How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

Download this video for viewing in HD on your smartphone or computer.
Click Here to Download High-Quality HD video to your Smartphone or Computer.

This video was brought to you by Click Here to See at

Here’s how to root your HTC Evo 4G on HBOOT 2.18 with S-OFF!

Step 1. Check the Software number on your HTC Evo 4G.  If you have 4.67.651.3 or later, this method will work.  If you have an older version, try the easier root method, don’t need to do this.

Step 2. Take the battery out and back in.  Then boot into bootloader by holding down Volume Down and Power button together.

Step 3. You should see that your phone says “LOCKED (OOW)”, HBOOT 2.18 or later.

Step 4. Hit the Power button to enter Fastboot mode.

Step 5. Connect a micro-USB cable from your phone to your computer.  It should now say “FASTBOOT USB”.

Step 6. Download and unzip: (This file has EVERYTHING you need to root your phone.)
(Don’t have unzipping program? Download and install 7Zip first.)

Sponsored Links

Sponsored Links

Step 7. For Windows, make sure you have correct USB drivers installed, there should be something like “HTC Bootloader” or “ADB Interface” in Device Manager.  If you don’t simply run the HTCDriver3.0.0.007.exe to install drivers.  No drivers are needed for Mac and Linux.

Step 8. Open up a command prompt and type:

cd Downloads

cd RootEvo4GNew

fastboot oem get_identifier_token

For Mac, replace “fastboot” with “./fastboot-mac”
For Linux, replace “fastboot” with “./fastboot-linux”

Copy everything starting from <<<< to >>>> as shown below to your clipboard.

Step 9. Go to and sign in.  If you don’t have an account, simply sign up and log in.  Then choose “Unlock Bootloader”.

Step 10. Next choose “All Other Supported Models” and click on “Begin Unlock Bootloader”.

Step 11. Click on “Yes”.

Step 12. Check the legal terms and click on “Proceed to Unlock instructions”.

Step 13. Scroll down and click on “Proceed to Step 5”.

Step 14. Scroll down and click on “Proceed to Step 8”.

Step 15. Scroll down and paste your token you copied earlier.

Step 16. Hit the “Submit” button and you should see “Token Submitted Successfully” message.

Step 17. Check your e-mail inbox and you should have received an e-mail from HTC with a file called “Unlock_code.bin”.

Step 18. Simply download Unlock_code.bin and move the file to the RootEvo4GNew directory.

Step 19. Type:

fastboot flash unlocktoken Unlock_code.bin

Step 20. Go to your phone, you should now see an “Unlock bootloader?” screen, choose “Yes” using Volume buttons and hit the Power button.  Your phone will reboot.

Step 21. Take the battery out and back in while it’s booting.  Then enter the bootloader again by holding down Volume Down and the Power button together.

Step 22. Choose “FASTBOOT” and hit the Power button.  Notice that now your phone says “*** UNLOCKED ***” at the top.

Step 23. Connect a micro-USB cable from your Evo 4G to your computer and it should say “FASTBOOT USB”.

Step 24. Type:

fastboot flash recovery recovery-RA-supersonic-v2.3.img

This will flash the recovery on your Evo 4G, which let’s you flash zip files.

Step 25. Go back to your phone and choose “BOOTLOADER” and hit the Power button.

Step 26. Choose “RECOVERY” and hit the Power button.

Step 27. In Recovery, choose “USB-MS toggle” and hit the Power button.

Step 28. Copy the file to your Evo 4G SD card.

Step 29. Choose “Flash zip from sdcard”.

Step 30. Choose “Choose zip from sdcard”.

Step 31. Choose the file “”.  This will actually root your phone.

Step 32. When that’s done, reboot.

Step 33. Reboot your phone and you will fine SuperSU app, which means your Evo 4G has been fully rooted.

You can stop at Step 33, if you are not going to flash custom ROMs often.
If you stop here, you will have a fully rooted Evo 4G with S-ON.

(Read Q&A at bottom if you want to know how to flash ROMs on S-ON.)

Step 34. If you want S-OFF, do the following to allow RUU flashing back to 651.1.

First, make sure USB Debugging is checked ON under Settings->Applications->Development.

Step 35. Go back to command prompt and type:

adb push flashimage /sdcard/.
adb push mtd-eng.img /sdcard/.

adb shell
cat /sdcard/flashimage > /data/flashimage
chmod 755 /data/flashimage
/data/flashimage misc /sdcard/mtd-eng.img

For Mac, replace “adb” with “./adb-mac”.
For Linux, replace “adb” with “./adb-linux”.

Step 36. Next connect your Evo 4G to your computer as a disk drive and copy the file to the root directory of your Evo 4G’s SD card.

Step 37. Type:

adb reboot bootloader

Step 38. Your phone should now say “LOCKED (OOW)”.  And should check for the file.  If it doesn’t (which happened to me), try using another micro-SD card or format your micro-SD card and repeat from Step 36.

Step 39. Hit the Volume Up button to start the update process.  This will get you back to software version 651.1, which allows you to use Revolutionary to get S-OFF.  You can also flash an older version too if you want but that’s outside the limits of this tutorial.

Step 40. Your phone should reboot once, just let it do its thing.

Step 41. When everything is done, you will get an option to reboot your phone, hit Volume Up to reboot.

Step 42. You should now be back on sfotware 651.1.  Let’s go root it using Revolutionary root method.  Make sure USB Debugging is checked ON under Settings->Applications->Development.

You can also see original step-by-step instructions for rooting using Revolutionary here.

Step 43. Go to command prompt and type “revolutionary.exe” and copy the serial number.

Step 44. Go to the website and click on “Download for Windows”.

Step 45. Choose “Windows”, HTC Evo 4G, 2.16.0001, and paste your serial number.  Click on “Generate key”.

Step 46. Copy the beta key.

Step 47. Go back to command prompt and paste your beta key and hit Enter.  Your phone should now become S-OFF after couple reboots.  Just let it do its thing.

Step 48. Your phone should say “Revolutionary” with “S-OFF” and HBOOT 6.16.

Step 49. You can stop here if you are going to flash a new custom ROM anyways.

You will be on 651.1 OTA plus root plus S-OFF.

(If you want latest 651.3 OTA rooted, keep going)

If you want to be rooted on latest 651.3 OTA plus root, copy the file to the SD card of your phone.

Step 50. And delete file as it will interfere.

Step 51. Reboot into bootloader by holding down Volume Down and Power button.  You know the drill by now.  And choose “FASTBOOT”.

Step 52. Go to command prompt and type this again to re-flash recovery as it has been wiped out during OTA 651.1 zip install.

fastboot flash recovery recovery-RA-supersonic-v2.3.img

Step 53. Choose “RECOVERY” to enter recovery.

Step 54. Choose “Flash zip from sdcard”.

Step 55. Choose “Choose zip from sdcard”.

Step 56. Choose the file “”

Step 57. When that’s done installing, go ahead and install the file “”.  This will give you root (again) on 651.3.

Step 58. Reboot and you will find yourself with the latest Software 651.3 (just like you started) with root and S-OFF.


Time to get all this done = around an hour.

Having the latest OTA, rooted with S-OFF so you can go flashing new ROMs on the bus or the plane = Priceless.


Q: Why do I need S-OFF?
A: If you want to install new custom ROMs without a computer.
Q: Can I flash a new custom ROM with S-OFF?
A: Yes you can but you must boot recovery from fastboot, get your phone into fastboot USB mode, then the command is:
fastboot boot recovery-RA-supersonic-v2.3.img
You must do this everytime you want to flash a new ROM if you are on S-ON.

Q: I am having problems on Mac or Linux!
A: Try running with root by typing “sudo -i” first or add “sudo” in front of commands.

For those on S-OFF, just flash normally from recovery.

Credits – Huge thanks to user THC Butterz who put it all together.

If you like this post, don't forget to Like us on our Facebook page!

Want to stay updated on latest HTC Evo hacks and tips?
Sign up for our HTC Evo Hacks Newsletter here so you don't miss a single tip!
Categories: HTC Evo Hacks.

Recent Android News from

378 Responses to How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

  1. Lisa says:

    I am stuck at step #24.
    Whenever I type in the command,
    it says error: cannot load ‘recovery-RA-supersonic-v.2.3.img’.

    Please help, what am I doing wrong?
    Thanks in advance for your help! 🙂

    • HTC Evo 4G Hacks says:

      Make sure that file is there.

    • wael karkour says:

      still have the same problem, where I checked of existence of the file in the same folder. what else I can do please.

    • nsitarski says:

      Did you figure this out?

      I am also stuck on step 24. I get the following…

      C:\Users\Nick\Downloads\HTC Root\RootEvo4GNew>fastboot flash recovery recovery-R
      sending ‘recovery’ (3544 KB)…
      FAILED (remote: not allowed)
      finished. total time: 0.004s

      If I try again it will just hang and say
      C:\Users\Nick\Downloads\HTC Root\RootEvo4GNew>fastboot flash recovery recovery-R
      sending ‘recovery’ (3544 KB)…

      if I unhook USB at this point it will say

      FAILED (status read failed (Unknown error))
      finished. total time: 172.782s

      Any help would be appreciated.

  2. Kevin says:

    Really helpful. Although box could have been a little shorter.

  3. Locc says:

    When I choose the fastboot and then plug in my usb, it doesn’t say fastboot usb. I also have a problem, I think, when I plug my phone to my computer, nothing pops up and no disk drive, it charges fine. I tried to change the settings to make it a disk drive only, that doesn’t work either. Even tried another micro usb cord, no dice.

    I know it’s a stock rom from sprint, and nothing has been done to it. Is there somehow I can fix this so I can root?

  4. mark s says:

    rootevo4gnew never downloads all the way then gives me an error message

  5. mark s says:

    does anyone have another link to rootevo4gnew? thanks

  6. jonathan says:

    can you plz help me i am stuck in step#8 when i put the fastboot oem get_identifier_token it tells me command error

    • Jill Clark says:

      I got stuck too but I think because it was taking me so long to get to this step…I took my battery out and did step #2-#5 again and then it worked…(I’m slowwwww:)

  7. jonathan says:

    my phone was already rooted i unrooted it to get the updates then now im trying to root it back i cant btw its already s-off

  8. Ed says:

    I have to take my phone back in, but they won’t take it until l unroot. Can anyone provide me directions on how to unroot. I

  9. Andrew Walsh says:

    hey i cant get past the command prompt it said error

  10. Nate says:

    Stuck at step 16
    here’s a screenie;
    Says, “Error Code: Invalid Bootloader Token Length.
    Error Reason: The submitted Token appears to be the wrong length and won’t work.”
    But i copied it straight from the command prompt. Any ideas?

  11. brandon gonzalez says:

    i got ics on hboot i on a rom

  12. Shag Nasties says:

    Thank you! Worked just like a charm for me…….

  13. Sharpe351 says:

    Used this method to root without doing the S-OFF stuff. I’ve been able to flash kernals and ROMs in recovery (Ra smelkus mod) since unlocking. I’m not sure why to go through the extra steps, seems like a waste of time.

  14. jerry says:

    I just want to say thanks, could not of done it without you, your awsome and so was your video.

  15. Mike says:

    When I start the s-off process I get a device not found error when I type ‘adb push flashimage /sdcard/.’ I know I have debugging turned on and the drivers are correct. Any other thoughts?

  16. umhardcore says:

    Awesome. I’ve been nervous to root my phone. My phone took a dump, brought it to Sprint store, and wound up with a brand new Evo 4G after they had it for 45 mins. I’m up for an upgrade now and since they gave me a brand new phone, i figured what the hell, I’ll root my phone. Followed step by step in the video and everything worked flawlessly. Thanks again. I will probably be changing to another mod, but for now, I am rooted.

  17. David says:

    So I installed the HTCDrivers3.0.0.007 and when I check the Device Manager it does not say HTC Bootloader. I get an error after I type in the command fastboot oem get_identifier_token. Please help. Thank you.

  18. Le says:

    Upon the 1st cmd (Ubuntu system w/o devt tools) I get

    If I put the EVO in diag mode (after normal boot) it is seen. Do I need some of the devt tools?

  19. Le says:

    I get “”

  20. Le says:

    OK, I get “waiting for device” in angle brackets.

  21. Jay North says:

    OK I went to step # 33 successfully. I was wanting to use the hotspot and get rid of the crappy Sprint apps but I can’t. Any suggestions on what my next steps should be. By the way the instructions where great and I had no issues. Any help would be appreciated.


  22. Andy says:

    when i type in /data/flashimage misc /sdcard/mtd-eng.img in the cmd i get error opening /sdcard/mtd-eng.img: No such file or directory. am i missing a file or did i do something wrong?

  23. Le says:

    You might want to add a comments within the instructions for Linux users:
    “sudo -i” may be required on Linux systems to execute ./fastboot-linux – sudo is insufficient.
    If your terminal contains leading “INFO” preambles on each line they must be edited out.

    Thanks for the response HTC Evo 4G Hacks.

  24. fb says:

    trying to install s-off…when i type “adb push flashimage /sdcard/.” i get “adb server is out of date. killing…”

  25. omari says:

    I cant get the phone to say “fastboot usb” when i connect it to the computer. Anyway around this or what to do ?

  26. Jose says:

    whenever i input the code to get fastboot on step 8 it says fastboot not recognized as a internal or external command, operable program or batch file. what do i do??

  27. wael karkour says:

    I’d like to thank you for these steps, but at step #24 it didn’t get through and I got this message “fastboot flash recovery recovery-RA-supersonic-v2.3.img” where I checked the file recovery-RA-supersonic-v2.3.img in the folder, I stopped and I don’t know what I can do. So please, HELP.

    • HTC Evo 4G Hacks says:

      that’s the message?

      • Vanessa says:

        I am having the same problem stuck on step 24. It says “sending ‘recovery’ (3544 KB)…” and it lagged there for an hour. I’m running Windows 7, never had HTC Sync installed on my computer. Before I did this, the drivers in my Device Manager read ADB Interface/HTC Bootloader. I reinstalled using the drivers in the RootEvo4GNew download and now the drivers in Device Manager read as Android USB Devices/My HTC, but I am still getting stuck at the same step.

  28. Mike says:

    Thanks for all the work you put in. I used your root method to root my EVO back when the first method for gingerbread came out. Now I have to do it again because my USB port went out and had to get a replacement phone. I tried to download the root file you put up, but it’s saying the file isn’t available. Is the file gone or the website just down temporarily? Thanks

  29. joe says:

    Thanks for your instruction, it helped rooted my evo 4g but now i need to bring it back to store for repair. Can you kindly tell me how to get back to S-On locked and unroot?


  30. Needp says:

    I need your help please. I tried all your and got my phone fully rooted but I can get the s-off. When I type in the command in cmd, I get an error message. I just realized that boost mobile wont accept the meid for activation because its a sprint phone. I am willing to allow u to remote to my computer and help me to set my phone back to stock.

    Thank you

  31. Sam says:

    I need your help please. I tried all your and got my phone fully rooted but I can get the s-off. When I type in the command in cmd, I get an error message. I just realized that boost mobile wont accept the meid for activation because its a sprint phone. I am willing to allow u to remote to my computer and help me to set my phone back to stock.

    Thank you

  32. Tony says:

    Hi Mark,
    Thank you for all your help. I Rooted my HTC Evo 4G on HBOOT 2.18 with S-OFF and I did all the extra steps on the video. So I thought, well finally rooted back. I download the WiFi Tether and I tried to use it in my laptop it does not work, even thought it looks like connect but never give me access to the internet. What will be the problem. I download app on Google market but nothing since to work for the tethering.
    Help will be greatly appreciated.


    • HTC Evo 4G Hacks says:

      try setting profile to “generic ics” and make sure MSS clamping and routing fix are checked on on wifi tether app.

  33. Adam says:

    Everything worked out fine until I went to back it up in rom manager and now it wont read sd card nor charge, PLEASE HELP. I am very tech savvy, wont take much guidance. Thanks

  34. dan says:

    I am stuck cmd-fastboot flash recovery recovery-RA-supersonic-v2.3.img- it says failed remote not allowed then i renter and it just stays at sending recovery. Any ideas what the problem is?

  35. dan says:

    C:\Users\admin\Downloads\RootEvo4GNew>fastboot flash recovery recovery-RA-supers
    sending ‘recovery’ (3544 KB)…
    FAILED (remote: not allowed)
    finished. total time: 0.000s

    C:\Users\admin\Downloads\RootEvo4GNew>fastboot flash recovery recovery-RA-supers
    sending ‘recovery’ (3544 KB)…

  36. Ed says:

    Stuck trying to flash, when I click it, it send me to the next directory. I select /apps, and the Superuser app is not there. My phone is unlocked, so i just went to google play store and downloaded Superuser from that. Am i still rooted? Is it safe for me to try and flash a custom rom like cyanogen?

  37. dan says:

    Still need help here, if i can just get the hboot from 2.18 to 2.10 i will just run unrevoked and be done…anybody? its unlocked evo4g 2.3.5 with 5.07

  38. Carlos says:

    I am stuck on step 19. I type “fastboot flash unlocktoken Unlock_code.bin” and I get back
    “sending ‘unlocktoken’ (0 KB)…” I verified the file is there, any suggestions ?

  39. Jessica says:

    Also stuck on #19…”error: cannot load ‘Unlock_code.bin'”…..not sure why. The bin file is in the correct location, inside the RootEvo4GNew pleeease?

  40. Adam says:

    so im at the point right now to where i have to wait for it to zerget root the phone, how long does this take? ive been waiting for more than 15 mins now???

  41. nick says:

    Stuck on step #24. when i type in “fastboot flash recovery recovery-RA-supers
    onic-v2.3.img” comes back with “OKAY [1.051s]… writing ‘recovery’…. Failed <remote: image error! >” some help would be great! Thanks.

  42. Mac says:

    Im stuck on step 8 and i am using a mac, once i enter “./fastboot-mac oem get_identifier_token”, all i get is “…”

  43. frank says:

    I just got to step 33. Everything worked fine. I was hoping that this would allow me to use the wifi hotspot. Do I need to complete the rest of the steps and get a custom ROM? Or can I just use the wifi hotspot as is?


  44. ju66er says:

    The download link for the isnt working on Internet Explorer 9.
    This is the message i get:
    Something has triggered an error on your website. This is the default error page for nginx that is distributed with EPEL. It is located /usr/share/nginx/html/50x.html. You should customize this error page for your own site or edit the error_page directive in the nginx configuration file /etc/nginx/nginx.conf.

    I had to use Firefox to get it to work.

  45. Kenny says:

    I have my HTC EVO rooted with S-Off and 651.3 OTA, but I can’t get rid of Sprint installed apps using SuperSU. I updated SU binary but there is no apps configured in Apps. What am I doing wrong?

  46. abdier says:

    heyy i got s-off everythig fine but when i try to boot into recovery to install a custom rom ti wont boot just got a red triangle wont boot help

  47. Matt says:

    Hey, just wanted to leave a message and say outstanding work. Wouldn’t have been able to do this without you, and I appreciated the explanation of certain steps just for our information! What’s your preferred EVO 4G ROM right now?

  48. xoodutyoox says:

    PC36IMG will load in H BOOT but always says wrong image and never asks to update i have formatted my SD card and flashed the correct recovery and i can still flash ROM’s manually but i would like s-off. have re downloaded the new4gevo file twice. i do have a BAMF ROM running now, do i need to wipe and try the update IMG without a custom ROM?

  49. Don says:

    Ok…got down to the token part. Submitted to the site ( and downloaded the bin file to the directory I am working from (named it evo). When in fastboot usb on phone, input the command on pc “fastboot flash unlocktoken unlock_code.bin” and it just sits there forever after outputing ” sending ‘unlocktoken’ …”

    Nothing comes up on the phone to allow unlocking or anything. Just sits there like it is stuck. Have submitted 2 different tokens but neither has worked. same result with either one.

  50. mykhal says:

    I’m stuck on step 35 my PC turned of at that point how should i proceed at this point? thanks in advance.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related News and Resources