[Droid Incredible Android Development] dnchattan:
TRY THIS AT YOUR OWN RISK

First off, big kudos to the Unrevoked team for finding this!

I've attached a utility I wrote that should automate the whole process with minimal user interaction. I have not yet gotten this to work on my Incredible, but it should work just fine based on the results of this thread- I think my SD is just not triggering the right conditions for the race condition.

To run the utility, just copy it into your tools directory next to adb and the downloaded updates from Unrevoked and run it. There are some switches that you can specify, use the /? switch to see what they are. Most importantly, you can choose between the "adb shell" and "adb devices" approaches to polling the connection.

After getting ADB access in recovery mode, it will give you the option to hit Control-C to abort the process before continuing. If you continue, it will automatically execute the scripts (with a few prompts to the user) described in the walkthrough- including the following scripts at the end:

su
/system/bin/cat /system/bin/sh > /system/bin/su
/system/bin/chmod 4777 /system/bin/su

As well as CityId:

/system/bin/su
/system/bin/rm /system/app/CityID.apk

If anyone tries this and it works, I'd love to know. Meanwhile I'm digging around trying to find a different sd card.

For the skeptics, the following is a log from the app showing the entire process - naturally, there are errors where success would be reported by the scripts being run since I faked the exploit success in the debugger:

IncRootUtility.exe -
Disclaimer: I take no responsibility for any damage or data loss caused by
this application. Use at your own risk!

Thanks to the Unrevoked team for the method!
If you use this app, please consider donating to the Unrevoked team for
finding this exploit!
http://www.unrevoked.com/rootwiki/doku.php?id=public:adb_in_recovery

Your device will now reboot into recovery.
Hit any key to continue.
Rebooting device into recovery
Attempting to establish ADB connection
ADB connection failed

Press VolUp+Power on the device and Power again to reboot device

Rebooting device into recovery
Attempting to establish ADB connection
Recovery exploit successful!

If you wish to do the remaining steps yourself,
press Control-C now to exit this application.
Otherwise, press any key to continue

1. Press volume-up and power at the same time
A menu should appear.
2. Select update.zip by pressing power
It should fail.

Press any key when these steps are completed

Applying fake OTA Update and busybox

adb push busybox /sdcard/busybox
exit
$ adb: permission denied
$ adb push ota.zip /sdcard/update.zip
exit
$ adb: permission denied
$

IMPORTANT:
Select update.zip at the menu again by pressing power. Approximately half a seco
nd after it starts, press enter to run the second command!

Press any key when ready!

adb push payload-update.zip /sdcard/update.zip
exit
$ adb: permission denied
$

Once the update is applied, press any key to execute the su chmod script
Executing chmod script
su
/system/bin/cat /system/bin/sh > /system/bin/su
/system/bin/chmod 4777 /system/bin/su
exit
$ su: permission denied
$ cannot create /system/bin/su: read-only file system
$ Unable to chmod /system/bin/su: No such file or directory
$

Removing CityID

/system/bin/su
/system/bin/rm /system/app/CityID.apk
exit
$ /system/bin/su: not found
$ rm failed for /system/app/CityID.apk, Read-only file system
$

Your device is now rooted! All that's left is to reboot your device!