[HTC Butterfly S] edorner:
Here is an easy way to achieve S-off and root without the need to go through the HTCDev unlock procedure and flashing custom recoveries:

1. Make a backup of all your data, just in case... (E.g. with Helium, which is free and works without root)

2. Make sure that

HTC drivers installed and working (You can download them here: http://xdaforums.com/showthread.php?t=2217396)

HTC sync is removed (not closed – REMOVED)

All other phone software are removed or disabled (Samsung Kies, PDANet, etc.)

There is a working internet connection ON YOUR DEVICE - wifi, 3g, 4g, etc. are all supported.

USB debugging is enabled on your device

Ensure that lock screen security is disabled on your device: no passcode lock, no pattern lock, no face lock

3. Install ADB on your PC (e.g. download and extract fastboot_adb.zip to c:\ADB)

4. Download firewater

5. Download temproot

6. Download su binary for SuperSu (e.g. the one in su.zip, or extract it from the SuperSu zip installer)

7. Place firewater and temproot in the ADB folder (e.g. c:\ADB)

8. Copy the SU binary to the root of your memory card and install the card in your device

9. Connect your device directly to an USB 2.0 port on your PC

10. Open a command prompt, and navigate to your ADB folder (e.g c:\ADB)

11. Important: Reboot your device:

adb reboot

12. When the device rebooted, issue the following commands:

adb wait-for-device push firewater /data/local/tmp
adb push temproot /data/local/tmp
adb shell
chmod 755 /data/local/tmp/temproot
chmod 755 /data/local/tmp/firewater

At this point, you have the temproot and firewater binaries on your device with execute permissions

13. Now start temproot to gain temporary root access via the shell:

/data/local/tmp/temproot

This will take long (5-10min) -> go and grab a coffee :)

14. Once root access is achieved (temproot will inform you about this, and you will see '#' at the end of the prompt instead of '$') you can start firewater:

/data/local/tmp/firewater

For my device, this step took about 2 minutes.

Now you have S-OFF and an unlocked bootloader. Yay! :D

15. Remount the /system partition in order to be able to write it:

mount -o remount,rw -t ext4 /dev/block/mmcblk0p38 /system

16. Copy su to the /system partition and set its permissions

cat /storage/ext_sd/su > /system/xbin/su
chmod 04755 /system/xbin/su

17. Grab your device, enter the Play Store and install SuperSu. At this point you are fully rooted.

18. If SuperSu requests to update the su binary, let it (choose the normal approach, NOT the TWRP/CWM method).

19. Shut down your device, then turn it on in bootloader mode by pressing and holding "power" and "volume down" buttons simultaneously

You should see (the UNLOCKED, TAMPERED, and Ship S-OFF texts)

20. To exit bootloader mode, select the "Fastboot" menu item with the vol up/dn buttons, then enter using the power button. Then choose the "Reboot" menu item the same way.

[OPTIONAL] Locking bootloader and clearing "tampered" flag

21. Start command prompt on your PC. Enter your ADB folder. And issue the following commands:

adb devices
adb shell
su

(I would very strongly recomend you copy/paste the following line)

echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796

exit
exit
adb reboot bootloader

22. Verify you are now locked. Then select Fastboot -> Reboot

23. Issue the following commands:

adb devices
adb shell
su

(I would very strongly recomend you copy/paste the following line)

echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988

exit
exit
adb reboot bootloader

24. Verify that the tampered flag is cleared

25. That's it. Reboot your device and have fun :)

FAQ:

Q: I have been waiting for ages to gain temporary root but nothing is happening!! What should I do?

A: Please be patient. It is a long process (usually 5-10 min)

Q: If I S-OFF/unlock/root my phone using this method, what happens to my apps in /data/preload? Will they get wiped?

A: No, they won't. They will be untouched.

Q: Why are you using that long and complicated command for remounting /system? Wouldn't it be easier to just issue "adb remount"?

A: Sure it would, but unfortunately it would not work, since our stock ROMs use secure ADB and this particular command is only available if the ADB daemon on your device is run in "insecure" mode. More information about the technical background here and here.

Q: Why are you suggesting we use SuperSu as a root management app? What's wrong with Superuser / XXX / YYY ?

A: I have no preference whatsoever. It is only an example. Feel free to use other apps (with corresponding su binary), if you so desire.

Q: Is the su binary inside su.zip safe? Where is it from?

A: Yes, it is safe. It was extracted from the zip installer package of SuperSu v1.93 and was not altered in any way.

Q: My phone rebooted itself when I issued the mount command. What now?

A: Run temproot again, then continue the process starting with reissuing the mount command.

Q: Don't you think XYZ is wrong / missing in your guide?

A: Please reply to the thread or drop me a PM and I will correct it ASAP.

Fine print

I created this guide with the best of intentions, to help people like me, who are more or less new to android but are willing to learn and want to make the most of their devices. I tested the whole procedure on my own Butterfly S 901s 1.23.708.3 without any issues.

However you must keep in mind that during this process you will be modifying vital parts of the system, and doing so always entails some risk. Therefore I cannot and will not take any responsibility if you accidentally brick your device attempting the above procedure.

The tools and most methods used throughout this guide are not my creations. I simply collected and organized information already available but scattered across several topics.

Kudos

to beaups and fuses for bringing us firewater,

to hikezoe and fi01, whose work the temproot is based on,

to daorderdillon for figuring out the way to lock the bootloader and clear tampered flag on an S-OFFed Butterfly S.

to ebautista, who was the first to confirm that firewater does indeed work with the Butterfly S

and of course to koniiiik who encouraged me to start experimenting with the /system remounting :)