How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

Download this video for viewing in HD on your smartphone or computer.
Click Here to Download High-Quality HD video to your Smartphone or Computer.

This video was brought to you by Click Here to See at

Here’s how to root your HTC Evo 4G on HBOOT 2.18 with S-OFF!

Step 1. Check the Software number on your HTC Evo 4G.  If you have 4.67.651.3 or later, this method will work.  If you have an older version, try the easier root method, don’t need to do this.

Step 2. Take the battery out and back in.  Then boot into bootloader by holding down Volume Down and Power button together.

Step 3. You should see that your phone says “LOCKED (OOW)”, HBOOT 2.18 or later.

Step 4. Hit the Power button to enter Fastboot mode.

Step 5. Connect a micro-USB cable from your phone to your computer.  It should now say “FASTBOOT USB”.

Step 6. Download and unzip: (This file has EVERYTHING you need to root your phone.)
(Don’t have unzipping program? Download and install 7Zip first.)

Sponsored Links

Sponsored Links

Step 7. For Windows, make sure you have correct USB drivers installed, there should be something like “HTC Bootloader” or “ADB Interface” in Device Manager.  If you don’t simply run the HTCDriver3.0.0.007.exe to install drivers.  No drivers are needed for Mac and Linux.

Step 8. Open up a command prompt and type:

cd Downloads

cd RootEvo4GNew

fastboot oem get_identifier_token

For Mac, replace “fastboot” with “./fastboot-mac”
For Linux, replace “fastboot” with “./fastboot-linux”

Copy everything starting from <<<< to >>>> as shown below to your clipboard.

Step 9. Go to and sign in.  If you don’t have an account, simply sign up and log in.  Then choose “Unlock Bootloader”.

Step 10. Next choose “All Other Supported Models” and click on “Begin Unlock Bootloader”.

Step 11. Click on “Yes”.

Step 12. Check the legal terms and click on “Proceed to Unlock instructions”.

Step 13. Scroll down and click on “Proceed to Step 5”.

Step 14. Scroll down and click on “Proceed to Step 8”.

Step 15. Scroll down and paste your token you copied earlier.

Step 16. Hit the “Submit” button and you should see “Token Submitted Successfully” message.

Step 17. Check your e-mail inbox and you should have received an e-mail from HTC with a file called “Unlock_code.bin”.

Step 18. Simply download Unlock_code.bin and move the file to the RootEvo4GNew directory.

Step 19. Type:

fastboot flash unlocktoken Unlock_code.bin

Step 20. Go to your phone, you should now see an “Unlock bootloader?” screen, choose “Yes” using Volume buttons and hit the Power button.  Your phone will reboot.

Step 21. Take the battery out and back in while it’s booting.  Then enter the bootloader again by holding down Volume Down and the Power button together.

Step 22. Choose “FASTBOOT” and hit the Power button.  Notice that now your phone says “*** UNLOCKED ***” at the top.

Step 23. Connect a micro-USB cable from your Evo 4G to your computer and it should say “FASTBOOT USB”.

Step 24. Type:

fastboot flash recovery recovery-RA-supersonic-v2.3.img

This will flash the recovery on your Evo 4G, which let’s you flash zip files.

Step 25. Go back to your phone and choose “BOOTLOADER” and hit the Power button.

Step 26. Choose “RECOVERY” and hit the Power button.

Step 27. In Recovery, choose “USB-MS toggle” and hit the Power button.

Step 28. Copy the file to your Evo 4G SD card.

Step 29. Choose “Flash zip from sdcard”.

Step 30. Choose “Choose zip from sdcard”.

Step 31. Choose the file “”.  This will actually root your phone.

Step 32. When that’s done, reboot.

Step 33. Reboot your phone and you will fine SuperSU app, which means your Evo 4G has been fully rooted.

You can stop at Step 33, if you are not going to flash custom ROMs often.
If you stop here, you will have a fully rooted Evo 4G with S-ON.

(Read Q&A at bottom if you want to know how to flash ROMs on S-ON.)

Step 34. If you want S-OFF, do the following to allow RUU flashing back to 651.1.

First, make sure USB Debugging is checked ON under Settings->Applications->Development.

Step 35. Go back to command prompt and type:

adb push flashimage /sdcard/.
adb push mtd-eng.img /sdcard/.

adb shell
cat /sdcard/flashimage > /data/flashimage
chmod 755 /data/flashimage
/data/flashimage misc /sdcard/mtd-eng.img

For Mac, replace “adb” with “./adb-mac”.
For Linux, replace “adb” with “./adb-linux”.

Step 36. Next connect your Evo 4G to your computer as a disk drive and copy the file to the root directory of your Evo 4G’s SD card.

Step 37. Type:

adb reboot bootloader

Step 38. Your phone should now say “LOCKED (OOW)”.  And should check for the file.  If it doesn’t (which happened to me), try using another micro-SD card or format your micro-SD card and repeat from Step 36.

Step 39. Hit the Volume Up button to start the update process.  This will get you back to software version 651.1, which allows you to use Revolutionary to get S-OFF.  You can also flash an older version too if you want but that’s outside the limits of this tutorial.

Step 40. Your phone should reboot once, just let it do its thing.

Step 41. When everything is done, you will get an option to reboot your phone, hit Volume Up to reboot.

Step 42. You should now be back on sfotware 651.1.  Let’s go root it using Revolutionary root method.  Make sure USB Debugging is checked ON under Settings->Applications->Development.

You can also see original step-by-step instructions for rooting using Revolutionary here.

Step 43. Go to command prompt and type “revolutionary.exe” and copy the serial number.

Step 44. Go to the website and click on “Download for Windows”.

Step 45. Choose “Windows”, HTC Evo 4G, 2.16.0001, and paste your serial number.  Click on “Generate key”.

Step 46. Copy the beta key.

Step 47. Go back to command prompt and paste your beta key and hit Enter.  Your phone should now become S-OFF after couple reboots.  Just let it do its thing.

Step 48. Your phone should say “Revolutionary” with “S-OFF” and HBOOT 6.16.

Step 49. You can stop here if you are going to flash a new custom ROM anyways.

You will be on 651.1 OTA plus root plus S-OFF.

(If you want latest 651.3 OTA rooted, keep going)

If you want to be rooted on latest 651.3 OTA plus root, copy the file to the SD card of your phone.

Step 50. And delete file as it will interfere.

Step 51. Reboot into bootloader by holding down Volume Down and Power button.  You know the drill by now.  And choose “FASTBOOT”.

Step 52. Go to command prompt and type this again to re-flash recovery as it has been wiped out during OTA 651.1 zip install.

fastboot flash recovery recovery-RA-supersonic-v2.3.img

Step 53. Choose “RECOVERY” to enter recovery.

Step 54. Choose “Flash zip from sdcard”.

Step 55. Choose “Choose zip from sdcard”.

Step 56. Choose the file “”

Step 57. When that’s done installing, go ahead and install the file “”.  This will give you root (again) on 651.3.

Step 58. Reboot and you will find yourself with the latest Software 651.3 (just like you started) with root and S-OFF.


Time to get all this done = around an hour.

Having the latest OTA, rooted with S-OFF so you can go flashing new ROMs on the bus or the plane = Priceless.


Q: Why do I need S-OFF?
A: If you want to install new custom ROMs without a computer.
Q: Can I flash a new custom ROM with S-OFF?
A: Yes you can but you must boot recovery from fastboot, get your phone into fastboot USB mode, then the command is:
fastboot boot recovery-RA-supersonic-v2.3.img
You must do this everytime you want to flash a new ROM if you are on S-ON.

Q: I am having problems on Mac or Linux!
A: Try running with root by typing “sudo -i” first or add “sudo” in front of commands.

For those on S-OFF, just flash normally from recovery.

Credits – Huge thanks to user THC Butterz who put it all together.

If you like this post, don't forget to Like us on our Facebook page!

Want to stay updated on latest HTC Evo hacks and tips?
Sign up for our HTC Evo Hacks Newsletter here so you don't miss a single tip!
Categories: HTC Evo Hacks.

Recent Android News from

378 Responses to How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

  1. Andy says:

    having a problem at step 33-35.
    Running on mac and using command line ./adb-mac push flashimage /sdcard/. and getting response
    -Macbook:RootEvo4GNew admin$ ./adb-mac push flashimage /sdcard/.
    error: device not found

    • turd maker says:

      how the hell do you download the data files? Twenty two thousand download buttons yet none of them actually do as they say its all ads.

  2. Antonio says:

    Please, help 🙁
    My evo 4g is rooted, unlocked and S-ON with cyanogenmod 7.2
    I want s-off
    This method??? Compatible with cyanogen????
    i am from bularia

  3. Antwan says:

    What if it says C:\Users\Owner\Downloads\RootEvo4GNew>fastboot flash recovery recovery-RA-supers
    error: cannot load ‘recovery-RA-supersonic-v2.3.img’

    • dale says:

      Just rename it to recovery. Then go into fastboot command and type “fastboot flash recovery recovery.img” (no quotes””)

  4. drzeeee says:

    @Antonio flash back to a stock Sense rom, that should do it. I just did this on the latest ota 5.07.651.6 and it worked like a charm since it’s the same hboot.

    @Antwan- make sure you have usb debugging checked and also set to charge only. You can always check if adb “sees” your device by typing in command “adb devices”.
    Good luck everyone. 🙂

  5. Lorenzo says:

    It’s awesome for me to have a web site, which is good in favor of my know-how. thanks admin

  6. mathew colon says:

    the command processor does not recognize the links of the root folder. What you recommend me?

  7. Robert says:

    Thank a ton for this video, so happy with all the apps I can now use after rooting. Question, if I install the HTC updates that keep popping up, will the phone go back to being unrooted?

  8. frank says:

    it is giving me this …

    Microsoft Windows [Version 6.1.7600]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Users\User>cd Downloads

    C:\Users\User\Downloads>cd RootEvo4GNew

    C:\Users\User\Downloads\RootEvo4GNew>fastboot oem get_identifier_token

    (bootloader) [ERR] Command error !!!
    OKAY [ 0.011s]
    finished. total time: 0.011s

    • dale says:

      reboot phone and check usb debugging box.

      • mike says:

        I get the same error code. I rebooted, checked to make sure the debug box was selected, its all good. If I let the phone reboot in normal mode, I get the code “waiting for device” when Im in fastboot usb I get that same error code as the other guy.

        (bootloader) [ERR] Command error !!!
        OKAY [ 0.011s]
        finished. total time: 0.011s
        Where do I go from here?

  9. hey worked great just did today, quick question,once i have rooted my device, but dont plan to install any customs roms, do u need to lock the bootloader back or can i keep it unlocked?

  10. eduardo says:

    it always says access denied when I get to this part
    “cat /sdcard/flashimage > /data/flashimage
    chmod 755 /data/flashimage
    /data/flashimage misc /sdcard/mtd-eng.img

  11. Bob says:

    Thanks I was able to root my EVO 4G!!!
    Upon going to the SU icon and clicking. There were no apps? I went to the app store there and downloaded a SU app. (Looks like Superman logo) After re installing 120 apps. moving them to the SD card. It came back to the super user app found in the SU app. it asked for (something like cmx… and …. ) or normal. I opted for normal! Now the phone is in a loop. Now my Android assistant app. shows a load time over the icon when loading? I can’t find the app to remove it. It must be on the phone because removing the SD card changed nothing? I tried safe mode, it still does it? I’m no comupter genius. I wanted to root to get rid of all the bloatware. TY!

  12. brian says:

    I cant get step 38 to work. I type adb reboot bootloader and the phone reboots into the bootloader but that’s it. I cant get it to read the PC36 file to save my life! I have tried different sd cards, formatting, nothing works. I see the file on the sd card, but it wont read it and update Any ideas?

    • Bob says:

      He claims if you add him on Google+. He’ll answer questions there. Good luck. I waited 5 days w/o a reply. Bit having a phone. Try joining Phandroid forums. They helped me get mine up. Responses are sketchy though. But dome help is better than “no help”.

    • HTC Evo 4G Hacks says:

      Try formatting your sdcard and try again.

    • Dustin says:

      I had this issue to but at the risk of bricking my phone I thought I’d try clicking stuff that I didn’t understand. I got lucky because the first thing I selected was ‘Bootloader’ and it went to the bootloader screen, then started looking for the May be a missing step for some people? Seemed to work fine.

    • dale says:

      be sure file is PC36IMG.

  13. web page says:

    When some one searches for his vital thing, therefore he/she desires to
    be available that in detail, thus that thing is maintained over here.

  14. marlon says:


  15. Rex says:

    I get a signature fail

    0130729\sdk\platform-tools>fastboot oem get_identifier_token

    (bootloader) <<<>>>
    (bootloader) 3ED1AE011EC10AF62557D5C68D9B01E4
    (bootloader) C85E0743CBEFB212E76C69D7774D021E
    (bootloader) 72B4B87F7E4F8B556C5738B45DDF8D16
    (bootloader) A296E25D08667E4BD8FDEF5B3E84743F
    (bootloader) 659245235EE72AD15ECDF35C2DEA2021
    (bootloader) 846EF3895B6D7E06F867A9ED0F41658B
    (bootloader) 2B4246673B2B001802E734126C189C9C
    (bootloader) 475DB8EFA5107799073C538C5E739F9D
    (bootloader) 7AFC05A6537EDCC9AF3FBA04658A5D7E
    (bootloader) B4808817A432323D520116B1A67EB69E
    (bootloader) 356026A112F6480E992270746019792B
    (bootloader) E1F5DBE82DF72B34D6B3B5372539283E
    (bootloader) B906A49F9C3214AC17055709B7D73FC1
    (bootloader) E3024688C7A1A7C5543D48C06A9CFA86
    (bootloader) 0109CB70D80C77C9202F6A3DBF2A6C1B
    (bootloader) 6650FC0FE81A8FAC452604E6C6334FAE
    (bootloader) <<<<>>>>
    OKAY [ 0.063s]
    finished. total time: 0.064s

    0130729\sdk\platform-tools>fastboot flash unblocktoken Unlock_code.bin
    sending ‘unblocktoken’ (0 KB)…
    OKAY [ 0.170s]
    writing ‘unblocktoken’…
    (bootloader) signature checking…
    FAILED (remote: signature verify fail)
    finished. total time: 0.172s

    Any ideas?

  16. rizwan says:

    i got this what can i do please help i am trying to do this on my laptop and i have to this on many other computers please help

    ‘fastboot’ is not recognized as an internal or external command,
    operable program or batch file.

  17. Desiree says:

    When I get to the recovery part and select recovery my phone does not give me the options your phone gives you it gives me a phone with a red caution sign … ANY IDEA OF WHAT I CAN DO?

  18. yo, its my birthday says:

    Awesome walkthrough! I had some trouble in step 35 a couple times. first said img not found or valid or something. tried again after making sure i was using superSU instead of superuser, that seemed to work. also saying acces denied after opening shell and typing su. that also worked after flashing superSU. who knows? but it worked. It definitely took a few tries but keep at it and this guide will get you there. Thanks bro from all of us out here in user-land.

  19. October 2, 2013.
    thank you so much. I really like this layout format of instruction. I have a Sprint HTC 04 G with 2.18. It is now rooted I rooted this phone, because I needed to control the phone using my computer. thank you to you. Kinsley

  20. Frank says:

    I thought that I was somewhat smart until today. Can’t even get to the page Download and all I get is advertising and some stuff for computer optimization or programs that I don’t want. arrrrggggggggg

  21. Kevin says:

    Great stuff Man! I got it working on the first run through, but just double checking each step in your walkthrough against the video. Success. Thanks again. Now If only I can figure out a good rom!

    Nice bike too!

  22. TX_Jax says:

    OMG, I just cannot thank you enough.

    I have gone around and around trying to unlock this stupid phone. THANK YOU!!!!!

  23. degges1 says:

    thank you, i root one evo successfully however i am trying to root another evo and when i get to go into recovery and boot superuser, when i hut recovery it brings me to the white HTC EVO 4g window for about 15 min then it powers off what did i do wrong on this one

  24. zfr says:

    i echoTX_Jax. this worked exactly you laid it out. thanks for the full and attentive details.

  25. Mike says:

    Hey! Thanks for this. Rock rock on – my EVO is rooted… The only issue I have is that the GPS is no longer stable at ALL. When we downgraded the HBoot – is there a possibility we lost some GPS radio functionality/power? Is there a way to, once we have the phone rooted, to replace the HBoot with the 2.18 again?? If so, I’d LOVE a link. Or just some simple instructions and a link to the file I need. Thanks again!

  26. boo says:

    got to step 49
    please send direction on how to in stall costume rom

  27. Wise Fool says:

    I know most probably dont use Linux to do this and this phone is old, but including the revolutionary script(downloadable at for Linux in the zip archive you provided would be useful.

  28. spawn says:

    where can I download or get this at?

  29. raj says:

    Thank you so much….now my kids can enjoy there devices while traveling….owesome….thanks again.

  30. Scott says:

    I got to where you have to load Unlock_code.bin (mac in terminal). Everything’s worked fine until now. It says “error: Unlock_code.bin cannot be loaded”
    Any help?

  31. Erica says:

    The folder is empty.. can anyone direct me to a working file?

  32. Jared says:

    Thanks for your help. All the work has been done smoothly.

  33. Michael Embry says:

    I get [1] segmentation fault /data/flashimage misc /sdcard/mtd-eng.img

  34. Karl says:

    Everything worked out great but only problem now is i am trying to flash a TWRP recovery to be able to flash this KK rom but it keeps saying can’t find update script then says installation aborted

Leave a Reply

Your email address will not be published. Required fields are marked *

Related News and Resources