[HTC Pico (Explorer)] no.human.being:
It's not a question of having the right set of tools, it's a question of having the signature key. A signature is basically a hash that is encrypted with an asymmetric cryptosystem. It basically works like this.

An HTC engineer generates an RSA key pair consisting of a private key and a public key. The private key is kept secret by the engineer, the public key is built into the HBOOT bootloader that ships with the phone. A property of a strong asymmetric cryptosystem is that the private key can not be derived from the public key in an efficient way (a way that does not take hundreds of years of computing power).

Now the engineer compiles a new DIAG utility and wants it to run on S-ON devices. So he takes the compiled DIAG code, puts it through a hash function (most likely SHA1, I think I've seen a SHA1 implementation in HBOOT) and then encrypts this hash with his private key.

hash = sha1(code);
signature = rsa_encrypt(hash, private_key);

Then he appends the signature to the DIAG utility together with some meta-information.

signature + code --> signed_code

The signed DIAG utility is carried to the customer's phone where a normal HBOOT is running.

--- SNIP --- Now we're no longer at the developer's workstation, but at the customer's phone. --- SNIP ---

The HBOOT running on the customer's phone detects the DIAG utility and now wants to check whether it's valid. So it first splits the signed code again into signature and code.

signed_code --> signature + code

Then it takes the public_key the engineer has put into the HBOOT itself and decrypts the DIAG utility's signature with it, obtaining (hopefully) the original hash that the HTC engineer attached to it.

original_hash = rsa_decrypt(signature, public_key);

Then it hashes the code it extracted from the signed binary and does a decision.

hash = sha1(code);

if (hash == original_hash)
run(code);
else
printf("Invalid signature\n");

If we modify the code, it will create a different hash and thus the signature verification will fail (hash decrypted from signature not identical to hash calculated from code), after all the purpose of a signature is to prove that the content that was signed actually comes from the person who's in posession of the signature key (private RSA key). We can calculate the SHA1 hash of the modified code, but we cannot RSA encrypt it with the engineer's private key, since we don't have that key.

Even though we use the RSA encryption algorithm to encrypt a hash, we don't achieve any confidentiality by doing this. Anyone who has the public key (and this is not meant to be kept secret, in fact it comes shipped with any HBOOT - I don't know exactly where it is and I also don't want to take a look since it won't help if the signature scheme is properly implemented) can decrypt the signature, obtaining an original hash. This operation is required to verify the signature. What we do achieve though is integrity. As soon as we perform a modification to the code, it will with a very high probability hash to a different SHA1 value. If we use the original signature, the values will mismatch. The signature only matches the original code, not the modified one (as it's designed to do). Even though we know into which SHA1 value the signature must decrypt in order to match, we can not generate a signature by encrypting this value, since we don't have the key that's required for this. We only have the key to decrypt (verify) a signature (public key), not the one to encrypt (generate) a signature (private key).