Sprint HTC Evo Shift 4G Root and ROM Replacement


Original guide is available here.

Detailed Instructions

Required Software

  • Download and install the Android SDK onto your PC.
    • run tools/android which will launch a GUI.
    • Choose Available Packages -> Android Repository. I installed Android SDK Tools, Android SDK Platform-tools and SDK Platform Android 2.2. Platform-tools requires adb which is used for this process.
    • Close the GUI
  • Download fastboot from HTC. Once unzipping the download I placed fastboot into the platform-tools directory of the SDK which is where adb is.
  • Install VISIONary+ onto your phone. This will give you temporary root to then perform the permanent root.
  • Download These are the files that will permanently root your device.
  • Unzip and place its contents into the root of your SD card. Keep the path in tact. Your phone should now have:
  • Download This is the recovery image. Unzip it to somewhere on your PC, the resulting file is recovery.img. You do not need to copy this to your phone.
  • My local mirror of the required files is here.


  • Make sure you do not have the Superuser App installed, VISIONary+ will install it automatically.
  • Put your phone in Airplane mode.
  • Launch VISIONary+ and choose Temproot now. Phone should do something for a bit and then bring you back to this menu. If for some reason it reboots, make sure you're in Airplane mode and don't have the Superuser app installed per above.
  • From the SDK on your pc run adb start-server. If on Linux this must be done as root.
  • From the SDK on your pc run adb shell to get a shell ($ prompt). Run su to become root ( # prompt). If this is your first time doing this you will receive a dialog on the phone- you must approve it from the phone's screen.
  • Verify that the files you copied to your sd card are valid. Run this command from your phone:
md5sum /sdcard/Shift/hboot_orig.bin
  • This should result in this output:
386c19451e8dd18f9b98fad6b11be4c0  /sdcard/Shift/hboot_orig.bin
  • Verify the other file:
md5sum /sdcard/Shift/hboot_eng.nb0
  • This should result in this output:
60ec1006e6ec2e8acb370d6aad35b17e  /sdcard/Shift/hboot_eng.nb0
  • If for any reason the hashes above don't work you must re-copy the files onto your SD card or possibly re-download the original .zip file.
  • Finally we will perform the root. Run this command from your adb root shell:
dd if=/sdcard/Shift/hboot_eng.nb0 of=/dev/block/mmcblk0p18
  • Once complete will will verify that the file we wrote still has the same md5sum. Run:
dd if=/dev/block/mmcblk0p18 of=/sdcard/Shift/hboot_check.nb0
md5sum /sdcard/Shift/hboot_check.nb0
  • This once again should be the valid checksum from before:
60ec1006e6ec2e8acb370d6aad35b17e  /sdcard/Shift/hboot_check.nb0
  • If for any reason this does not match DO NOT REBOOT YOUR PHONE! Redo these steps until the md5sum matches.
  • If things match power down your phone. Hold VOL-DOWN + POWER to boot your phone into the bootloader. It should say S-OFF (Security Off) at the top.
  • Power down and boot your phone normally.
  • Put your phone into Airplane mode again.
  • Launch VISIONary+ and choose Attempt Permroot now. Your phone will reboot.
  • That's it, your device is permanently rooted. You can test by going to an adb shell and typing su again or installing an app from the Market that requires root. The first time you run any program that requires root the Superuser app will ask you to permit it.

Recovery Partition

  • Backup your wimax keys by running these commands from a root shell on your phone:
dd if=/dev/block/mmcblk0p25 of=/sdcard/Shift/wimax.bin
dd if=/dev/block/mmcblk0p30 of=/sdcard/Shift/udata_wimax.bin
  • Reboot your phone to the bootloader prompt with adb reboot bootloader. You can also get here by booting the phone while holding down VOL-DOWN + POWER.
  • Your phone will be at the bootloader.
  • Choose FASTBOOT from the menu, you should now have FASTBOOT USB in red.
  • As root, run fastboot devices. This initially listed ???????????? fastboot. After a few runs It showed HT0CBHV0xxxx fastboot.
  • Flash the recovery image using this command:
sudo fastboot flash recovery /path/to/recovery.img
  • I received this output:
sending 'recovery' (4034 KB)... OKAY
writing 'recovery'... OKAY
  • Power your phone down and once again boot into the bootloader with VOL-DOWN + POWER.
  • From the menu choose Bootloader and then Recovery. This will boot you into the ClockworkMod Recovery. From here you can go to backup and restore and then backup.