagnostics mode. To do this open your dialer and enter “##DIAG#” as if you were dialing a phone number.

On your phone in “About phone” and then “Phone Identity” copy your MEID!

In CDMA Workshop, "Security" tab, SPC (Also known as an MSL code) – type in your SPC (MSL) - send. Note that your MSL if using a pre-flashed phone is probably “000000”. You should get a message saying that the SPC code is correct and the phone is unlocked.” Once the phone is unlocked, click on the memory tab. go to NV Items read and save items: 465,466,1192,1194; they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and save it as 465 then move on to the next item and do the same. Remember to save it somewhere handy, as we will need the later on. Occasionally depending on the type of phone that was used for a donor there might not be anything in 1192 or 1194 that’s ok. While still in CDMA Workshop click the NAM Tab. Click “Read” this will display all your phones information inside of “NAM 1” Save the filename as NAM 1 and do the same for NAM 2.

Now close Cdma Workshop. Open up QPST Service Programming (IF YOU HAVE NOT ALREADY, TAKE NOTE OF YOUR “MEID” AND “ESN”) and enter your phones SPC. Click Read and SAVE. Now navigate to the “MIP” Tab, we need your phones NAI. Click on Profile 1 and copy down your “NAI”, Primary HA and secondary HA address, MN-HA SPI1, MN-AA SPI1 and then note if “Rev-Tunnel Preferred” is checked or not.

Ok now Close QPST Service Programming and open up QXDM. In the command input windows type. Password 000000 (or whatever MSL you have) hit enter. Now type “Requestnvitemread ds_mip_ss_user_prof” without quotes . This will find your Ha Shared and AAA Passwords for profile 0. HA Shared which should be “736563726574” if youre on boost like me. For your AAA Provisioning password open up Nvitem 466 and read your 32 digit password after the “10”, save and return back to Qxdm. Now enter “Requestnvitemread ds_mip_ss_user_prof 1” for Profile 1, once again you HA Shared will be “736563726574” if youre on boost then scroll down for your AAA Password, this password will be 6 digits long located starting after the line “mn_aaa_shared_secret_length = 0x06”.

Ok good, that’s all the info you need to keep safe. Now the procedure for recovering the flash using this info! It’s actually quite simple, we’re just going to take the steps above and now load and apply them instead of saving them.

Throw that sucker into diagnostics mode like earlier and now plug it into your computers USB and fire up CDMA Workshop and enter your SPC/MSL. Remember The NAM info we saved? Click the NAM tab then load the saved file (NAM1 for NAM1, NAM2 for NAM2 DO NOT WRITE THEM TO THE WRONG PLACE!).

Next open QPST, enter your security info (SPC/MSL) and then read from the phone. After it loads your phones info click load, find the QPST saved file we created earlier and click write. Your phone will reboot after which open QPST back up and click read again. Make sure all the info is correct compared to what I mentioned to write down. If all is correct onto the next step!

Most likely all your info is correct except for the MEID/ESN.

Now, due to the respected rules and regulations of this forum and the powers that control/own it I cannot go into detail as to the process of correcting your MEID/ESN. If you need any assistance in this matter please PM me and I will set you on the right path. I really don't mind especially since it's a crucial part should your flash die. I will NOT answer posts to this question you MUST PM me. Sorry for the inconvenience!

Now you can restore your APN using APN Backup and Restore after which you should reboot your phone. Once it’s up and running connect to any WIFI and then update your Profile and then your PRL. I’m not sure if doing it in that order or even being connected to wifi is necessary but that’s what I did and it worked for me. You should now be back to full flash and 1.4 HBOOT!

I hope this helps because it was a complete nightmare during the 6 straight hours it took to solve this issue and I’d hate for anyone else to go through all that.