unrevoked

Revolutionary: S-OFF & Recovery Tool 0.4pre4

At last, the time has come -- AlphaRev and unrevoked have come together to join our strengths
and build an S-OFF tool for the next wave of phones. We're very excited about this, and we hope
that you will be too! We've been working on this for a while, and we'd like you, our fellow
developers, to get early access, so you can build awesome applications and amazing ROMs for
everyone to use. So, today, we're releasing for you a developer preview of something that we call
Revolutionary.
Revolutionary? Why the name? Well, this tool is revolutionary in a couple of ways. It's the first
major collaboration between two development groups that we know of -- and in honesty, we've
stood on the shoulders of other giants, too, in building this! It's revolutionary in some of the
mechanisms by which we gain S-OFF; we have worked quite a while to build this, and we think
that we've come up with a robust solution. And, we'd like to think of it not just as a revolutionary
tool, but as a revolutionary itself! Over the past few months, our community has successfully
convinced HTC and other vendors of the need to provide unlocked bootloaders for their phones.
As we build this tool out to work with the unlocked updates, we're excited about the next wave
of innovation that this tool can help spark.

Let's get started!

This software is a developer preview. We still haven't made it perfectly easy to use for
everyone, but we want power users and developers to be able to get started. If you're not a
developer, feel free to try it out anyway; but you'll have to be patient with us while we iron out
the wrinkles.
All devices included in this release have been pretested. Please note, however, that bugs could
still be present! If you're willing to accept the risks anyway, download the binary for your OS
below, and generate a beta key through the application form that appears. In case we need to
make changes to the tool, every phone has a unique beta key, so in this developer preview, you'll
have to get a key for each phone you wish to unlock.
Before you begin, please carefully read our documentation page for this tool; that page also lists
which devices (and which versions of those devices) are supported.

Revolutionary S-OFF & Recovery tool

Revolutionary is a tool to give you S-OFF on your phone and optionally flash a custom
recovery image to your Android phone. A custom recovery image allows you to perform

advanced tasks on the system partition , such as flashing custom ROMs and taking a full backup
of your phone (a nandroid backup). We recommend installing the custom recovery image for
all users who want rooted phones .
The current version of Revolutionary, 0.4pre4, is a developer preview. We still haven't made
it perfectly easy to use for everyone, but we want power users and developers to be able to get
started . If you're not a developer, feel free to try it out anyway; but you'll have to be patient with
us while we iron out the wrinkles .
You can download Revolutionary from our site, http://revolutionary.io/.
Windows users, please download and install these HTC fastboot drivers.
Revolutionary comes with NO WARRANTY (express or implied), and NO GUARANTEE OF
FITNESS for any particular task. Although we have attempted to minimize the risk the best we
can, the authors disclaim any chance of damage to your phone. The entire risk of running
Revolutionary lies with you, the user.

Supported Devices
Revolutionary currently supports the following Android phones and HBOOT versions:

HTC Desire (bravo) 0.93.0001, 1.02.0001

HTC Desire CDMA (bravoc) 1.06.0000
HTC Wildfire ( buzz ) 1.01.0001
HTC Aria (liberty) 1.02.0000
HTC Incredible S (vivo) 1.09.0000 and 1.13.0000
HTC Droid Incredible 2 (vivow) 0.97.0000 (Gingerbread only!)
HTC Desire S ( saga ) 0.98.0000 and 0.98.0002
HTC View (express) 1.09.0000 and 1.13.0000
HTC Flyer (flyer) 1.10.0000, 1.11.0003
HTC Sensation (pyramid) 1.17.0006, .0008, .0011 and .0012, 1.18.0000
HTC Evo 3D (shooter) 1.30.0000 and 1.40.0000
HTC EVO 3D GSM (shooteru) 1.49.0007, 1.49.0008
HTC Thunderbolt (mecha) 1.04.0000, 1.05.0000
HTC EVO 4G (supersonic) 2.15.0001, 2.16.0001
HTC myTouch Slide 4G (doubleshot) 1.44.0007

Revolutionary will permanently unlock NAND write protection by default on the following
phones:

HTC Sensation (pyramid)

HTC Evo 3D (shooter)

HTC EVO 3D GSM (shooteru)
HTC myTouch Slide 4G

Changelog
Revolutionary has been through the following iterations:

0.4pre4
- Fixed HTC Thunderbolt (mecha) 1.05, added support for HTC Evo 4G (supersonic) 2.15.0001
and HTC Evo 3D GSM (shooteru) 1.49.0008

0.4pre3
- Fixed support for HTC myTouch 4G Slide (doubleshot) 1.44.0007

0.4pre2
- Fixed support for HTC Incredible 2 (vivo_w) 0.97.0000, only works on Gingerbread now!

0.4pre1
- Added support for more devices and expanded/improved support for existing devices,
including:
o Bravo, 1.02.0001
o Flyer, 1.11.0003
o Pyramid, 1.18.0000
o ShooterU, 1.49.0007
o Doubleshot, 1.44.0007
o Mecha, 1.04.0000
o Supersonic, 2.16.0001
o Mecha, 1.05.0000

0.3pre7
- Fixed support for HTC Sensation (pyramid) 1.17.0008

0.3pre6
- Initial public release.

Common Problems & Questions

Why do you need my serial number?

We use your serial number to generate your unique beta key to use revolutionary.

Why do I need a beta key?

We introduced the beta key mechanism so that if problems/bricks occur we can stop generating
beta keys to prevent more people being affected.

I don't want to give you my serial number!

That's fine, stable releases will not require a beta key, however there may be significant time
between a beta and the subsequent stable release.

Does Revolutionary give me root?

No. You will need to flash this zipfile from recovery.

What does this do, then?

revolutionary will give you S-OFF either by a patched HBOOT or setting the secureflag to off on
the device itself. This behaviour will depending on your particular device. Optionally it will also
replace the stock Android recovery with a custom one, which adds many features including
nandroid backups, the ability to use custom ROMs, and a greater amount of flexibility and
customization of your Android phone.

Does this permanently unlock the NAND flash on my phone?

Yes. The default configuration of this tool disables the phone's security, which also disables the
NAND locks placed on the storage by the bootloader.

Are any drivers required?

On Linux, the program is self-contained. For Windows users, please install the fastboot drivers
available here.

I'm running Linux and it won't detect my device!

Either run the program with root permissions, or add appropriate udev rules to the file
/etc/rules.d/51-android.rules. Instructions are available at the Android Developers
website.

The program hangs when waiting for the system to settle. -OR- the program says
Communications with phone unexpectedly interrupted.
Uninstall any programs that may connect to the phone over USB and automatically sync.
Specifically, we have had interference from HTC Sync and Doubletwist in the past; other
programs may also cause trouble. Try reinstalling the drivers, if all else fails (or use Linux, which
has a 99% less sucky USB stack).

Titanium Backup says that I'm not rooted, even though I ran Revolutionary and flashed the
root zip from recovery.
Install Busybox from the Market to fix this.

Will you release the source code?

At this time, we are not disclosing the vulnerability we have exploited.

That doesn't seem fair! Android is about open source.

In some senses, we agree; but at times, a tradeoff needs to be made. Releasing the source code
for this, we believe, would compromise the greater ability to unlock devices like these in the
future. Given the choice between sacrificing the liberty of running code on our handsets and the
liberty of reading the code by which we unlock it, we feel that the millions of handsets are more
important. It is unfortunate that we must make such a choice, and we look forward to the day in
the future that no such decision need be made.

Where can I get support?

As an experiment, we'd like to redirect users to our IRC channel for support. If you have an IRC
client already, connect to irc.freenode.net, channel #revolutionary if you don't, then that's OK;
you can use Freenode's web IRC client. We'd love to hear from you!

Credits
Revolutionary was brought to you by (in no particular order):

Ryan Pearl
Joshua Wise
Eric Smaxwill
Matthew Fogle
Matt Mastracci
Koush Dutta
Michael Sullivan
Adam Glasgall
Kenny Millington
Sen Verbrugge
The mysterious 0xf4b

Special thanks (in no particular order):

Scott Walker for the psneuter exploit.

Sebastian Krahmer for the GingerBreak exploit.
agrabren and teamwin for the fre3vo exploit.
Bumble-Bee for assisting with early eMMC device support.
attn1 for all-round amusement and building recoveries.
toastcfh for early testing on EVO 3D and general support.