How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

Download this video for viewing in HD on your smartphone or computer.
Click Here to Download High-Quality HD video to your Smartphone or Computer.

This video was brought to you by Click Here to See at

Here’s how to root your HTC Evo 4G on HBOOT 2.18 with S-OFF!

Step 1. Check the Software number on your HTC Evo 4G.  If you have 4.67.651.3 or later, this method will work.  If you have an older version, try the easier root method, don’t need to do this.

Step 2. Take the battery out and back in.  Then boot into bootloader by holding down Volume Down and Power button together.

Step 3. You should see that your phone says “LOCKED (OOW)”, HBOOT 2.18 or later.

Step 4. Hit the Power button to enter Fastboot mode.

Step 5. Connect a micro-USB cable from your phone to your computer.  It should now say “FASTBOOT USB”.

Step 6. Download and unzip: (This file has EVERYTHING you need to root your phone.)
(Don’t have unzipping program? Download and install 7Zip first.)

Sponsored Links

Sponsored Links

Step 7. For Windows, make sure you have correct USB drivers installed, there should be something like “HTC Bootloader” or “ADB Interface” in Device Manager.  If you don’t simply run the HTCDriver3.0.0.007.exe to install drivers.  No drivers are needed for Mac and Linux.

Step 8. Open up a command prompt and type:

cd Downloads

cd RootEvo4GNew

fastboot oem get_identifier_token

For Mac, replace “fastboot” with “./fastboot-mac”
For Linux, replace “fastboot” with “./fastboot-linux”

Copy everything starting from <<<< to >>>> as shown below to your clipboard.

Step 9. Go to and sign in.  If you don’t have an account, simply sign up and log in.  Then choose “Unlock Bootloader”.

Step 10. Next choose “All Other Supported Models” and click on “Begin Unlock Bootloader”.

Step 11. Click on “Yes”.

Step 12. Check the legal terms and click on “Proceed to Unlock instructions”.

Step 13. Scroll down and click on “Proceed to Step 5”.

Step 14. Scroll down and click on “Proceed to Step 8”.

Step 15. Scroll down and paste your token you copied earlier.

Step 16. Hit the “Submit” button and you should see “Token Submitted Successfully” message.

Step 17. Check your e-mail inbox and you should have received an e-mail from HTC with a file called “Unlock_code.bin”.

Step 18. Simply download Unlock_code.bin and move the file to the RootEvo4GNew directory.

Step 19. Type:

fastboot flash unlocktoken Unlock_code.bin

Step 20. Go to your phone, you should now see an “Unlock bootloader?” screen, choose “Yes” using Volume buttons and hit the Power button.  Your phone will reboot.

Step 21. Take the battery out and back in while it’s booting.  Then enter the bootloader again by holding down Volume Down and the Power button together.

Step 22. Choose “FASTBOOT” and hit the Power button.  Notice that now your phone says “*** UNLOCKED ***” at the top.

Step 23. Connect a micro-USB cable from your Evo 4G to your computer and it should say “FASTBOOT USB”.

Step 24. Type:

fastboot flash recovery recovery-RA-supersonic-v2.3.img

This will flash the recovery on your Evo 4G, which let’s you flash zip files.

Step 25. Go back to your phone and choose “BOOTLOADER” and hit the Power button.

Step 26. Choose “RECOVERY” and hit the Power button.

Step 27. In Recovery, choose “USB-MS toggle” and hit the Power button.

Step 28. Copy the file to your Evo 4G SD card.

Step 29. Choose “Flash zip from sdcard”.

Step 30. Choose “Choose zip from sdcard”.

Step 31. Choose the file “”.  This will actually root your phone.

Step 32. When that’s done, reboot.

Step 33. Reboot your phone and you will fine SuperSU app, which means your Evo 4G has been fully rooted.

You can stop at Step 33, if you are not going to flash custom ROMs often.
If you stop here, you will have a fully rooted Evo 4G with S-ON.

(Read Q&A at bottom if you want to know how to flash ROMs on S-ON.)

Step 34. If you want S-OFF, do the following to allow RUU flashing back to 651.1.

First, make sure USB Debugging is checked ON under Settings->Applications->Development.

Step 35. Go back to command prompt and type:

adb push flashimage /sdcard/.
adb push mtd-eng.img /sdcard/.

adb shell
cat /sdcard/flashimage > /data/flashimage
chmod 755 /data/flashimage
/data/flashimage misc /sdcard/mtd-eng.img

For Mac, replace “adb” with “./adb-mac”.
For Linux, replace “adb” with “./adb-linux”.

Step 36. Next connect your Evo 4G to your computer as a disk drive and copy the file to the root directory of your Evo 4G’s SD card.

Step 37. Type:

adb reboot bootloader

Step 38. Your phone should now say “LOCKED (OOW)”.  And should check for the file.  If it doesn’t (which happened to me), try using another micro-SD card or format your micro-SD card and repeat from Step 36.

Step 39. Hit the Volume Up button to start the update process.  This will get you back to software version 651.1, which allows you to use Revolutionary to get S-OFF.  You can also flash an older version too if you want but that’s outside the limits of this tutorial.

Step 40. Your phone should reboot once, just let it do its thing.

Step 41. When everything is done, you will get an option to reboot your phone, hit Volume Up to reboot.

Step 42. You should now be back on sfotware 651.1.  Let’s go root it using Revolutionary root method.  Make sure USB Debugging is checked ON under Settings->Applications->Development.

You can also see original step-by-step instructions for rooting using Revolutionary here.

Step 43. Go to command prompt and type “revolutionary.exe” and copy the serial number.

Step 44. Go to the website and click on “Download for Windows”.

Step 45. Choose “Windows”, HTC Evo 4G, 2.16.0001, and paste your serial number.  Click on “Generate key”.

Step 46. Copy the beta key.

Step 47. Go back to command prompt and paste your beta key and hit Enter.  Your phone should now become S-OFF after couple reboots.  Just let it do its thing.

Step 48. Your phone should say “Revolutionary” with “S-OFF” and HBOOT 6.16.

Step 49. You can stop here if you are going to flash a new custom ROM anyways.

You will be on 651.1 OTA plus root plus S-OFF.

(If you want latest 651.3 OTA rooted, keep going)

If you want to be rooted on latest 651.3 OTA plus root, copy the file to the SD card of your phone.

Step 50. And delete file as it will interfere.

Step 51. Reboot into bootloader by holding down Volume Down and Power button.  You know the drill by now.  And choose “FASTBOOT”.

Step 52. Go to command prompt and type this again to re-flash recovery as it has been wiped out during OTA 651.1 zip install.

fastboot flash recovery recovery-RA-supersonic-v2.3.img

Step 53. Choose “RECOVERY” to enter recovery.

Step 54. Choose “Flash zip from sdcard”.

Step 55. Choose “Choose zip from sdcard”.

Step 56. Choose the file “”

Step 57. When that’s done installing, go ahead and install the file “”.  This will give you root (again) on 651.3.

Step 58. Reboot and you will find yourself with the latest Software 651.3 (just like you started) with root and S-OFF.


Time to get all this done = around an hour.

Having the latest OTA, rooted with S-OFF so you can go flashing new ROMs on the bus or the plane = Priceless.


Q: Why do I need S-OFF?
A: If you want to install new custom ROMs without a computer.
Q: Can I flash a new custom ROM with S-OFF?
A: Yes you can but you must boot recovery from fastboot, get your phone into fastboot USB mode, then the command is:
fastboot boot recovery-RA-supersonic-v2.3.img
You must do this everytime you want to flash a new ROM if you are on S-ON.

Q: I am having problems on Mac or Linux!
A: Try running with root by typing “sudo -i” first or add “sudo” in front of commands.

For those on S-OFF, just flash normally from recovery.

Credits – Huge thanks to user THC Butterz who put it all together.

If you like this post, don't forget to Like us on our Facebook page!

Want to stay updated on latest HTC Evo hacks and tips?
Sign up for our HTC Evo Hacks Newsletter here so you don't miss a single tip!
Categories: HTC Evo Hacks.

Recent Android News from

378 Responses to How to Root HTC Evo 4G on HBOOT 2.18 with S-OFF!

  1. mykhal says:

    ISSUE RESOLVED,was easier then i thought

  2. kyle says:

    hey hey 🙂

    Im stuck on step 21-27 I went through the steps and my recovery screen didnt come up. now i can not get my fastboot to say fastboot usb
    Trying to retrace my steps from after unlock_code.bin (which was successful) and still cant get my phone to say fastboot usb…
    in cmd the fastboot flash recovery is saying waiting on device…

    Any ideas?

  3. wally18324 says:

    I have a question regarding this method.I don’t know where to post it I have an Htc Evo 4g. Rooted already by the Htc method, still have s-on. 🙁 I am currently using Decks Reloaded and Amon-ra 4.3. I would like to get s-off. But really don’t want to go through a lot of hassle.Can I use this method and if so how do I go about it. Very happy with what I have, just can’t zip through recovery and get new logos. I appreciate all the advice. Thanks in Advance.

  4. rOBERT says:

    UHi Max, Under step 35. I was able 2 enter the first 2 commands & then this is wat followed:C:\Documents and Settings\Robert\Desktop\RootEvo4GNew>adb push mtd-eng.img
    adb server is out of date. killing…
    * daemon started successfully *
    2155 KB/s (655360 bytes in 0.296s)

    C:\Documents and Settings\Robert\Desktop\RootEvo4GNew>adb shell
    adb server is out of date. killing…
    * daemon started successfully *
    ** daemon still not runningerror: cannot connect to daemon

    C:\Documents and Settings\Robert\Desktop\RootEvo4GNew>SU
    ‘SU’ is not recognized as an internal or external command,
    operable program or batch file.

    C:\Documents and Settings\Robert\Desktop\RootEvo4GNew>su
    ‘su’ is not recognized as an internal or external command,
    operable program or batch file.

    C:\Documents and Settings\Robert\Desktop\RootEvo4GNew>

    Any suggestions?

  5. Joshua Bryson says:

    i rooted an evo 4g newer version with this method but did not continue to s-off. i did make a nandroid before installing cm7.2 with tiamat kernel. it is very glitchy so i would like to return to stock and reroot and try a more stable rom. how do i unroot? do you have a suggestion on a stable rom with hdmi mirroring support?

  6. James Hardin says:

    In step 38 your forgot to say that they need to hit the power button to go into fastboot for it to check for that zip

  7. Mike says:

    HI Thanks for the Video on the rooting my evo Worked perfectly. Is there a way to increase the partition to have more room for the apps. I tried with a program and had to reinstall the Original OS from from another EVO phone. Does it have to be S-off to do so ? it is unlocked and rooted but it is S-On thanks in advance

  8. Brian says:

    Sir you are awesome. Mine worked like a charm. Thank you very much for taking the time out to make such an awesome video. I think it’s impossible to mess this up with such a great video. Cheers!

  9. Speedy says:

    hey, tk 4 all ur help. allways. ok I root my htc evo 4g on HBOOT 2.18 with S-OFF but everything was fine, two weeks later my touch panel fail. now that I TRY TO FLASH A NEW ROM. Help can not use phone now.

  10. Suzanne says:

    HELP! and THANK YOU!
    First, I searched all over for help with booting my 2.3.5, version 2.18….thank you . The directions are so simple…I have the Evo 4g, originally from sprint. I got through all of the directions, up to 35.
    I did all the following, no problems:

    Step 35. Go back to command prompt and type:

    adb push flashimage /sdcard/.
    adb push mtd-eng.img /sdcard/.

    adb shell

    BUT when I try to type the next commands…
    cat /sdcard/flashimage > /data/flashimage

    THIS is what I get:

    c:\Users\Sue\Desktop\root files>adb shell
    $ su
    # cat/sdcard/flashimage>/data/flashimage
    cat/sdcard/flashimage: not found
    # cat /sdcard/flashimage > /data/flashimage
    cat /sdcard/flashimage > /data/flashimage
    /sdcard/flashimage: No such file or directory
    # cat/sdcard/flashimage>/data/flashimage
    cat/sdcard/flashimage: not found
    # cat /sdcard/flashimage > /data/flashimage
    cat /sdcard/flashimage > /data/flashimage
    /sdcard/flashimage: No such file or directory
    c:\Users\Sue\Desktop\root files>cat /sdcard/flashimage
    ‘cat’ is not recognized as an internal or external command,
    operable program or batch file.

    Can you help me?
    Thank you again.

    • Ronishaa says:

      You have to go back into the by doing this
      cd Downloads ENTER
      cd RootEvo4GNew ENTER
      adb push flashimage /sdcard/.
      adb push mtd-eng.img /sdcard/.

      adb shell
      cat /sdcard/flashimage > /data/flashimage
      chmod 755 /data/flashimage
      /data/flashimage misc /sdcard/mtd-eng.img
      exit ENTER

  11. Eritheill says:

    I made one fatal mistake when rooting.. I totally blanked on backing up my contacts, etc. It won’t let me sync with Google anymore now that it’s rooted, and it seems to have all of my apps on the SD card, just in a seemingly inaccessible partition from the phone itself..

    Any suggestions on how to get my stuffs?

  12. glager says:

    my unrooted evo 4g has current software number of 5.07.651.1 i good to use this procedure? if so can i get back to this software number?

  13. LGomex says:

    Thank you so much man, You did a Great job,

  14. johnny says:


  15. duckusa says:

    Works great coming off 2-18.01 Thanks

  16. THC Butterz says:

    Wow, I learned many processes off of this site, kinda cool to stumble apon one of my tuts here!! made my day…lol

  17. Max Nix says:

    Well, this has been a real 3 hr. cluster bomb and only halfway through.

    It seems the EVO 4G is looking for a file called and not which is corrupt as far as the HTC is concerned. IN any case, formatted SD Card or not, the HTC will not restore to either file as it says they are unreadable.

    Other frustrations with the presentation I will save until later when I get my phone back.

  18. Max Nix says:

    For later versions of Android than the tutorial addresses, the Root can be unlocked, but the file WILL NOT BOOT! no matter what one does with a new formatted micro SD card. The phone will not recognize any image on that file.

    AVOID AT ALL COST going beyond Step 33 if your phone has Build Number 5 or higher of Android.

    His version of is unreadable and flawed!

    • HTC Evo 4G Hacks says:

      Make sure you relocked bootloader also, will not work on unlocked bootloaders.

      • Jason McLean says:

        First and foremost, Zedomax, Thanks for such a comprehensive tutorial. I was out of breath at the end as well. Secondly, the phone I worked on was the latest OTA from Sprint. I followed all steps through to the very end with no issues. The only hiccup was when I tried to flash a ROM and realized that had not flashed the recovery file. After that, no issues. MikG v3.0 running like a champ.

  19. Max Nix says:

    OK. Final Update , I hope. Reformatted (again) micro SD 8GB and extracted directly to it with not folders.

    Rebooted and hit UpVolume key to start update search. Phone searches first for and not no image is found. Then it searches for PCPC36DIAG.nbh and reports bad or no image.

    Then it searches for and voila, it updates. Have no idea why it did not work before, but it was in a folder whereas now it is not.

    Something is still way too kluge in this process, but there is no support nor evidently interest from the author either.

  20. Eduardo says:

    I went as far as step 49 and when i tried using a screen shot app is said my phone wasn’t rooted no more. I also noticed that i didn’t have superSU anymore. Is there a way i can just get the s off back to on and just leave it as normal rooted. I don’t know how to install roms so i just want to go back. Thanks you

  21. Raf says:

    Thank you I am rooted with S-OFF (FINALLY!) This is my second Evo and it was re-furbished so I had to go through all these steps. At the end of your Q&A after saying we are S-OFF you typed “You must do this everytime you want to flash a new ROM if you are on S-ON.” Was the last word “ON” a typo?

    I performed the Q&A’s suggested recovery from fastboot USB mode, with the command:
    fastboot boot recovery-RA-supersonic-v2.3.img
    and did a backup so I can start uninstalling bloatware and in case I mess up. Is this the only way of installing ROMs or can I install a ROM Manager like clockwork or move the RA supersonic directly to my sd card and run it from fastboot without usb?

    Just not sure the easiest way to search for this since this is way different from such an easy root a couple years ago.

    Any help appreciated!

  22. Nate1 says:

    Where is the link to download the It does nothing but take me to another site with the information about the file but nowhere to click to download. Is it gone or what?

  23. Becky Williams says:

    I have the same problem as Eritheill. I’m rooted but am unable to register my google account. What can I do to get sync back?

  24. Ariel Brown says:

    Hey Max, my HTC EVO 4G, doesn’t say fastboot usb… it has 2.18 update i really dont know what the problem is….Can you tell me..

  25. nate says:

    you is a god my friend finally i rooted my phone

  26. hugo says:

    When i type (fastboot oen get_identifier_token )I dont get the token. Can you help me? please.

  27. Raf says:

    I don’t think anyone is monitoring this thread anymore, I haven’t got a response or seen any responses lately. Plus theres been a system update being pushed that I keep turning down.

    I’m afraid to install different ROMs because I’m just not sure if I can the usual way or if I have to thru usb commands, so I haven’t… Help us please!

  28. pavonn says:

    ISSUE RESOLVED, thanks a ton……

  29. catdubh says:

    Just ran through this starting with 2.18.0001…worked like a charm. Followed this step-by-step and it worked perfectly. I’ve been wanting to do this and this article could not have made things easier…thanks!

  30. queknight says:

    Finally got it to work after 3 days. I kept getting stuck at step 35. After a massive search I read about uninstalling everything HTC and installed HTC SYNC MANAGER (Rebooted) and bam. I’m BACK BABY

  31. Erik says:

    I have a Mac. Im getting stuck with the command prompt part. It always says “permission denied”. Help!

    • Anthony says:

      i found that if there is no password set it wont work

      • Zach says:

        I made it to Step 35, and I am on a Windows machine, but I am getting the ‘Permission denied’ response as well. when I attempt to run the adb part of it.???? Please help.

        Thank you! Woof. 🙂

    • rich says:

      I am stuck there too.
      I assume it means permissions to its destination /sdcard/.
      is /sdcard hidden??

      This is beyond me….

  32. Jr says:

    Im stuck at step 8…for some reason htc bootloader does not show in the device manager just Android USB Devices and in the pull down My HTC…tried the driver detective and everything. So when I type in the cd downloads that works but it doesnt recognize cd RootEvo4GNew says the system cannot find the path specified…please help Im stuck. Thanks a bunch.

  33. Luke says:

    I have downgraded and I am at the revolutionary step. but whenever I try it says “Zerging Root…. Failed to get root!” Note: I am running this in Linux.

  34. Ronishaa says:

    How do I flash a custom rom with S-ON ?

  35. GeekyBoy says:

    Everything seems to go well, until I get to step 52. I tried the command from both Linux and Windows and it hangs on both. From Linux command line I get stuck at “”, and on Windows it doesn’t get any further than “writing ‘recovery’ …

    Any idea what would cause this halting?

  36. scott says:


  37. tommy says:

    after step 17 I check my email and the unlock code bin can olny be download as a vlc file. How do I change that to make it work

  38. Anthony says:

    Are you cooking up a root method for phones being shipped with/OTA JB update?

  39. I’ve been surfing online greater than three hours as of late, yet I by no means found any fascinating article like yours. It is lovely worth enough for me. In my view, if all web owners and bloggers made just right content as you did, the internet will be much more useful than ever before.

  40. miguel says:

    I know people read this for solutions sometimes too, I did, and I was having trouble installing the new recovery at step 24, last thing I did was switch from a usb 3.0 port to a 2.0 port on my pc. I tried everything else before, so that must have been it. Maybe that will one day help someone.

  41. SkullyD says:

    Ok im stuck on Step 26 everytime i try and select recoverey the boot screen comes up ant then a phone with a red triangle. What do i do :/

  42. Chad says:

    I have a strange issue after rooting my phone with this method. First of all, the instructions were GREAT and it was a FLAWLESS rooting of my HTC EVO 4G. However…. I use a “pattern” to unlock my phone when it has been idle and now my phone unlocks with ANY pattern you decide to enter.

    Any thoughts??

    I have not flashed any new ROMS. I went through every step in the video from beginning to end and did not run into any issues along the way. Can this be fixed or do I need to attempt to flash a new ROM? If I should flash a new ROM, I am leaning toward the MIKG rom…. unless there is something out there that is faster, more stable, and “neato” to use??

  43. dudehealthy says:

    I’m stuck on Step 17. I filled out all the information on HTCDev, and went thru the process – but I never got an email with the file attached. Tried it again, still nothing. Tried setting up a separate account and trying again – still nothing.


    • rich says:

      I noticed when I pasted my token in the submit form that some extra characters were created.
      I am on a Mac so I figured they were escape characters..cleaned it up and resubmitted it and it worked.
      should look like this:

  44. Pingback: {GUIDE}Unrooting gingerbread 2.3.5 - Android Forums

  45. yamel says:

    help i have finally rooted my phone and i need on how to install the digital karma rom

  46. Carlos says:

    Follow your easy direction and everything work great. Very long process but it was worth it. I just wish I can get the twrp back up recovery for my htc evo 4g.

    Android vers.2.3.5
    Baseband vers.
    kernel vers.
    build # 4.67.651.3 CL239674 release key
    software #Classic v0.1p3 Supermagic

  47. Matt says:

    I cant get HTCDev to work. I signed up and log in, go to bootloader, pick all supported devices, click go, then the are you sure you want to continue comes up, hit yes and nothin happens. Their site havin issues or what?

  48. Zabby says:

    I get same thing, Press Yes and Stops Nothing?????

  49. gsimms says:

    Can somebody help I am still stuck on the part with the command prompt. I downloaded the files he said and then extracted them to the desktop and when I open up the Command prompt on my computer and paste cdDownloads <<<<<This goes in fine cd RootEvo4GNew <<<< but this says the system can not find the patch specified fastboot oem get_identifier_token<<<<<< this ones says 'fastboot' is not recognized as an internal or external command,operable program or batch file help!!!!!!!! I have and Acer Aspire if that helps

  50. abugeater says:

    Fantastic video! Fantastic instructions! Worked great the first time.. Thank you.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related News and Resources