[HTC EVO 3D] S-trace:
I recieved some images of this partition fom mine russian friends and compared them. Here is results:

4 bytes at offest 0x824 are unique for every phone. There is "simlock" string near this bytes. I think it's used to generate sim lock code.

4 bytes at offset 0x424 are unique for every unlocked or relocked phone. I recieved only one image from locked phone, but this bytes was same for mine and that image. It's too little to be sure, but it's looks like it's same for every locked phone. it's 0x4ED7B921

16 bytes at offset 0x9400 - unique for every phone

another 16 bytes at offset 0x9410 repeats 265 times (until 0xA49F) and unique for every phone. - 4040 bytes at all.

previous 16 bytes again at offset 0xA800 repeats 32 times (until 0xA9FF) and unique for every phone. 512 bytes at all.

Are You have wire-trick s-off? Phones with new motherboard are much more interesting than stock.

I have one image of mmcblk0p3 partition from such phone. There is some more differences in it, comparing to stock phone:

4 bytes at offset 0xC24 (near "simunlock"string - at all other images those bytes was same.

256 bytes at offset 0xAD00 - all other images had 0x00 at this offset. It's NOT Unlock_code.bin.

previous 256 bytes again at offset 0xB100 - again same 256 bytes. All other images had 0x00 at this offset. It's still NOT Unlock_code.bin.

Here is Bash script. Correct ADB= string to which adb output for Your system or full path to adb binary, then save it as adbflasher, then chmod +x adbflasher

Connect Your S-OFF Evo 3D to PC and run ./adbflasher read security_record security_record.img - this will be mmcblk0p3 partition image.

#!/bin/bash
set -x
E_WRONGCOMMAND=65
E_WRONGPARTITION=66
E_ERASE=67
ADB="/opt/android-sdk-update-manager/platform-tools/adb"

fs_write() {
echo fs_write $*
local param_fs=$1
local param_file=$2
local param_device=$3
exportfs none
exportfs $param_fs

device_detect $param_device
sudo pv $param_file|dd of=$device bs=65536
sync
exportfs none
}

fs_read() {
echo fs_read $*
local param_fs=$1
local param_file=$2
local param_device=$3
exportfs none
echo calling exportfs $param_fs
exportfs $param_fs
echo calling device_detect
device_detect $param_device
sudo pv $device |dd of=$param_file bs=65536 &
exportfs none
}

fs_erase() {
echo fs_erase $*
local param_fs=$1
local param_device=$2
case $param_fs in
security_record) echo Erasing partition $param_fs not allowed: it may brick Your phone!; exit $E_ERASE;;
hboot) echo Erasing partition $param_fs not allowed: it will brick Your phone!; exit $E_ERASE;;
emmc) echo Erasing partition $param_fs not allowed: it will brick Your phone!; exit $E_ERASE;;
none) echo Unable to erase partition $param_fs!; exit $E_ERASE;;
*) fs_write $param_fs /dev/zero $param_device ;;
esac
}

exportfs() {
echo exportfs $*
case $1 in
security_record) partition=/dev/block/mmcblk0p3;;
hboot) partition=/dev/block/mmcblk0p12;;
radio) partition=/dev/block/mmcblk0p17;;
adsp) partition=/dev/block/mmcblk0p19;;
boot) partition=/dev/block/mmcblk0p20;;
recovery) partition=/dev/block/mmcblk0p21;;
system) partition=/dev/block/mmcblk0p22;;
data) partition=/dev/block/mmcblk0p23;;
cache) partition=/dev/block/mmcblk0p24;;
devlog) partition=/dev/block/mmcblk0p27;;
emmc) partition=/dev/block/mmcblk0;;
sdcard) partition=/dev/block/mmcblk1;;
none) partition="none";;
*) echo Wrong partition: $1; exit $E_WRONGPARTITION;;
esac
legacy="/sys/devices/platform/usb_mass_storage/lun0/file"
recent="/sys/devices/platform/msm_otg/msm_hsusb/gadget/lun0/file"
until $ADB shell "echo $partition > $legacy" ; do sleep 1;done
until $ADB shell "echo $partition > $recent" ; do sleep 1;done
until $ADB shell "echo $partition |su -c \"tee $legacy\"" ; do sleep 1;done
until $ADB shell "echo $partition |su -c \"tee $recent\"" ; do sleep 1;done
echo exportfs $* done
}

device_detect() {
echo "device_detect $*"
device=`find /dev/disk/by-id/|grep -i Android|sort|head -n 1` ## TODO: write better detect function!
if [[ "z$1" != "z" ]] ;then device=$1; fi
}

usage() {
echo "Usage: adbflasher flash hdsp boot.img [device_to_flash]
adbflasher flash recovery recovery.img [device_to_flash]
adbflasher flash radio radio.img [device_to_flash]
adbflasher flash hboot hboot.img [device_to_flash] ## Dangerous!
adbflasher flash adsp adsp.img [device_to_flash]
adbflasher flash emmc emmc.img [device_to_flash] ## Extremly dangerous! DO NOT FLASH ANY FILE EXCEPT YOUR HAVE READ FROM YOUR PHONE EARLIER!
adbflasher exportfs {hboot|radio|adsp|boot|recovery|system|data|cache|devlog|emmc|sdcard|none}
## Might br dangerous! ALWAYS do exportfs none before exportfs another partition!
adbflasher read {security_record|hboot|radio|adsp|boot|recovery|system|data|cache|devlog|emmc|sdcard|none} filename.img [device_to_read]
adbflasher erase {radio|adsp|boot|recovery|system|data|cache|devlog|sdcard} [device_to_erase]"
}

if [[ $# -eq 0 ]] ;then usage; exit $E_WRONGCOMMAND; fi
case $1 in
exportfs) exportfs $2 ;;
erase) fs_erase $2 $3 |exit $? ;;
read) fs_read $2 $3 $4 |exit $? ;;
flash) fs_write $2 $3 $4 |exit $? ;;
*) echo "Wrong command: $1"; usage; exit $E_WRONGCOMMAND ;;
esac

#until /opt/android-sdk-update-manager/platform-tools/adb reboot ; do sleep 1;done