Runnymede S-OFF HBOOTS

Originally identified by XDA memeber fardjad the HBOOT partition on the Runnymede is not protected and can be written to with a rooted phone. Due to some limitations in that procedure, Unlimited.IO created HBOOTS which provide more complete S-OFF functionality as well as optionally providing overwrite protection.

This page contains modifed HBOOTS for the HTC Sensation XL (runnymede). These HBOOTS provide S-OFF and limited Engineering HBOOT behaviour for the HTC Runnymede. The HBOOTS enable flashing of radios and also ROMs from any region (SuperCID).

The protected HBOOTS have built in protection that prevent them from being overwritten by an RUU or a stock HBOOT. If you wish to return to stock or flash a stock HBOOT for some other reason you must first flash the unprotected HBOOT.


Supported Devices:

Runnymede S-OFF HBOOTS currently support the following Android devices:

    HTC Sensation XL (Runnymede)



To load the first of these HBOOTS on your phone if you are on a HTC factory HBOOT you must be rooted, either by using a temporary root such as zergRush, tacoroot or sparkyroot or by performing the bootloader unlock and flashing superuser. Installation is then performed using the following procedure:

  1. sudo ./adb push hboot_7230ddr2_Runnymede_6.25.4444.nb0 /data/local/tmp

  2. sudo ./adb shell

  3. $ su

  4. # dd if=/data/local/tmp/hboot_7230ddr2_Runnymede_6.25.4444.nb0 of=/dev/block/mmcblk0p18

  5. # exit

  6. $ exit

  7. sudo ./adb reboot-bootloader

If any of the HBOOTS from this page or the HBOOT from jardjsudo ./adb's original thread have been previously flashed then it is not necessary to follow the above procedure, instead the new HBOOT can be flashed directly using fastboot using the follow command:

  • fastboot flash hboot hboot_name.nb0

  • for example:

  • fastboot flash hboot hboot_7230ddr2_Runnymede_6.25.4444.nb0



Runnymede S-OFF protected HBOOT (GB)

md5 6dfb17e8c51ef8a3fd7480320d007766

Runnymede S-OFF unprotected HBOOT (GB)

md5 2818a4e269bd29e727a135cc15ad485c

Runnymede S-OFF protected HBOOT (ICS)

md5 b6d40a430016030003ed334277b48bf7

Runnymede S-OFF unprotected HBOOT (ICS)

md5 166c6d8dc6b49d32b1c45d4fd981f521

Runnymede ICS Recovery

md5 c90249bf454f08290facc36482ef9055


Support for Runnymede S-OFF HBOOTS is on IRC channel #unlimited on freenode. If you do not have an IRC client you can use the link below.