How to Unlock Nand Protection and Install Recovery Menu Permanently!

For those of you who have rooted your HTC Evo and have been messing around with different ROMs on your HTC Evo 4G, you know you can use ROM manager but there’s also another way, by unlocking Nand protection and installing the recovery menu permanently. (Thanks to XDA Developers!)

I tend to like the latter option better because it has Nandroid, I like the Nandroid backup/recovery.

By installing this mod, you should/be able to backup/restore different ROMs on the go.  (Also you can do it with ROM manager of course but ROM manager doesn’t work under unrooted ROMs so you’d have to go back to command line method.)

First, let’s backup your current ROM (whatever you are using) by using command line and Nandroid.  Because we will have to “downgrade” your ROM in order to unlock the Nand protection.

Second, you will want to download these 4 files:

PC36IMG.zip
mtd-eng.zip
flash_image.zip
recovery.img

Next, unzip both mtd-eng.zip and flash_image.zip, which will get you mtd-eng.img and flash_image.

Connect your HTC Evo 4G to your computer, choose “Disk Drive”, then copy the files mtd-eng.img, flash_image, recovery.img and PC36IMG.zip to the root folder of your HTC Evo 4G’s SD card.

Change your HTC Evo 4G to “Just Charge” mode because we will need to access the SD card from ADB shell.

Go to your SDK Tools folders (where you installed Android SDK such as C:\sdk\tools), then type “adb shell“.

Next, type in the following three commands:

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image misc /sdcard/mtd-eng.img

Now, turn your phone off and reboot it into hboot/bootloader by pressing the Power button while holding down the Volume Down button.

Wait about a minute or two and your Evo 4G should ask you if you want to update the zip file.  Say yes by pressing the Volume Up button.

When it’s done, hit the Volume Up button again to reboot.

After you reboot, choose “Disk Drive” for your Evo 4G, then erase the PC36IMG.zip file as we don’t need it anymore and your phone will try to update it again when you go back into the hboot/bootloader mode.

Next, set your HTC Evo 4G as “Charge Only” again and go back to the SDK Tools folder, then type “adb shell” again.

cat /sdcard/flash_image > /data/flash_image
chmod 755 /data/flash_image
/data/flash_image recovery /sdcard/recovery.img

(*Note – I got an error message that it couldn’t write a block but I think you can ignore it as my Recovery menu is working just fine now.)

Congratulations! Now you’ve officially unlocked the Nand protection and you can access the “new” Recovery menu to backup/restore/flash new ROMs!!!

Turn your HTC Evo 4G again then press Power button while holding down the Volume Down button.

Select “Recovery” using your Volume keys then hit the Power button.

You should have arrived at the new Recovery Menu. You can always enter this new Recovery Menu to flash/backup/restore new HTC Evo 4G ROMs.

Now, let’s restore your previous ROM before we unlocked the Nand protection so choose “Backup/Restore”, “Nand Restore”, then locate your last backup. (It’s organized by date.)

Restore your previous ROM, reboot, and voila!

Enjoy!

If you like this post, don't forget to Like us on our Facebook page!

Want to stay updated on latest HTC Evo hacks and tips?
Sign up for our HTC Evo Hacks Newsletter here so you don't miss a single tip!

Recent Android News from HighOnAndroid.com



52 Responses to How to Unlock Nand Protection and Install Recovery Menu Permanently!

  1. eyecon82 says:

    Awesome thank you….can you give us a guide to update the radio that is in the XDA thread afterwards? Thank you

  2. saintsfan says:

    i still cannot get this to work.

  3. saintsfan says:

    My adb does not read from charge only

  4. sean says:

    I dont know whats going on i tried everything you said but the ADB shell isnt working.

  5. Saintsfan says:

    FYI just goint mine to work. In order to access ADB shell the phone has to be in HTC Sync Mode. But the directions are flawless thanks so much xedomax you are the man

  6. Somu says:

    Hi I am trying this for the third time now. I am getting the follwing message: Main version is older! Update Fail! While trying to boot to the PC36IMG.zip
    Also when I was at the step:
    /data/flash_image misc /sdcard/mtd-eng.img
    I got the follwing message:
    SPCS_001 DeviceWarmBoot CE: not found

  7. Jonah says:

    somehow i cant download the pc36img and recovery.img.. help please

  8. Bryan says:

    Thank you very much. You’re videos helped me a lot. If you keep it up we might have to donate so that you can get a tripod for your camera 🙂

    Now that I have finished unlocking Nand Protection do I no longer need ROM Manager? And if so, can I then delete the update.zip on my sdcard which put the phone into Clockwork’s Recovery?

    • HTC Evo 4G Hacks says:

      Yes, you don’t need ROM manager, you can leave the update.zip if you want to, that’s up to you.

  9. Jonah says:

    the pc36img zip does not seem that working.. when i click it, it says “550 Can’t change directory to /PC36IMG.zip: Permission denied”

  10. laarmyguy20 says:

    The links for – PC36IMG.zip and recovery.img are not working, please update. Thank you fo rthe great walkthroughs I have had 100 percent success thus far.

  11. Billy Tolliver says:

    ok question_

    my Evo is bugging the crap out of me to do the new update, so much so that if the screen pops up while im sleeping, my alarm wont go off, i have been late for work TWICE because of the dumb update screen! so i need to make it go away, so i kind of need to update. BUT my phone is rooted and i have the Wifi Tether, thats all i want, free tethering, the whole reason i went through this whole rooting shenanigans, SO if i do the freaking update, will i have to kiss my free tether app “bye bye”? i mean i really dont care if i can add other crap, i just dont think i need to pay sprint $30 for their tether app. PLEASE HELP!

  12. Juan Leal says:

    Baby Bill: Settings > System Updates > HTC Software update > Scheduled Check [ uncheck this option ] Problem. Resolved.

  13. EvoRoy says:

    My computer is giving me an error when I try and unzip the folders do I just copy them straight to the SD card without unzipping? Or am I doing something wrong?

  14. SanityKills says:

    Okay, here’s my situation. I want to perform Nandroid backups since Titanium Backup kills my syncs (even when relinking them all my contacts disappear & I have to do a factory restore to rebuild). Nandroid apparently requires ROOT. ROOT kills my Sprint Hotspot that I’m paying $30/month for. (I am NOT planning on going with Wifi tethering just yet.) Is there a way to set this up to where I can still access Nandroid backup with stock Sprint ROM or equivalent?

  15. AuthenticM says:

    The “PC36IMG.zip” and the “recovery.img” links are not working. Unable to download. 🙁

  16. Anderson says:

    If u rooted da evo wit da drivers den of course adb shell is going to work with “charge only” the people who used HTC Sync instead of updating adb wit da other drivers max gave you links to, instead of putting c”harge only, use “HTC Sync”

  17. saintsfan says:

    Do we need to install a custome recovery such as the new a-mon-ra or clockwork?

  18. Pingback: How to Unlock NAND on HTC EVO « reginaldstinson.com

  19. Paul says:

    Question similar to Saintsfan, but in my case if I install the Clockwork MOD do I loose the Unlocked Nand mod I just installed following this tutorial? Is there a way of telling if I still have the NAND protection removed?
    Thank you Maxx for all this steps and details.. it has been easy to hack the phone.

  20. Mohsen says:

    I can not download the required files!! Is there an alternative link?

  21. Aaron says:

    The PC36IMG.ZIP link above doesn’t work. An alternative link is http://sdx-downloads.com/sdx/evo/troot/eng-PC36IMG.zip [thank you to toastcfh from his tutorial at http://forum.xda-developers.com/showthread.php?p=6800690 ]. Other needed files should be at the latter link.

  22. Billy Tolliver says:

    ok lets try this again, if u do the new update and it UNroots my phone, will my free wifi tether still work? thats all i even rooted it for so idc if its rooted or not as long as i can still use that

  23. Russ says:

    I just got the phone tonight and The Sprint rep updated the phone, When I attempt the root I am getting “Main Version is Older!” “Update Failed”. Am I screwed until there is a new root for the new version?

    • Hollow says:

      Hey Russ,

      It sounds that way. if your software version ends in a .6 then yeah buddy your kinda screwed!

  24. Brooklyn says:

    AHmm Yea!! the recovery file isn’t loading does anyone know how to make this work. Plus i rooted mi evo w.o the adb from mobile devices in the device manager. So mi question is…would i still be able to unprotect the nandroid? Please i wanna do dis b4 2mrw!!

    Cheers!!!

  25. Brooklyn says:

    actualli, wanna get this done tonite…

  26. brooklyn says:

    Come on man dis is redic… evri1 has da sme issue w this reoveri image file n da PCG File but u guys cant repsond to a resolution. Ppl r dependin on u to cme thru n ur failin us js lke our Predsident. Im sadden by hw u treat ppl who hv a fone tht is unlke ani otha n r so excitd to be hack crasi but u js contine to let us down. I mean if yal want it paid then sai tht but dnt leave us hangin. Let see if ds gts ur attention.

    Cheers!

  27. Shadowtat says:

    I get this on the CMD on the last code I put in. Please help me!!
    I am sorry for the length of the post, but I wanted to give you all of the info.
    Thank you for helping me on this.

    C:\sdk\tools>adb shell
    # cat /sdcard/flash_image > /data/flash_image
    cat /sdcard/flash_image > /data/flash_image
    # chmod 755 /data/flash_image
    chmod 755 /data/flash_image
    # /data/flash_image recovery /sdcard/recovery.i
    /data/flash_image recovery /sdcard/recovery.img
    mtd: erase failure at 0x00000000 (I/O error)
    mtd: erase failure at 0x00000000 (I/O error)
    mtd: skipping write block at 0x00000000
    mtd: erase failure at 0x00020000 (I/O error)
    mtd: erase failure at 0x00020000 (I/O error)
    mtd: skipping write block at 0x00020000
    mtd: erase failure at 0x00040000 (I/O error)
    mtd: erase failure at 0x00040000 (I/O error)
    mtd: skipping write block at 0x00040000
    mtd: erase failure at 0x00060000 (I/O error)
    mtd: erase failure at 0x00060000 (I/O error)
    mtd: skipping write block at 0x00060000
    mtd: erase failure at 0x00080000 (I/O error)
    mtd: erase failure at 0x00080000 (I/O error)
    mtd: skipping write block at 0x00080000
    mtd: erase failure at 0x000a0000 (I/O error)
    mtd: erase failure at 0x000a0000 (I/O error)
    mtd: skipping write block at 0x000a0000
    mtd: erase failure at 0x000c0000 (I/O error)
    mtd: erase failure at 0x000c0000 (I/O error)
    mtd: skipping write block at 0x000c0000
    mtd: erase failure at 0x000e0000 (I/O error)
    mtd: erase failure at 0x000e0000 (I/O error)
    mtd: skipping write block at 0x000e0000
    mtd: erase failure at 0x00100000 (I/O error)
    mtd: erase failure at 0x00100000 (I/O error)
    mtd: skipping write block at 0x00100000
    mtd: erase failure at 0x00120000 (I/O error)
    mtd: erase failure at 0x00120000 (I/O error)
    mtd: skipping write block at 0x00120000
    mtd: erase failure at 0x00140000 (I/O error)
    mtd: erase failure at 0x00140000 (I/O error)
    mtd: skipping write block at 0x00140000
    mtd: erase failure at 0x00160000 (I/O error)
    mtd: erase failure at 0x00160000 (I/O error)
    mtd: skipping write block at 0x00160000
    mtd: erase failure at 0x00180000 (I/O error)
    mtd: erase failure at 0x00180000 (I/O error)
    mtd: skipping write block at 0x00180000
    mtd: erase failure at 0x001a0000 (I/O error)
    mtd: erase failure at 0x001a0000 (I/O error)
    mtd: skipping write block at 0x001a0000
    mtd: erase failure at 0x001c0000 (I/O error)
    mtd: erase failure at 0x001c0000 (I/O error)
    mtd: skipping write block at 0x001c0000
    mtd: erase failure at 0x001e0000 (I/O error)
    mtd: erase failure at 0x001e0000 (I/O error)
    mtd: skipping write block at 0x001e0000
    mtd: erase failure at 0x00200000 (I/O error)
    mtd: erase failure at 0x00200000 (I/O error)
    mtd: skipping write block at 0x00200000
    mtd: erase failure at 0x00220000 (I/O error)
    mtd: erase failure at 0x00220000 (I/O error)
    mtd: skipping write block at 0x00220000
    mtd: erase failure at 0x00240000 (I/O error)
    mtd: erase failure at 0x00240000 (I/O error)
    mtd: skipping write block at 0x00240000
    mtd: erase failure at 0x00260000 (I/O error)
    mtd: erase failure at 0x00260000 (I/O error)
    mtd: skipping write block at 0x00260000
    mtd: erase failure at 0x00280000 (I/O error)
    mtd: erase failure at 0x00280000 (I/O error)
    mtd: skipping write block at 0x00280000
    mtd: erase failure at 0x002a0000 (I/O error)
    mtd: erase failure at 0x002a0000 (I/O error)
    mtd: skipping write block at 0x002a0000
    mtd: erase failure at 0x002c0000 (I/O error)
    mtd: erase failure at 0x002c0000 (I/O error)
    mtd: skipping write block at 0x002c0000
    mtd: erase failure at 0x002e0000 (I/O error)
    mtd: erase failure at 0x002e0000 (I/O error)
    mtd: skipping write block at 0x002e0000
    mtd: erase failure at 0x00300000 (I/O error)
    mtd: erase failure at 0x00300000 (I/O error)
    mtd: skipping write block at 0x00300000
    mtd: erase failure at 0x00320000 (I/O error)
    mtd: erase failure at 0x00320000 (I/O error)
    mtd: skipping write block at 0x00320000
    mtd: erase failure at 0x00340000 (I/O error)
    mtd: erase failure at 0x00340000 (I/O error)
    mtd: skipping write block at 0x00340000
    mtd: erase failure at 0x00360000 (I/O error)
    mtd: erase failure at 0x00360000 (I/O error)
    mtd: skipping write block at 0x00360000
    mtd: erase failure at 0x00380000 (I/O error)
    mtd: erase failure at 0x00380000 (I/O error)
    mtd: skipping write block at 0x00380000
    mtd: erase failure at 0x003a0000 (I/O error)
    mtd: erase failure at 0x003a0000 (I/O error)
    mtd: skipping write block at 0x003a0000
    mtd: erase failure at 0x003c0000 (I/O error)
    mtd: erase failure at 0x003c0000 (I/O error)
    mtd: skipping write block at 0x003c0000
    mtd: erase failure at 0x003e0000 (I/O error)
    mtd: erase failure at 0x003e0000 (I/O error)
    mtd: skipping write block at 0x003e0000
    mtd: erase failure at 0x00400000 (I/O error)
    mtd: erase failure at 0x00400000 (I/O error)
    mtd: skipping write block at 0x00400000
    mtd: erase failure at 0x00420000 (I/O error)
    mtd: erase failure at 0x00420000 (I/O error)
    mtd: skipping write block at 0x00420000
    mtd: erase failure at 0x00440000 (I/O error)
    mtd: erase failure at 0x00440000 (I/O error)
    mtd: skipping write block at 0x00440000
    mtd: erase failure at 0x00460000 (I/O error)
    mtd: erase failure at 0x00460000 (I/O error)
    mtd: skipping write block at 0x00460000
    mtd: erase failure at 0x00480000 (I/O error)
    mtd: erase failure at 0x00480000 (I/O error)
    mtd: skipping write block at 0x00480000
    mtd: erase failure at 0x004a0000 (I/O error)
    mtd: erase failure at 0x004a0000 (I/O error)
    mtd: skipping write block at 0x004a0000
    mtd: erase failure at 0x004c0000 (I/O error)
    mtd: erase failure at 0x004c0000 (I/O error)
    mtd: skipping write block at 0x004c0000
    mtd: erase failure at 0x004e0000 (I/O error)
    mtd: erase failure at 0x004e0000 (I/O error)
    mtd: skipping write block at 0x004e0000
    error writing recovery: No space left on device

  28. denis_c says:

    the files are on the xda site. they have the “corrected” site…
    http://forum.xda-developers.com/showthread.php?t=701835
    if you scroll down a little you’ll see the correction

  29. denis_c says:

    my only problem is that the recovery screen afterwards does not work….its just a blank screen with the phone and the exclamation point…no words on top…

  30. Brooklyn says:

    guys here are all the updated files pcg, flash, mtd and finally, RECOVERY.img! (just make sure to sign in to your acount): http://forum.xda-developers.com/showthread.php?t=705113

  31. Brooklyn says:

    man dis sucks!! tried everithing stil cant get this adb shell up to full root part 2 ugh!!!. i updated the driver via other devices – the one with the “?” via Device Manager and now the tab selection itself disappeared, now when i connect with HTC Sync there’s nothin to choose frm. LOL.. im tired of OS 2.1 i want 2.2! what needs to be done so that everi1 can ds?!!!…

    OH!
    AND BI THE WAY… I HEARD (SM1 WHOS FATHR WORKS FOR SPRINT EVO TECHNOLOGY) THAT SPRINT IN COMMIN OUT WITH A PROGRAM OF SOME SORT THAT IS GOING TO GO STR8 TO EVERI1’S EVO AND IF THEIR FONE IS ROOTED EVERITHING WILL BE ERASE AND U WILL HAVE TO GO BACK INTO SPRINT TO REACTIVITE EVERITHING ALL OVER AGAIN, PAYING FOR IT OF COURSE. THIS IS WAT I HEARD DONT KNOW IF ITS TRU OR NOT. BUT I WONT BE SURPRISE, SPRINT IS LOOSING MONEI THRU THEI LOST OF WIFI DUE TO THIS HACK AND U KNOW HOW BIG CORPORATIONS ARE. SO PUT IT TOGTHTR IT AINT THAT HARD… BUT IF SOME1 CAN COMFIRM THAT AS WELL AS SOLVIN THE ROOTIN PRBLM, WOULD APPRECIATE IT AND DONATE TO ACCOUNT… CHEERS!

  32. rwhite says:

    I’m having the exact same problem as Shadowtat. Please help.

  33. EDGARDO says:

    recovery.img the link dont work!!!!!!!!!

  34. Dyran says:

    I am experiencing the same problem as Shadowtat after running the last command after removing PC36IMG.zip it says no space left on device. I have deleted everything except the essentials from my sd card and still have this problem. Please help

  35. samuel says:

    Where can i download the files some of the links are broken

  36. Phil says:

    The download link for evorecovery.img is dead so you can use this one instead.
    http://www212.megaupload.com/files/3556fe953381bcd7dc2d6b564cdda91d/recovery.img

  37. mingodoggs says:

    hey guys i completely mess up my Evo trying to do this process for not reading. When i power up my phone it goes directly in recovery mode and if i hit reboot it goes to a black screen with a picture of the evo and a red triangle if i press the up bottom and the power bottom it goes to a screen with blue letters and yellow letters below tha says ” E:Can’t open/cache/recovery/command” the blue letters says “reboot system now” “apply sdcard update” “wipe data/factory reset” “wipe cache partition” some please help me out i would really appriciated

  38. Joshua Bryson says:

    i followed the whole process. when i go into hboot and select recovery android system recovery comes up and at the bottom it says E:Cant open /cache/recovery/command. any ideas as to why? please help!

  39. dunk says:

    Adb shell is not recognized by cmd line it says doesn’t recognize path or batch file

  40. Mark Euler says:

    Hi Max,

    I got to the reboot step, but get the following errors:

    [2] RADIO_V2 – Fail-PU
    [12] BOOTLOADER- Fail-IC

    Any insights you have would be greatly appreciated.

    Thanks
    Mark Euler

  41. danny says:

    hi were can i get these file the link are broken dont work please advise thank you

  42. LD says:

    Hi Max, First I would like to begin by saying thanks for all the hard work and for helping everyone. I know it’s been asked a million times; however I haven’t seen a clear cut answer. Is there some place that I can go that shows me how to get s-on if I need to take my phone back to sprint, for some reason. Thanks again for all the help.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related News and Resources