unrevoked3 recovery reflash tool

unrevoked3 is a tool to flash a custom recovery image to your Android phone. A custom recovery image allows you to perform advanced tasks on the system partition, such as flashing custom ROMs and taking a full backup of your phone (a “nandroid” backup). We recommend installing the custom recovery image for all users who want rooted phones.

It can be obtained from http://www.unrevoked.com/recovery/.

At this time, unrevoked3 works on all versions of the supported phones, thanks to work based on the exploit discovered by Sebastian Krahmer.

Windows users, please download and install these HBOOT drivers.

unrevoked comes with NO WARRANTY (express or implied), and NO GUARANTEE OF FITNESS for any particular task. Although we have attempted to minimize the risk the best we can, the authors disclaim any chance of damage to your phone. The entire risk of running unrevoked lies with you, the user.

Supported Devices

unrevoked3 currently supports the following Android phones:

  • Sprint EVO 4G (HTC Supersonic)
  • Droid Incredible (HTC Incredible)
  • HTC Desire GSM
  • HTC Desire CDMA (HTC BravoC)
  • HTC Aria
  • Droid Eris (HTC DesireC)
  • HTC Wildfire (HTC Buzz)

unrevoked3 will permanently unlock NAND write protection by default on the following phones:

  • Sprint EVO 4G
  • Droid Incredible (HTC Incredible)
  • HTC Desire CDMA (HTC BravoC)

We have noticed that the core mechanisms behind unrevoked3 may apply to other rooted current-generation HTC phones running Android 2.2. At this time, the tool does not support other phones; if you have an unsupported phone of that description, please get in contact with us.


unrevoked3 has been through the following versions:

  • v3.32:
    • Actually improved compatibility with Android 2.1, instead of failing to improve compatibility with Android 2.1.
  • v3.31:
    • Backed ClockworkMod down to 2.x series on EVO 4G; now
    • Improved compatibility with Android 2.1 (fixes “am reported error starting service”).
    • Increased root timing window (fixes “failed to get root” on supported devices).
  • v3.3:
    • Fix for latest EVO 4G OTA (3.70.651.1) and EVO 4Gs with new versions of HBOOT (2.02 and 2.10).
    • Switched exploits for all platforms; hopefully more reliable than rageagainstthecage
    • Updated ClockworkMod, with plenty of new features:
      • for EVO 4G, which has a new kernel (for better WiMAX safety), and supports WiMAX key backup
      • for Incredible, which supports SLCD
    • No update for Wildfire yet; sorry.
    • Only Snow Leopard is supported in the OS X build.
  • v3.22:
    • Fix for latest Incredible OTA.
    • New Mac OS X build infrastructure; let us know if it broke for you.
    • Switched to in-house reimplementation of rageagainstthecage for better reliability.
  • v3.21:
    • Perform validation of the 'misc' partition before we start to ensure that it's safe for us to root your phone
    • Changes timing of root process to make it more reliable (requires one extra reboot now)
  • v3.2:
    • Added support for Froyo builds on all supported devices (thanks to Sebastian Krahmer)
    • Added support for the CDMA Desire
    • Optionally disables security on supported CDMA devices
  • v3.14:
    • Added support for HTC Wildfire.
    • Updated to ClockworkMod Recovery
  • v3.1:
    • Fixed “Communications with phone unexpectedly interrupted.” error occurring on Windows version.
    • Updated to ClockworkMod Recovery
    • Program sets su permissions even when su is present.
  • v3.0:
    • Add support for Droid Eris.
    • Add the ability to function even without root on all supported phones.
    • Updated to ClockworkMod Recovery
    • Renamed to unrevoked3.
  • v2.1:
    • Added support for flashing a custom recovery image.
    • Updated to ClockworkMod Recovery ( on Incredible).
    • Removed Linux root requirement to run (Linux root may be needed if udev rules are not properly configured).
  • v2.0:
    • Mac OS X: Added support for 10.5, not just 10.6.
    • Added support for HTC Aria.
    • Updated to ClockworkMod Recovery
  • v1.0: Initial release.

Common Problems & Questions

  • Does unrevoked3 give me root?
    Yes. It previously did not; as of version 3.0, it does.

  • What does this do, then?
    unrevoked3 will replace the stock Android recovery with a custom one, which adds many features including “nandroid” backups, the ability to use custom ROMs, and a greater amount of flexibility and customization of your Android phone.

  • Does this permanently unlock the NAND flash on my phone?
    Yes. The default configuration of this tool disables the phone's security, which also disables the NAND locks placed on the storage by the bootloader. If you choose not to disable security, the /system partition will be read-only after the tool completes.

  • How do I re-enable security on my device?
    If you wish to re-enable security on your device, please follow the instructions for S-ON on the unrEVOked forever page.

  • How do I use a custom recovery image instead of the packaged ClockworkMod?
    You will need to choose a .img file, which is a binary file suitable for flashing. A .zip file will not work and may render your recovery partition inaccessible until you run unrevoked3 with an appropriate image.

  • Are any drivers required?
    On Linux and OS X, the program is self-contained. For Windows users, please install the HBOOT drivers available here.

  • I'm running Linux and it won't detect my device!
    Either run the program with root permissions, or add appropriate udev rules to the file /etc/rules.d/51-android.rules. Instructions are available at the Android Developers website.

  • The program hangs when “waiting for the system to settle.” -OR- the program says “Communications with phone unexpectedly interrupted.”
    Uninstall any programs that may connect to the phone over USB and automatically sync. Specifically, we have had interference from HTC Sync and Doubletwist in the past; other programs may also cause trouble. Try reinstalling the drivers, if all else fails (or use Linux or Mac OS, which have 99% less sucky USB stacks).

  • The program hangs on my Mac waiting for the phone.
    We've heard reports that setting your phone to “Disk Drive” mode instead of Charge Only makes this more reliable. If you're having trouble, give this a shot.

  • The program says “Error: failed to get root. Is your firmware too new?”
    If you're on EVO 4G, we've seen this happen with some applications from the market that cause incompatibilities; try uninstalling other apps. If you're on Wildfire, then the message is as it suggests; your firmware is in fact too new, and has the vulnerability that we use to get root patched. Sorry.

  • Titanium Backup says that I'm not rooted, even though I ran unrevoked3.
    Install Busybox from the Market to fix this.

  • Will you release the source code?
    At this time, we are not disclosing the vulnerability we have exploited to unlock the NAND flash.

  • That doesn't seem fair! Android is about open source.
    In some senses, we agree; but at times, a tradeoff needs to be made. Releasing the source code for this, we believe, would compromise the greater ability to unlock devices like these in the future. Given the choice between sacrificing the liberty of running code on our handsets and the liberty of reading the code by which we unlock it, we feel that the millions of handsets are more important. It is unfortunate that we must make such a choice, and we look forward to the day in the future that no such decision need be made.

  • I found this software useful, and I would like to donate to the team!
    Thank you for your support. At this time, the team behind unrevoked3 does not accept donations; but we highly encourage our users to donate to the Electronic Frontier Foundation. The EFF performs the important role of standing up for our digital liberties, including the liberties to reverse-engineer devices that we own. If you are able, please consider making a contribution to them so that they can continue to perform this valuable service.

  • Where can I get support?
    As an experiment, we'd like to redirect users to our IRC channel for support. If you have an IRC client already, connect to irc.freenode.net, channel #unrevokedtest – if you don't, then that's OK; you can use Freenode's web IRC client. We'd love to hear from you! Also, the wonderful folks from #unrevokedtest have written up an excellent wiki chock full of guides and help for EVO users – well worth a visit.


unrevoked was brought to you by (in no particular order):

  • Ryan Pearl
  • Joshua Wise
  • Eric Smaxwill
  • Matthew Fogle
  • Matt Mastracci
  • Koush Dutta
  • Michael Sullivan
  • Adam Glasgall

Special thanks to Sebastian Krahmer for the rageagainstthecage exploit.

Special thanks to _fenrir, ZanzDroid, TuffPoo, xrdodrx, and probably a few others that we've missed for helping out with support for the beta on the IRC.

public/unrevoked3.txt · Last modified: 2011/01/20 18:28 by joshuawise
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki