使用步骤：
• 安装 Visionary+ （R14）[请直接从手机内存卡安装，至于使用方法，论坛有很多帖子]
• 打开Visionary+，取得临时root权限，直接点击Temproot now就可以了。然后取得永久root权限，即点击Temproot now后，稍等片刻，等屏幕 返回首次打开界面，再点击 Attempt Permroot now，superuser会自动启动，询问你是否允许给予通行，点击允许，即可得到手机的永久root权限（手机会自动重启）。
• 手机连接到电脑 （确保手机的“USB调试”选项打勾并以“仅充电”方式连接电脑）
• 下载附件，解压后打开文件夹里的 "Desire HD easy s-off.exe", 点击 "S-OFF it"！如果SUPERUSER提示需要权限选择“允许”，如果
你的机器已经SHIP S-OFF，则勾上“I Have Radio S-0FF”。
注：软件最后一句是说，作为一个新特性，如果你是SHIP S-OFF（RADIO S-OFF），本工具可以支持任何ROM
• 如果使用完程序出现FC（强制终止）的情况请重启即可，不用担心。
• 完成。（请记得点击“thanks”按钮）
PS：请结合EASY RADIO TOOL一起使用，先做SHIP S-OFF（这是为了安全起见），再使用本软件做ENG S-OFF，用于开通FASTBOOT功能。
解锁一般分为两种：ENG S-OFF（工程解锁）和SHIP S-OFF（白卡解锁）。 在这不详述这两种解锁方式如何解锁，我们来说说如何判断机器是否已经解锁。
1、取下手机电池，然后重新放入。
2、按住音量下键，点击电源键，手机将进入HBOOT屏。
3、设备上出现白底黑色字体屏幕，这时可以查看最上面第一行最后是S-ON（即为未解锁）还是S-OFF（即为已解锁）。
S-ON为未解锁，请移步对应机型的解锁教程贴进行解锁：
G3：http://bbs.fengbao.com/thread-289107-1-1.html
G7：http://bbs.fengbao.com/thread-288985-1-1.html
G10：http://bbs.fengbao.com/thread-238997-1-1.html
G12：http://bbs.fengbao.com/thread-326425-1-1.html
S-OFF为已解锁，可以开始畅游刷机旅程啦！
ROOT:
如何判断是否已经获取ROOT权限。
先安装一个ES文件管理器。
1、打开ES文件夹管理器，点击硬键的MENU键，出现下弹出框，选择设置。
2、进入设置界面后，将选项菜单向下滑动，找到最下面的ROOT浏览选项，点击进去，勾选ROOT浏览，会依次出现两个弹出框，第一个实验功能选择确定，第二个选择使用系统选择安卓版，然后确定，会出现一个授权管理窗口选择“记住”即可。
3、这时如果ES文件管理器提示你已经获取ROOT权限，那么代表你的ROM已ROOT。并非所有的机型和ROM都已完美获取了ROOT，经过大量测试发现，部分机型ROM的ROOT并不完善。
Update 05/04/2011 - Where we are so far...
I thought I had better update this post, to let people know where we have got to and what we have tried, in case any developers want to join the fight. This will be a little technical and not explained step by step, there is a Q&A if you want to learn more about the goings on.
First off, the 'team'. Below is a list of people currently working on trying to get root, pm any one of us if you want to help. When I say what to help, please don't just PM saying "I want to help, I have no technical knowledge, what can I do?" We have plenty of testers, what we need is technical insight.
l0st.prophet
bin4ry
timbo007up
hawkysoft
Soctty2 was providing a lot of contributions in the early stages but we haven't heard from him in a couple of weeks, so don't contact him directly.
Where we are at at the moment. We can obtain temproot via the psneuter exploit, which allowed bin4ry to attempt to modify the wpthis exploit to allow us to load an S-OFF HBoot which was supplied by an anonymous benefactor. Unfortunately that didn't really amount to anything despite our best efforts, so he has now turned his attention to the kexec method of running a custom kernel, to see if that gives us an in.
Started 05/03/2011 - The race begins...
I am trying to root the Incredible S as no developers appear to have picked it up, but I am pretty new to this and was hoping for a little help. I have tried SuperOneClick and it appears to give some sort of temp root (although SU force closes and the test command fails, it does write to the system partition) and rebooting removes it all.
I am little lost where to go from here, although someone suggested using and older version of SOC and checking the log files, I will let you know what I find.
Frequently Asked questions
Temproot and Permaroot - What's the difference?
First, let me explain root access. Root access, superuser or su (all the same thing) is basically an admin account for Linux. It gives us permission to to access commands that normally couldn't be accessed, and to write information to partitions that normally couldn't be written to. On older devices (such as the Hero), once we had root we could write to the /system and /recovery partitions, and flash custom ROMs. In the case of the IS (and every HTC device since the desire), this isn't true. Getting root access is quite trivial and no where near as useful, because the internal flash memory (NAND or eMMC) is locked down and it means we everything we 'write' to the system (or any other protected partition) is lost on reboot because it is a non permanent change. In short, this stops us from flashing custom ROMs and recovery. This is a problem for any devices that are shipped with the Security flag on (S-ON). To get Permaroot, and the ability to flash custom ROMs, we need S-OFF.
So what's this S-OFF then?
Since the Desire, HTC have been securing their phones better than before by locking the internal flash memory (NAND or eMMC) to stop it being written to, unless the file being flashed is signed by a private key only known to HTC. This is controlled by a flag (@secuflag) and is identified as the device being S-ON. Telling the HBoot the device is Security Off (S-OFF) stops this check for the key, and allows us to write anything to any partition, which is what we are aiming for.
There are actually two levels of S-OFF. The Bootloader (HBoot) and the Radio. Getting S-Off on the HBoot gives us everything we need, but doesn't actually turn off the @secuflag which is set in the radio. What it is possible to do is to flash a HBoot that believes the Radio is set to S-OFF, as the HBoot is responsible for setting that flag. Once the HBoot on the phone is S-OFF, we can write to all the partitions and basically do whatever we want, but it is possible to go one step further. Flashing a radio that is S-OFF and actually setting the @secuflag off gives 100% total access to every part of the phone and it's software, as it becomes network unlocked allowing to you to use any SIM and also allows you to flash a ROM from any carrier (known as Super CID). It also makes it nigh on impossible to permanently loose root no matter what you flash. Once you have radio S-OFF, it makes it much easier to flash new HBoots and ROMs even if you flash something that is locked down tight.
Setting the Radio to S-Off is not necessary, and gaining S-OFF on the HBoot is more than most people will ever need. Radio S-Off is just the last step of the puzzle, but it is worth noting the only points you can permanently brick your phone is flashing a radio or a HBoot, if either of these go wrong you will end up with a shiny expensive paper weight so there is risk involved.
What about this XTC Clip, can that help?
The XTC clip is a hardware device that can unlock HTC phones, regardless of the software. The device ahs been proven to unlock the Incredible S, but will require the purchase of additional hardware. We are aiming to achive full software only root, which will be free. the XTC clip will soon be available in one-off use variations for €25 if you do not want to wait for software root. Please note that the XTC clip doesn't currently allow you to revert back to S-ON if you need to for warranty purposes.
What about people who are getting devices shipped with S-OFF?
There are reports that a lot of devices coming out of China and India are shipping with the @secuflag set off. These are lucky people, and have the ability to write to the flash memory, but it can't help those of us who are S-ON. It is also worth noting that because most devices are S-ON, no one has written any ROMs or kernels for the device so they will probably have to wait until we get a way of turning our devices to S-OFF until anyone creates any software for it.
So, what are you doing about it?
Well, what we were trying to do is finding a way of telling the kernel to allow us to flash a version of the HBoot which was shipped S-OFF, thus allowing us to write to all the right partitions. All of the current exploits that allowed this to happen have been closed off, and none of them help us achieve or goal. The IS is part of a newer breed of HTC phones that are not vulnerable to any existing exploits. The only other released phone that is part of this new breed is the HTC Thunderbolt, but they have managed to get round it by downgrading to an older version of the software which is vulnerable to the older exploits. Although we have the ability to downgrade via a goldcard method (thanks to timbo007up), no one has discovered an RUU old enough to be exploitable. Bin4ry (they guy responsible for finding root on the X10) has been working with myself, timbo007up and hawkysoft trying to adapt the wpthis exploit (the one used on the G2 and DHD) to work with the Incredible S, but it appears that it cannot be done. He is now looking at the kexec method used on the X10 to load a custom kernel, to then allow us to overwrite the HBoot. This is how progress currently stands as of the 5th April 2011
http://forum.xda-developers.com/showthread.php?t=980497
刚刚找的的用来 Root desire z 和 G2的软件
好像很多地方都没有得下载
介绍就这样:
通过文件管理器打开VisioNaryplus.R14的APK包进行安装，安装完后点击该程序图标打开程序。出现以下几个选项：
Temprootonboot
Runvisionary.shafterroot
Setsystemr/wafterroot
TemprootNow!
AttemptPermrootNow!
UnrootNow!
注：默认前三项是没有勾选的，也不需要勾选。
直接选择"TemprootNow!"即可，会看到"设备正在root"的提示字样，稍等片刻执行完毕。
此刻，界面会自动返回到上面几个选项的界面。这时我们再次选择"AttemptPermrootNow!"，此刻会弹出一个对话框，要求以最高权限执行，直接选择"允许"即可。
执行完毕后，系统会自动重新启动，稍等片刻后系统重启完毕，这时你的DZ已经是具有ROOT权限的了。
验证的方法很多种，比如：
1、系统中会多一个"SuperUser"或"权限管理"的程序；
2、再次点击"TemprootNow!"会提示"你的设备已经rooted了"；
3、安装一些需要ROOT权限执行的程序看能否执行；
注：此方法为永久Root方法，重新启动也不会丢失权限。
可以在编译时就加入选项，直接编译为静态 --enable-speling
也可以在安装好后，用apxs添加
cd httpd-2.2.17/modules/metadata/mappers/
bin/apxs -i -c -a mod_speling.c
CheckSpelling .
CheckSpelling on
在设置中的“关于手机”记录着不少手机信息，就好像我们的身份证一样，记录着手机身份信息。升级RADIO，刷新ROM也要经常查看“关于手机”。下面我就为大家介绍一下“关于手机”。
进入设置，压轴的一个项目就是“关于手机”了。
首先可以看到手机状态、法律信息、系统向导、系统版本信息等。
进入“状态”可以看到手机电以重满，电池电量也有精确的显示，还有网络信息等。
再向下滑动可以看到手机串号（IMEI） 还有WIFI和蓝牙的真实地址，以及手机运行时间，我的连续开机22小时。
跳过法律信息不说，进入“系统向导”你就可以按照系统的安排一步一步学习怎样使用G1，新手朋友可以试试。
再来看最重要的“系统信息”部分。
型号：标注出你手机的硬件型号。
固件版本：系统的软件版本。
Baseband版本：也就是基频版本又叫RADIO版本。
Kernel版本：Android系统的LINUX核心的版本。
内部版本号：系统编译人员制定的系统版本号码。
