How to SIM-Unlock for HTC J, ISW13HT

This article is written how to rooting and sim unlock for ISW13HT, HTC J (Valentewx).
Sorry for poor my English, but I hope you will find it helpful.

This page is translated the following pages.

HTC J 最新OTAでのroot化&アンロック

HTC JでDocomo,SoftbankのSIMを読みこませる方法


●First Step – rooting your phone

Please download rootkit by @goroh_kun.
rootkit is here. 

We need the file named “f-10d.ab”.

After download it, let’s start rooting.

1. send the file to phone

adb restore f-10d.ab

After that, press “Restore my data” on your phone.
Password is empty.

2. Confirm rootkit is working correct

adb shell ls -l -d /data/data/

If rootkit works fine, got output as following.
drwxrwxrwx system system

3. Confirm more

adb shell ls -l /data/data/

Confirm there are 100 files named “file00” – “file99”.

4. Delete the files that made now once.

adb shell rm /data/data/*

5. Create “/data/local/prop” to get root

adb shell "while : ; do ln -s /data/local.prop /data/data/; done"

You see the output “link failed File exists” forever.
Then, you open a new console and excute the command.

adb restore f-10d.ab

After press “Restore my data”, close the console that outputing “link failed File exists…”.

adb shell ls -l /data/local.prop

-rw-r–r– system system 524288 1970-01-16 22:18 local.prop
It will be OK if displayed in this way.

6. Reboot the phone

adb reboot

After reboot, check the phone is rooted.

adb shell

If your phone is rooted, the console says # instead of $.
$ is not rooted.
# is rooted.

●Second Step – Unlock Bootloader

(thanks @fnoji)

adb shell
# dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4
# exit
adb pull /sdcard/mmcblk0p4 mmcblk0p4ORIG

Then, edit mmcblk0p4ORIG. (Before edit, backup it!!)
Please use the binary editor you like.

You will see “KDDI_801”.
Please rewritten with “111111”.

After that, save it.
Please name the file to “mmcblk0p4MOD”.

Then, write the file to your phone.

adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD
adb shell
# dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
# sync
# reboot bootloader

Your phone will reboot and go to fastboot mode.

fastboot getvar cid

cid: 111111

It will be OK if displayed in this way.

After that, go to HTCDev to unlock.

Select Your Device -> All Other Supported Models -> Begin Unlock Bootloader.

And advance according to directions.
Afret last step completed, you’ll get e-mail with file named “Unlock_code.bin”

Please save it, and go to fastboot mode, then unlock your phone.

adb reboot bootloader
fastboot flash unlocktoken Unlock_code.bin

If you select “Yes”, unlock bootloader.

May void your warranty and lost all data if you unlock bootloader!!

After that, flash ClockWorkMod Recovery.

CWM is here. (thanks @caplioz and @td2sk)

adb reboot bootloader
fastboot flash recovery valentewx-td2sk-121010.img

Then, find “su” binary anywhere and install it.

adb reboot recovery
adb push su /
adb shell
# mount /system
# cp /su /system/xbin/.
# chmod 6755 /system/xbin/su
# exit
adb reboot

After that, confirm your phone is rooted.

adb shell
$ su
# exit
$ exit

If you execute “su” and colsole says #, your phone is rooted!

●Last Step – SIM Unlock

Enter ClockworkMod Recovery.
After that, transfer “” and “radio.img(Hong Kong version)” to the phone. is here.

radio.img is here.

Exec the follow commands.

adb push radio.img /
adb push /
adb shell
# mkdir /hoge
# mount -t vfat -o loop /radio.img /hoge
# cd /hoge
# mount /data
# mkdir /data/local/tmp/radio
# cp -a /hoge/* /data/local/tmp/radio
# sh /
# chmod -R 755 /data/local/tmp/radio
# exit

boot image to use HK radio.

boot images are here.
(for 1.31.970.1, Sense4.0)
(for 2.05.970.3, Sense4.1)

Please contact me if you are using other ROMs.

fastboot boot BOOTIMG
or, fastboot flash boot BOOTIMG

If flash image, you must backup original boot image before flash!!

After boot, change network type.
Go to Play Store and download “Phone Info”(by SC@TAIWAN).
Open app, and Testing window is opened.
Tap Phone information, and set preferred network type to “WCDMA preferred”.

All done.
It is necessary to set up APN setting depending on the case.
If so, exec the command
adb shell am start -n
and setup APN.

If you want to back CDMA mode, just flash original boot image.

[`evernote` not found]

  1. Dear Sir:

    I used AU HTC J. SIM unlock before.
    Today I upgrade TW HTC J 3.0 3.04.709.1 android 4.1.1 Sense 4+
    but SIM Lock ,too.
    So ,can you help me.
    cook new boot.img for use TW Radio



  2. thanks !!
    I used c9jbWCDMA_test1.img and sim unlocked ^^

    but ,I have question wish u help.

    Why my radio still show old type:

    I need to do this again ?

    “adb push radio.img /
    # sh /
    # chmod -R 755 /data/local/tmp/radio

    • Allen
    • 2013年 1月 25日 2:33am

    sorry , I have use your new radio.img .
    and do again ,again ..more than 5 times.
    my radio still show old one

    I don’t know what happen.
    when bootload ,I see
    *** TAMPERED ***
    *** UNLOCKED ***
    aUG 6 2012,21:07:46

  3. Hi!

    I try again again ,but radio still old version
    my bootloader show like this …
    Do u think any problem about my ISW13HT ?
    thank you for your help !!

    *** TAMPERED ***
    *** UNLOCKED ***
    aUG 6 2012,21:07:46


      • tako0910
      • 2013年 1月 25日 3:24pm

      This radio-change method does NOT write radio partition practically.
      So HBOOT says that old version.

      But,see Settings-> About-> Software information-> More-> Baseband version
      This says the version of radio in fact by this radio-change method.

  4. Hi !

    I see Settings-> About-> Software information-> More-> Baseband version
    still old version radio “”

    but I see /fiware_radio/radiover.cfg show “SSD:”

      • tako0910
      • 2013年 1月 27日 11:41pm

      Hmm…I don’t know about this problem…
      Maybe it’s ok as is if you can Simfree.

  5. I want to ask about ISW13HT APK from AU.
    How can I install them for HTC J TW ROM ?

      • tako0910
      • 2013年 1月 27日 11:45pm

      1. adb pull hoge.apk & hoge.odex from /system/app
      2. deodex by “baksmali” and “smali”
      3. adb push (deodexed apk) to /system/app

      You need “baksmali” and “smali” to deodex apk.

      For more details about deodex, please try google it…

    • Allen
    • 2013年 1月 28日 12:48am

    Ok!many thanks for your help :)

    • Arthur
    • 2013年 2月 20日 2:09am

    Dear Sir,

    Thanks for your sharing this useful information first of all.
    Before I perform this sim unlock procedure, should I s-off my ISW13HT in advance.
    and where can I find the instruction as like your description, please advise.
    the other question is how can I use “f-10d.ab” this file? should I install Ubuntu system?
    so many question need your help.

    Thank you very much in advance.


    • 匿名
    • 2013年 2月 24日 10:18pm

    i already unlock htc isw13ht in philippines… it became htc j z321e

      • 匿名
      • 2015年 2月 13日 4:45am

      how to use that adb

    • frix
    • 2013年 2月 24日 10:20pm

    ive unlock htc isw13ht.,, it became htc j z321e

  6. Dear Mr. Tako0910,

    I would like to say thank you for your instruction first of all.
    Finally, I’ve unlock my sim lock and it is working very well in Taiwan.

    Appreciate your effort to share this useful information.

    Thanks agian and have a good day.


    • dung
    • 2013年 3月 16日 10:41am

    i already unlock htc isw13ht in vietnam

    • yar
    • 2013年 3月 16日 8:08pm

    I try follow the instruction . Now i can search all gsm operators but can’t register !
    Do you can help me ?

      • tako0910
      • 2013年 3月 16日 9:44pm

      I don’t have any ideas…

    • 2013年 4月 22日 6:23pm

    adb is what .pls help me

    • 2013年 4月 22日 11:38pm

    Hello brother,

    I’m from Myanmar and trouble unlocking HTC J ISW13HT even though following your steps.
    The problem is cannot go through 2nd step. I would be really appreciated if you could help me to unlock that phone or sharing the video file of unlocking that phone or sending me the detail instruction, step by step, including all necessary link/URL. Thanks in advance.

      • tako0910
      • 2013年 4月 22日 11:48pm

      Hmm…this website is for advanced users.

      Please study of “adb” and “root of Android”.
      Try google it!

      If continues while knowledge has been scarce, your phone will break down.

    • Dark
    • 2013年 4月 24日 11:43am

    Hi (^o^)

    Hello, have you been trying to unlock SIM for the Infobar A02 yet? I’m very interest in that fone. Too bad can’t find any kind of help about it anywhere, all I manage to find is a (unconfirmed) way to temproot it on 2chan

      • tako0910
      • 2013年 4月 25日 1:24am

      Hello :)
      INFOBAR A02 cannot unlock SIM now. Only can temproot now.
      That device is protected more than formar, so can’t unlock bootloader and permanent root.

      If we can bootloader unlock, it may be able to SIM unlock.
      But that method has not been discovered yet.

        • Dark
        • 2013年 4月 30日 12:33pm


        Thanks for your answer. Aaarrrr, guess I only can wait right now. Damn with all the protection KDDI put around their phones (facepalm) I have bunch of friends here dying to buy even the old generation keitai from KDDI, even Sony S003 will do (facepalm, again!)

          • unknown001
          • 2013年 6月 15日 12:55am

          Just a note: This seems to be changing; there is one seller on Yahoo Auctions offering an unlock service for the A02, supposedly confirmed by HTCsoku, and there are two sellers in China offering unlocked A02s. I’m thinking of getting one on an upcoming trip to China; I just hope it’s the real deal.

    • 2013年 4月 26日 12:00am

    Hi Bro,

    Now I understand about adb & sdk, I tried again as u said and finished step 1 : restore my data. (thadb restore f-10d.ab). After that, when I tried to step 2 : it appear as ” No such file or directory”. What should I do now ? Thank u so much for ur reply, bro. I don’t want to give up and I really want to success unlocking that ph. with ur help.

      • tako0910
      • 2013年 4月 26日 11:39am

      The file “f-10d.ab” must be in the same folder as “adb.exe”.

      Or specify an absolute path.

      ex) adb restore “C:\Users\hoge\Documents\f-10d.ab”

    • 2013年 4月 28日 4:18pm

    when i press enter>>>>> adb shell ls -l -d /data/data/>>> it appear as>>>>> /data/data/ : no such file & directory
    but when i press enter>>>>> adb shell ls -l -d /data/data/ >>>it appear as>>>>> drwxr-x–x system system
    and then when i typed ” adb shell ls -l /data/data/ ” (without “/a/”), it appear as>>>> opendir failed, Permission denied”
    what should i do now :(

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.



    C:\>cd android-sdk\platform-tools

    C:\android-sdk\platform-tools>adb restore f-10d.ab
    * daemon not running. starting it now on port 5037 *
    * daemon started successfully *
    Now unlock your device and confirm the restore operation.

    C:\android-sdk\platform-tools>adb shell ls -l -d /data/data/

    drwxr-x–x system system 2013-04-28 16:05

    C:\android-sdk\platform-tools>adb shell ls -l /data/data/
    opendir failed, Permission denied

    C:\android-sdk\platform-tools>adb shell ls -l /data/data/

    /data/data/ No such file or directory

    C:\android-sdk\platform-tools>adb shell ls -l /data/data/

      • tako0910
      • 2013年 4月 29日 1:34am

      Maybe your device is protected from this exploit.
      It causes by OTA update for example.

      According to this site(,
      this exploit is only for version 1.20.970.2 and 2.05.970.3 .

      Version 2.06.970.3 can also get root, but can’t unlock bootloader and sim unlock forever!

    • 2013年 4月 29日 11:48pm

    ok tako あなたに感謝 :)

      • tako0910
      • 2013年 4月 30日 1:05am

      You’re welcome!

    • aFIF
    • 2013年 5月 3日 12:28am

    Hi, What should I do at step 3.

    1. download “(for 2.05.970.3, Sense4.1)”
    2. Follow step 2 ?

  7. How to upgrade 1.31.970.1 to 2.05.970.3 thank you ,my htc j is 1.31.970.3

  8. Hi, is this CDMA only or does it work with GSM networks too?

      • tako0910
      • 2013年 5月 28日 10:25am

      This method can “CDMA only” or “GSM only”.

    • freund
    • 2013年 5月 30日 2:46am


    Could you make boot image for 2.06.970.4?

      • tako0910
      • 2013年 5月 30日 5:47pm

      Please give me official boot image of 2.06.970.4 .

        • freund
        • 2013年 5月 31日 1:00am

        Any idea how I can dump the boot image? Didn’t find relevant info on Google

    • freund
    • 2013年 5月 30日 4:19am


    I see 2.06.970.4 cannot be unlocked. Is it possible to use to RUU back to 2.05.970.3? only requires HBOOT 1.17.000 as stated on their page.

      • tako0910
      • 2013年 5月 30日 5:48pm

      We can’t downgrade the version unless S-OFF.

      If S-OFF, you can downgrade by using RUU image.

        • freund
        • 2013年 5月 31日 5:11am

        Found a way to downgrade! I’ll write a tutorial in the next few days :)

    • EvertH
    • 2013年 6月 2日 5:41am

    What did you change in the boot image? As in, what do I need to modify when compiling my own boot.img?

      • tako0910
      • 2013年 6月 7日 9:39pm

      Please diff original boot image and modified boot image.
      Just a few lines changed.(disable mount from emmc and symlink from extracted radio)

    • unknown001
    • 2013年 6月 15日 12:53am

    Question: Will Osaifu-Keitai still function after unlocking using this method? I travel to Japan often and would like to be able to use this function on an unlocked phone.

      • tako0910
      • 2013年 6月 15日 4:00pm

      I don’t know but maybe works…

    • Viper
    • 2013年 6月 15日 1:33am

    Hello Tako san,

    Thanks for the valuable information above. Fortunately, I unlock my AU HTC J per the provided crews. However, I realized the SMS feature has some problem there that I can receive the SMS but send SMS to someone else. Do you experience this? In addition, after I perform the new radio.img to unlock my AU HTC J, the device ID is still being ISW13HT, is there anything I missed?



      • tako0910
      • 2013年 6月 15日 4:17pm

      It’s my pleasure.

      SMS problem is known issue on some HTC devices (include AU HTC J).
      For example, we can’t send SMS by NTT DoCoMo.
      And we can’t fix yet.

      Perhaps this problem can fix by “SMSC Setting”.
      Try google it, please.
      (But can’t fix this method for NTT DoCoMo SMS issue.)

      Device ID issue can ignore if your device still UNLOCKed.

    • Viper
    • 2013年 6月 17日 6:25pm

    Hello Tako san,

    Hon do aligadou. It works, but the sent party shows ‘unknown format of SMS’. Any kindly advice? Thanks again.



    • Pettervl
    • 2013年 6月 26日 5:20am

    I do it ok but when I wipe all data, phone reset loop. My phone 2.05.970.3 hboot 1.17

    • Pettervl
    • 2013年 6月 26日 5:22am

    Use go sms pro then can send sms. But how to solve after unlock, wipe data then phone reset loop.

    • Pettervl
    • 2013年 6月 26日 6:10am

    Humh, after flash stock ruu, phone ok but can’t unlock bootloader again.
    Phone still cid 11111111 but can’t unlock bootloader as before.
    Hate this phone much.

      • tako0910
      • 2013年 6月 26日 9:55pm

      thank you info.

      Well, maybe you can unlock bootloader by using cid 22222222, not 11111111.

      Maybe SuperCID “111111” can’t unlock causes of KDDI and/or HTC.
      But, maybe can unlock by another CID (22222222, 33333333, … , 99999999).

    • Dark
    • 2013年 7月 14日 1:16pm

    Hi, it’s me again (^^)

    So HTCDev finally got Infobar A02 S-OFF. May I ask if you have any plan on unlocking that phone? Much appreciate it

      • tako0910
      • 2013年 7月 15日 12:20am

      Hello :)

      I don’t have INFOBAR A02…haha (It’s difficult to find A02 at a shop), so I don’t know about that device.

        • Dark
        • 2013年 7月 15日 10:19am


        Damn (>-<) That is something I have to agree with you. Even looking from Yahoo Auction to, finding Infobar A02 is indeed a pain in the ass.

    • Dark
    • 2013年 7月 21日 12:58pm

    Hi (^O^) Wait wait wait, I’m not stalking you, not stalking you, okay?

    So I found this guy, who claim he can unlock infobar a02 by flashing the radio from HTC Droid DNA (Verizon’s version of HTL21) (email:

    Do you think you can contact him & post a full description how-to here? Seem like he want to make money from it —> I don’t like it, it’s not fair for him, I know, I just…..let’s just say I’m broke (^0^) I do want to contact him myself, but since Japanese is…er….not good with English, and I’m a big rookie in Japanese —> So, please? (:puppy eyes:)

      • tako0910
      • 2013年 7月 21日 11:09pm

      Hello. haha…I know^^

      Oh, it’s really..? (Can we sim-unlock for A02 by flashing radio of Droid DNA?)
      If you think so, why don’t you try it ;)

      1. S-OFF your A02 by “revone”.
      (See also:

      2. Flash radio.img.
      maybe you can flash in CWM recovery by ‘busybox dd if=[radio.img] of=[/dev/block/mmcblk0pXX]’

      I have nothing to say because I don’t have INFOBAR A02…

    • Yaki
    • 2013年 8月 19日 7:40am

    Hello Tako-san,

    Thank you very much for providing this nice tutorial.

    I am having an issue at the very first step.

    adb restore f-10d.ab prints some text in the cmd but nothing appear on the phone. I used adb to test some feature (push/pull, etc…) and it worked well.

    Do you have any idea concerning this issue?

    Thanks a lot!

      • Yaki
      • 2013年 8月 19日 7:49am

      Here is what “adb restore f-10d.ab” prints:

      Android Debug Bridge version 1.0.26

      -d – directs command to the only connected USB devic
      returns an error if more than one USB device is
      -e – directs command to the only running emulator.
      returns an error if more than one emulator is r
      -s – directs command to the USB device or emulator w
      the given serial number. Overrides ANDROID_SERI
      environment variable.
      -p – simple product name like ‘sooner’, or
      a relative/absolute path to a product
      out directory like ‘out/target/product/sooner’.

      If -p is not specified, the ANDROID_PRODUCT_OUT

      environment variable is used, which must
      be an absolute path.
      devices – list all connected devices
      connect [:] – connect to a device via TCP/IP
      Port 5555 is used by default if no port number
      is specified.
      disconnect [[:]] – disconnect from a TCP/IP device.
      Port 5555 is used by default if no port number
      is specified.
      Using this ocmmand with no additional arguments

      will disconnect from all connected TCP/IP devic

      device commands:
      adb push – copy file/dir to device
      adb pull [] – copy file/dir from device
      adb sync [ ] – copy host->device only if changed
      (-l means list but don’t copy)
      (see ‘adb help all’)
      adb shell – run remote shell interactively
      adb shell – run remote shell command
      adb emu – run emulator console command
      adb logcat [ ] – View device log
      adb forward – forward socket connections
      forward specs are one of:
      jdwp: (remote only)
      adb jdwp – list PIDs of processes hosting a JDWP transport

      adb install [-l] [-r] [-s] – push this package file to the device and i
      nstall it
      (‘-l’ means forward-lock the app)
      (‘-r’ means reinstall the app, keeping its data
      (‘-s’ means install on SD card instead of inter
      nal storage)
      adb uninstall [-k] – remove this app package from the device
      (‘-k’ means keep the data and cache directories
      adb bugreport – return all information from the device
      that should be included in a bug report.

      adb help – show this help message
      adb version – show version num

      (no option) – don’t touch the data partition
      -w – wipe the data partition
      -d – flash the data partition

      adb wait-for-device – block until device is online
      adb start-server – ensure that there is a server running
      adb kill-server – kill the server if it is running
      adb get-state – prints: offline | bootloader | device
      adb get-serialno – prints:
      adb status-window – continuously print device status for a specifie
      d device
      adb remount – remounts the /system partition on the device re
      adb reboot [bootloader|recovery] – reboots the device, optionally into the boo
      tloader or recovery program
      adb reboot-bootloader – reboots the device into the bootloader
      adb root – restarts the adbd daemon with root permissions
      adb usb – restarts the adbd daemon listening on USB
      adb tcpip – restarts the adbd daemon listening on TCP on th
      e specified port
      adb ppp [parameters] – Run PPP over USB.
      Note: you should not automatically start a PPP connection.
      refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
      [parameters] – Eg. defaultroute debug dump local notty usepeerdns

      adb sync notes: adb sync [ ]
      can be interpreted in several ways:

      – If is not specified, both /system and /data partitions will be u

      – If it is “system” or “data”, only the corresponding partition
      is updated.

      environmental variables:
      ADB_TRACE – Print debug information. A comma separated list
      of the following values
      1 or all, adb, sockets, packets, rwx, usb, sync
      , sysdeps, transport, jdwp
      ANDROID_SERIAL – The serial number to connect to. -s takes prior
      ity over this if given.
      ANDROID_LOG_TAGS – When used with the logcat option, only these de
      bug tags are printed.

    • Yaki
    • 2013年 8月 19日 9:27am

    Hey, it is me again :)

    It seems my problem came from the fact that I had an issue when I first downloaded the platform tools! I could use adb restore f-10d.ab correctly this time.

    Still, I have a new issue… :(
    It works perfectly fine untill I reboot at the end of the rooting step. My phone is really slow, there is no app and the whole menu is gone (except the notification bar). Still I get the # after adb shell but root checker says it is not rooted!

    If I go on step two, I cannot actually replace the original system file by the modified one, which means I am not rooted…

    Do you understand what is going on?

    Thank so much for your help and sorry for spamming this topic…

      • tako0910
      • 2013年 8月 19日 4:31pm

      Yes, reboot after got root , and the phone become very slow but it’s OK.
      You can continue steps only shell command by adb.

      In step two, do you see # in adb shell?
      If $, you didn’t get root.

      If #, you got root and can continue steps.

      You can’t replace modified file in step two?
      Please show me all shell output messages.

    • Yaki
    • 2013年 8月 19日 7:12pm

    Hi Tako-san,

    Thank you very much for your prompt reply!

    I see # in adb shell, but when I continue to step 2,here are all the output messages of step 2:

    Microsoft Windows [version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. Tous droits réservés.

    C:\Windows\system32>cd C:\platform-tools

    C:\platform-tools>adb devices
    List of devices attached
    SHTBE094807 device

    C:\platform-tools>adb shell
    root@android:/ # dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4
    dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4
    2+0 records in
    2+0 records out
    1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
    root@android:/ # exit

    C:\platform-tools>adb pull /sdcard/mmcblk0p4 mmcblk0p4ORIG
    142 KB/s (1024 bytes in 0.007s)

    C:\platform-tools>adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD
    55 KB/s (1024 bytes in 0.018s)

    C:\platform-tools>adb shell
    root@android:/ # dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
    dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
    2+0 records in
    2+0 records out
    1024 bytes transferred in 0.001 secs (1024000 bytes/sec)
    root@android:/ # sync
    root@android:/ # reboot bootloader
    reboot bootloader

    C:\platform-tools>fastboot getvar cid
    cid: KDDI_801
    finished. total time: 0.002s

    As you can see, the cid is still KDDI-801. Still, my mmcblk0p4MOD file contains “11111111” instead of “KDDI_801”. Even if I didn’t get any error message, mmcblk0p4 was not replace by mmcblk0p4MOD correctly.

    Thank you for all your support!

      • tako0910
      • 2013年 8月 19日 9:09pm

      I heard that normal dd can’t write correctly, but busybox version of that may write.

      So please download busybox and try,

      > adb push /path/to/busybox /data/local/tmp/.
      > adb shell
      # chmod 755 /data/local/tmp/busybox
      # /data/local/tmp/busybox dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4

    • Yaki
    • 2013年 8月 20日 1:27am

    Hi Tako-san,

    Thank you for your reply!

    Unfortunately, it didn’t work. Everything go smoothly and the cid is “11111111” until I reboot and it becomes “KDDI_801” again!

    Here is the output:

    C:\platform-tools>adb push busybox /data/local/tmp/
    3745 KB/s (1745016 bytes in 0.455s)

    C:\platform-tools>adb shell
    root@android:/ # chmod 755 /data/local/tmp/busybox
    chmod 755 /data/local/tmp/busybox
    root@android:/ # /data/local/tmp/busybox dd if=/sdcard/mmcblk0p4MOD of=/dev/bloc
    sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4 fastboot getvar cid
    cid: KDDI_801
    finished. total time: 0.003s

    I wonder why it worked for so many people but not for me. Did HTC upgraded the HBOOT to cut writing permission and to prevent people from putting the phone in S-OFF mode?

    Here are the information about my bootloader:

    Aug 6 2012,21:07:46

    Could you please tell me if you see anything strange?

    Thank you so much for all the answers!

      • tako0910
      • 2013年 8月 20日 1:56am

      >>I wonder why it worked for so many people but not for me. Did HTC upgraded the HBOOT to cut writing permission and to prevent people from putting the phone in S-OFF mode?

      Maybe yes… :(
      Please try another S-OFF method.

      Maybe can use “FacePalm (soffbin3)” method (try google it).
      (But need SuperCID? I don’t know…)

      If I get more info, I’ll write…

        • Yaki
        • 2013年 8月 20日 2:26am

        Thank you for all the help!

        I found a thread on this issue on xda for HTC One S

        There is a write protection known for months, but noone have been able to break it.

        Is SuperCID really necessary to sim unlock the phone?

        Thank you again!

          • tako0910
          • 2013年 8月 20日 2:40am

          To do sim-unlock, you need to

          1. rooted
          2. S-OFF or/and Bootloader Unlock

          If you can S-OFF or/and bootloader unlock, can apply this blog article.
          (write CWM in recovery, and “Last Step – SIM Unlock” …)

            • Yaki
            • 2013年 8月 20日 3:28am

            Thanks Tako-san!

            So, by and/or, you mean that S-OFF might not be necessary to sim unlock the phone?

            It seems that you need to have SuperCID to use facepalm method :(

            • Yaki
            • 2013年 8月 21日 1:51am

            Hi Tako-san,

            Just want to say that I posted a thread on this issue on xda.


            Thank you for everything!

    • Yaki
    • 2013年 8月 22日 4:52am

    Hi Tako-san!

    I could finally S-OFF the phone using this method:

    I did everything until the end, so I got S-OFF, unlocked bootloader and root!
    I also did the simlock step but so far this is not working.

    I put my GSM european sim card in it, it doesn’t recognize it (in the notification bar there is a sim card drawing and a !). I cannot find any network!

    I was almost there ! :( Do you know what’s happening?

    Thanks for everything Tako!

      • tako0910
      • 2013年 8月 22日 11:34pm

      You could S-OFF! That’s nice :)

      I don’t know why can’t connect network…
      Your network setting is set to “WCDMA preferred” correctly?

      If so, please choose another type from a list.
      (e.g. GSM auto, GSM/WCDMA,…)

        • Yaki
        • 2013年 8月 23日 1:23am

        I tried so many combination of network type and it is not working…

        Actually when I go to the software info I see that I still have the old radio version! I tried to flash it again and again but the version doesn’t change! I guess that’s why I don’t have sim free.

        Could you tell me if what I did is correct:
        – I flashed CMW recovery (it worked)
        – I get su (working too)
        – I put the radio.img file and file in my adb folder
        – I go in recovery mode and enter CMW
        – I flash radio by following the commands:

        adb push radio.img /
        adb push /
        adb shell
        # mkdir /hoge
        # mount -t vfat -o loop /radio.img /hoge
        # cd /hoge
        # mount /data
        # mkdir /data/local/tmp/radio
        # cp -a /hoge/* /data/local/tmp/radio
        # sh /
        # chmod -R 755 /data/local/tmp/radio
        # exit

        – I reboot to the bootloader and flash the boot.img file (sense 4.1 for me)
        – I used Phoneinfo to try all the network types

        Is something wrong with this? I really thought that if I could be fully rooted it would be easy to get sim unlock…

        Do you think I can directly download a taiwan RUU for my phone and use it? like this one?

        Anyway, thank you so much for all your reply and the time you spend helping me.

          • tako0910
          • 2013年 8月 23日 1:55am

          You’re welcome :)

          Your method is all OK.
          This sim-free method don’t modify REAL radio partition, so you see REAL radio version.
          My custom boot.img reads radio files from /data/local/tmp/radio(you made!).

          taiwan RUU may apply to your phone.(But maybe have to modity android-info.txt,etc)
          If so, your REAL radio partition is written by taiwan radio.


          Or, just rewrite only REAL radio partition by taiwan radio.img.
          Please download this.

          Then, rename downloaded file.
          “PK07IMG(2).zip” -> “”

          And go fastboot-mode

          adb reboot bootloader

          If your phone is now fastboot mode,

          fastboot oem rebootRUU

          And if you see hTC logo,

          fastboot flash zip

          If you see “finished” in command prompt,

          fastboot reboot-bootloader

          All done.
          Check your radio version, and real radio partition is now written by taiwan version(sim-free version).

    • Yaki
    • 2013年 8月 23日 7:08pm

    Dear Tako-san,

    I am SIM free! I used Taiwan RUU and it worked!

    Thank you so much for all your help, it would NEVER have been possible without your support and work!

    That would be my pleasure to donate a little to support your activities. Is it possible?

    I am now looking for a cool ROM to install on my HTC J z321e :D. If you have any recommendation, don’t hesistate to tell me.

    Also, if you want, I can post step by step what I did from the beginning to sim unlock my phone (2.06.970.4, HBOOT 1.17.0000) here to make it easier for people in my situation!

    Have a good day!

      • tako0910
      • 2013年 8月 23日 10:44pm

      You’re welcome,and thank you for all replies with detailed information.

      I’ll plan to place the donation button to bottom right of my blog sometime,
      so please donate if you liked my contents ;)

      My HTC J has taiwanROM-based ROM and I add some Japanese-customize.
      So,it’s not so much different from your HTC J.
      There are some other ROM, for example,CyanogenMod 10.

      I heard that some Chinese Android forum has another customROM for HTC J.
      Please try googling it!

      Thank you about posting article, but you don’t have to do it :)
      I’ll add to article when I have time.

      I was able to increase knowledge, too.
      Let’s enjoy HTC!

    • tla
    • 2013年 9月 25日 2:01am

    Can i sim unlock htc j one

      • tako0910
      • 2013年 9月 26日 6:24pm

      htcsoku says it’ll be public soon that how to sim-unlock for ISW13HT, HTL21, HTX21, HTL22 by his website.

    • Daniel
    • 2013年 12月 27日 8:22am

    Hi, I have Htc j z321e with 2.07.970.3 software versión. Can I do thr Sim unlock .

    • Daniel
    • 2013年 12月 27日 10:44pm

    tako0910 :
    htcsoku says it’ll be public soon that how to sim-unlock for ISW13HT, HTL21, HTX21, HTL22 by his website.

    Hi, can I do sim unlock with 2.07.970.7 software version?

  9. I used to be suggested this website by way of my cousin.

    I’m no longer positive whether or not this publish is written
    by means of him as nobody else recognise such specified about my difficulty.
    You’re amazing! Thanks!

    • Roger
    • 2014年 3月 3日 3:11pm

    Hello, I tried to sim-unlock step by step as you said, but cid shows up still kddi_801. so i read htcsoku’s guide. and it was going well until i flash so i tried again your guide. suddenly CID changed… i think that’s because of installed RUU. and then i installed cwm, but when i flash sense41_wcdma.img phone restart itself over and over again as soon as its turn on… what should i do? anyway. i also saw a custom rom on htcsoku’s page. and flashed it by cwm. still no network :(

      • tako0910
      • 2014年 3月 3日 6:07pm

      Do you flash “correct” boot image for ROM version?
      (I release 2 type: (for 2.05.970.3, Sense4.1) and (for 1.31.970.1, Sense4.0).)

    • Roger
    • 2014年 3月 4日 11:14pm

    Yes, i flashed sense 4.1.. :(

    • Roger
    • 2014年 3月 5日 11:58am

    I installed this rom.. but still no sim-free :(. Tried to go back to 2.05.970.3 but RUU couldnt install on this device :(

  10. help i have htc j how do i sim lock i am newbie noob

  11. Hi,

    I have an HTC J ISW13HT with software version 2.06.970.4 (Android 4.0.4 – HTC Sense 4.1) – (S-ON) .

    Can you please tell me how to do sim-unlock? I’ve tried many guidelines on your website but now luck. People said that we have to downgrade to 2.05.970.3 in order to do it. But I don’t know how to do.

    I’m looking forward to hearing from you soon.

    Thanks for your help!


    • Kryptinine
    • 2014年 5月 2日 1:04am


    HTC J ISW13HT (Valentewx) phone locked to AU (Japan) opened up on

    Australia’s cell network using a range of different solutions.
    The phone was initially: S-ON, HBOOT 1.17.0000 and Software Version

    2.07.970.7. In the end, this is the path I followed:

    1) Installed Linux Ubuntu 32bit Operating Software in a separate

    unformatted partition using a LiveUSB installer (alongside Windows 64bit).

    –Must be 32bit for Dirty Racun Software later–
    Installed ADT Bundle for Linux 32bit, installed ADB and Fastboot through

    the Linux terminal
    Installed HTC Sync Manager on Windows for phone driver files
    Connected my phone into a USB 2.0 port

    2) Rooted phone using Taco’s First Step on this forum.
    –I used Linux Ubuntu with the ADT bundle (ADB and Fastboot)–

    3) Edited the phone file ‘mmcblk0p23’ to display Software Version

    2.05.970.3 as explained in the website:

    (Steps 2 – 3)
    –Hex Edit (Windows) and ADB (Ubuntu)–

    4) Downgraded Software Version by flashing the RUU using this RUU

    installing exe:
    This is step 4 in the previous websites article written in Japanese

    5) Obtained S-OFF by following all the steps of the Unlimited DirtyRacun

    website, including reflashing the RUU with the stock ‘RUU 2.05.970.3 –

    HBOOT 1.17’ file they provided and re-using Taco’s root tactic part way

    through the process when they request you do a Temproot.
    –Make sure you look at all the DirtyRacun Prerequisites very closely and

    dont skip a word, 32 bit Linux Ubuntu OS installation required–

    6) Unlocked the Bootloader and installed CWM as explained in this thread by

    Taco (Second Step).
    –I got my ‘Su Binary’ from–

    7) Changed Radio Image to Taiwanese version by using the radio image

    supplied by Tako in this link:

    and following the steps he provided in a comment above:
    Rename file “PK07IMG(2).zip” -> “”
    > adb reboot bootloader
    > fastboot oem rebootRUU
    > fastboot flash zip
    > fastboot reboot-bootloader
    –I do not recommend following points 1-3 in Tacos Final Step as it put my

    phone into a unbootable state that was hard to recover from–

    8) Followed point 4 in Tacos Final Step downloading the “Phone Info” App

    and changing the signal from CDMA to WCDMA Preferred (3G)
    –it’s a bit deceiving because it doesn’t look like you can change it until

    you tap CDMA and then a menu appears–

    9) Enabled Mobile Data by following point 5 in Taco’s Final Step and then

    pushing “settings” on top right, “Add APN”. Inputting the settings of my

    carrier in Australia which was simply a name and a APN. Then press the

    “…” on top right “save”

    After 4 dedicated days of downloading different bits of software,

    researching and hacking the hell out of that phone it’s finally completely

    open to use. Went through many emotional moments as frustratingly many things didn’t work. Cracking through AU’s security takes time and patience. What you need most of is perseverance. Thanks Taco for all the help info and help! =P

    • Neenish Tart
    • 2014年 5月 16日 10:19pm

    どうも ありがとう ごさいます Thanks Tako-sama – I successfully used your method to gain root on my pre-sim-unlocked HTC J z321e from here in Australia too.

    I couldn’t get your S-OFF method to work because I couldn’t edit the CID, but I managed to get S-OFF with Rumrunner: I hope this helps anyone who hasn’t yet found a successful method.

    I would love to try your ROM but I think I need to downgrade my HBOOT first? It’s currently 2.08.0000

    • Caustic
    • 2014年 8月 23日 11:14am

    Do you know if this method will work with “Software number 2.07.970.7”?

    I have been able to root, but not unlock my bootloader. Every time I try to do that step, my CID never changes from KDDI. I’ve done it several times, but it never stays at 111111.

    • Phone
    • 2014年 8月 25日 5:58pm

    It says unable to open file f-10d.ab

    • Sanam Pudasaini
    • 2014年 8月 30日 4:37pm

    Dear sir,
    I have brought HTC htl21 from Japan (AU,KDDI). AS I insert sim (from Nepal) no unlock codes are asked. It just show no service. As i am new to android, I know nothing. Is this phone already unlocked?? Can i unlock without rooting? Information:
    android version: 4.1.1
    HTC sense version: 4+
    Software number: 1.39.970.3
    baseband version:
    kernel version: 3.4.10-g0d3ac9b root@abm030 #1

    Please help me from very beginning?

    • san gyi
    • 2014年 10月 15日 8:57pm

    please let me know more detail in sim unlock.
    i have the following problem.
    how can i fix it.
    mkdir failed for /hoge, Read-only file system

    • 匿名
    • 2014年 10月 19日 4:48am

    after editing the binary file. my phone reboot and show qhsusb_dload on pc. what do i do?

    • hi
    • 2014年 12月 2日 4:00pm

    i have htc j isw13ht i can undestand the 1st and the whole step pls help me

    • hi
    • 2014年 12月 2日 4:04pm

    pls help me my isw13ht is japan locked im from the philippines can u add me on facebook pls Julius Rosal Guinto

    • DS
    • 2014年 12月 10日 5:01am

    Baseband android 4.2.2 and 2.21.970.2 firmware and Jedi network lock.
    HTC Sence version 5.0 plz share for unlock tips

    • hi
    • 2015年 1月 21日 6:22pm

    Julius Rosal Guinto be patient and you will be able to unlock it. I am from the philippines and I was able to unlock it but I used ubuntu and some adb commands indicated above.

      • john
      • 2015年 6月 30日 2:37am

      hi :
      Julius Rosal Guinto be patient and you will be able to unlock it. I am from the philippines and I was able to unlock it but I used ubuntu and some adb commands indicated above.

      sir plss kindly help me i cant get through step 1 f-10d.ab. i can manage to press “restore my data” but after i input this adb shell ls -l -d /data/data/
      it says “no files found”. pls help me i already spend 2 yrs to get my htl22 sim unlock but still no luck.

      • john
      • 2015年 6月 30日 9:04pm

      sir plss kindly help me i cant get through step 1 f-10d.ab. i can manage to press “restore my data” but after i input this adb shell ls -l -d /data/data/
      it says “no files found”. pls help me i already spend 2 yrs to get my htl22 sim unlock but still no luck.

  1. 2013年 1月 13日
  2. 2013年 11月 1日
    トラックバック先 :htc valente wx – GSM-Forum