hey,
i did some research about S-OFF and i couldn't find one good answer here or when i ran a query on Google.
my HTC Legend is set as S-OFF, never noticed it before, i think i got it this way.
is this really S-OFF device?
can i flash ClockworkMod recovery and replace the stock one?
these are the details on my Bootloader screen (if it helps):
LEGEND UNKNOWN SHIP S-OFF
HBOOT-0.43.0001
MICROP-0816
TOUCH PANEL_SYN07_0105
RADIO-7.13.35.13
i'm using CyanogenMod-6.1.0 ROM
my CID is SuperCID 11111111
Well, you can try that via fastboot or if that doesn't work you can try via recovery using adb (using flash_image utility). You can not brick your phone as long as you don't try to overwrite HBOOT and experience power failure during that procedure.
Just search the forum for "flashing recovery via fastboot" or "flashing recovery via recovery".
great, just wanted to make sure i won't brick it in the process.
thanx BlaY0!
well, apparently it's not a real S-OFF like AlphaRev's cause it gave me an error trying to write the recovery, so guess i'll have to use theirs.
thanx again!
Difference between "Eng S-off" and "Ship S-off"
AlphaRev's S-off will show "PVT Eng S-off".
"PVT Ship S-off" or "Unkonwn Ship S-off" is usually an s-off by the officail HTC means, a.k.a by using a HTC Factory Smartcard (commonly refered as a "whitecard" or "javacard"). This is commonly refered as "Radio S-off" in the XDA. This kind of s-off usually comes along with a super cid(11111111). It has no limitaion any more, but it's HBOOT does not have full featured support for some fastboot commands which means it can not flash image in the fastboot mode, but it can be done by the means of LEGEIMG.zip or "fastboot oem rebootRUU" and "fastboot flash zip LEGEIMG.zip".
"Eng S-off" will lose s-off after flashing an RUU, but "Ship S-off" does not, it is a permanat s-off.
Related
Hi,
My Evo 3d GSM device was S-OFF by the Revolutionary method.
All work fine.
But for garanty purpose, l've already restored boot_signed and system.img from stock rom.zip
Can i restore original recovery with:
fastoot flash recovery recovery_signed.img ?
And Restore stock hboot with:
fastoot flash hboot hboot_SHR_U_1.53.0007_20120522_signedbyaa.nb0 ?
Thank before,
If you really want to go back to stock, run the ruu for your region/carrier. It will leave you s-off, but everything else stock. You could go 100 percent stock by going back to s-on first. EDIT: After! See ramjet's post below.
Imagika FTW... with Tapatalk 2
Running the RUU should restore the default recovery and leave you s-off if it is going in for warranty work don't forget you want to be s-on (fastboot oem lock) after running the RUU.
coal686 said:
If you really want to go back to stock, run the ruu for your region/carrier. It will leave you s-off, but everything else stock. You could go 100 percent stock by going back to s-on first.
Click to expand...
Click to collapse
ItzCrooK2UxD said:
Running the RUU should restore the default recovery and leave you s-off if it is going in for warranty work don't forget you want to be s-on (fastboot oem lock) after running the RUU.
Click to expand...
Click to collapse
That's the command to relock after doing the HTC unlock. The command to set S-ON is "fastboot oem writesecureflag 3" and should only be run after the RUU is flashed and the stock bootloader is restored. If S-ON is set while a modified bootloader such as ENG, Revolutionary, or Juopunutbear is installed it will brick the phone.
ramjet73
ramjet73 said:
That's the command to relock after doing the HTC unlock. The command to set S-ON is "fastboot oem writesecureflag 3" and should only be run after the RUU is flashed and the stock bootloader is restored. If S-ON is set while a modified bootloader such as ENG, Revolutionary, or Juopunutbear is installed it will brick the phone.
ramjet73
Click to expand...
Click to collapse
So ramjet: if s-on, you lock then run ruu. But if s-off, you run ruu then lock if you wish. Is that right? I know it's a different kind of lock, but i didn't realize order mattered going s-off to s-on.
Imagika FTW... with Tapatalk 2
coal686 said:
So ramjet: if s-on, you lock then run ruu. But if s-off, you run ruu then lock if you wish. Is that right? I know it's a different kind of lock, but i didn't realize order mattered.
Click to expand...
Click to collapse
Yes, those are separate S-OFF's. The bootloader unlock (hboot S-OFF) is different from the radio S-OFF. This post from the MeanROM ICS thread has an explanation by Unknownforce, the developer behind the the hboot 1.4 downgrade method for radio S-OFF.
The "fastboot oem lock" command will undo the bootloader S-OFF, which is required to run the RUU.exe for users that are radio S-ON. Users that are radio S-OFF can run the RUU.exe without any special considerations.
Once the RUU.exe is run and the stock bootloader is installed, the phone will be bootloader S-ON regardless of the radio S-OFF status. To run fastboot commands like "flash" and "erase" the stock bootloader needs to be unlocked by the htcdev method or a custom bootloader modified to support those commands needs to be flashed, which requires radio S-OFF.
After installing a custom bootloader, setting radio S-ON via the "fastboot oem writesecureflag 3" bricks the phone because the bootloader is not signed by HTC and that is not allowed with radio S-ON. Therefore a stock bootloader needs to be reinstalled before setting radio S-ON and the easiest way to do that is flash an RUU.exe.
Hope that makes sense.
ramjet73
Makes perfect sense. Thanks boss. Learn something new everyday. :thumbup:
Imagika FTW... with Tapatalk 2
Thank-you very much for all your post, and a special thank to ramjet73.
It's clear now, but I will try tomorow.
result
Hello,
After all your explanations, I was reassured to install "RUU_SHOOTER_U_ICS_35_S_HTC_Europe_3.28.401.1_Radio_11.77.3504.00U_11.25.3504.06_M_release_262714_signed.exe"
Unfortunately it did not work: probably due to the absence of CID (HTC__203) of the revolutionary HBOOT.
So I took the rom.zip file in the% temp% directory and I renamed PG86IMG.zip. I pushed on my sdcard.
A reboot in the bootloader and the EVO 3D has successfully installed the ROM with firmware radio, recovery, system ... in short, everything
Now my HBOOT is 1.53.0007 HTC, it does not show revolutionary, but it is unlocked and S-OFF
Now I think it is acceptable to send like that. What do you think?
In fact I've not said what the problem was my phone: After installing a ROM that had the good idea to turn xLOUD (I think that's it) it has blown me the speaker (communication only)
Thank you again for your help
The latest changes
fxjumper said:
Now my HBOOT is 1.53.0007 HTC, it does not show revolutionary, but it is unlocked and S-OFF
Now I think it is acceptable to send like that. What do you think?
Thank you again for your help
Click to expand...
Click to collapse
Ok, i dit it !
Code:
fastboot oem lock
relocked my phone
and
Code:
fastboot oem writesecureflag 3
put my phone S-ON ! (radio)
Everything was fine in the end? I'm in the exact same situation and I'm installing PG86IMG.zip as we speak. Did HTC see anything wrong with your phone?
Hi Everyone. Now I'm on stock hboot 1.53.0007 S-ON and I'd like to do S-OFF. I understand that i should unlock via HTC Dev, then root and after that S-OFF. But my question is how does the bootloader looks after S-OFF via JuopunutBear? Does it make LOCKED and S-OFF? If not what should I do (if it's possible) to go back for a locked bootloader (not relocked)? And if JuopunutBear makes bootloader LOCKED i should be able to flash RUU, than use fastboot oem writesecure flag 3 to make S-ON and that's all? Cheers
c000ler said:
Hi Everyone. Now I'm on stock hboot 1.53.0007 S-ON and I'd like to do S-OFF. I understand that i should unlock via HTC Dev, then root and after that S-OFF. But my question is how does the bootloader looks after S-OFF via JuopunutBear? Does it make LOCKED and S-OFF? If not what should I do (if it's possible) to go back for a locked bootloader (not relocked)? And if JuopunutBear makes bootloader LOCKED i should be able to flash RUU, than use fastboot oem writesecure flag 3 to make S-ON and that's all? Cheers
Click to expand...
Click to collapse
You are most correct sir. After you perform the wire trick the end result is a "locked" bootloader with s-off. With s-off you can flash any version of your carrier and regions ruu. Definetely right after you flash ruu you would fastboot and use that command to get back on s-on. I hope I answered your questions. Please don't hesitate to ask if you need more help. Peace.
Please hit the thank you button if I helped you in anyway.
One more thing. When it comes to the end of S-OFF via JuopunutBear there is a question: Do you want to install juopunutbear modified hboot? What will happen when I'm going to choose No? I will be on stock locked hboot with S-OFF? What pros are with Juopunutbear modified hboot? And I understand that if I want to get rid of Juopunutbear hboot I must flash RUU? Cheers
With s-off you can flash any hboot you desire by renaming the file PG86IMG.zip, place it on root of sd, reboot bootloader.
Jbear hboots accept more adb commands than stock.
sudo passwd root
Hi,
Device: Flyer Wifi 16gb
HBOOT: 6.11.1111
Revolutionary S-OFF
No Root (apparently by Root Checker Basic)
3.2.1 RUU
i followed this guide:
http://forum.xda-developers.com/showpost.php?p=19339909&postcount=1
to regain S-ON and standard recovery. Unfortunately it didnt work, I installed the RUU, it boots and works fine but if I send the devices to bootloader via ADB it lands back in Revolutionary. The guide was completed without errors.
So I am currently on RUU but with S-OFF and Revolutionary and I would like to get S-ON and standard recovery.
I found several other guides, but I cant see what puts them above the mentioned one and therefore I prefer to ask...
Thank you very much in advance for any help,
P32r
More
For example this:
http://forum.xda-developers.com/showthread.php?t=1257909
just ends in that:
http://forum.xda-developers.com/showpost.php?p=16147471&postcount=77
and that holds for everything I found.
Somebody said I could just use fastboot and send "fastboot oem lock" for the lock and RUU afterwards. But am I right that HBOOT is not replaced by RUU at all? Do I have to downgrade first?
p32r said:
For example this:
http://forum.xda-developers.com/showthread.php?t=1257909
just ends in that:
http://forum.xda-developers.com/showpost.php?p=16147471&postcount=77
and that holds for everything I found.
Somebody said I could just use fastboot and send "fastboot oem lock" for the lock and RUU afterwards. But am I right that HBOOT is not replaced by RUU at all? Do I have to downgrade first?
Click to expand...
Click to collapse
the RUU flash will not write over a S Off Hboot. the procedure you listed in the OP is the only one I know of that will do what you want. Are you sure that when you:
fastboot flash hboot flyer_downgrader.nb0
it was successful?
pic
Thank you for your help!
I attached the output of fastboot and I actually dont think that it flashes correctly but all I saw is "OKAY" and "finished"...
Is the screen supposed to show anything during this flash? Because it stays just the way it is and shows no change in HBOOT or any part of the fastboot screen.
After rebooting it says "HBOOT-6.10.1005" but revolutionary still.
Great Success!
Got it! Works with RUU
RUU_Flyer_HTC_WWE_Wifi_1.36.1114.32_Radio_20.3501.30.089BU_3809.05.04.10_M_release_191235_signed
and NOT with the one I used. With this RUU I did the exact same procedure and succeeded. Now on stock recovery, S-ON and 1.10.0000!
Thank you for the guide, it really does work
[Q] Evo 3D that hates me!!! ROOT s-OFF and unlock bootloader cant select yes
Hi all, im a newbie to android rooting etc, so please be patient if I dont understand... XD
I will try to give a backround with a very detailed discription for those who might have the same problem, a similar problem or for those trying to help...
so I bought this beast in Feb with stock software on: this was my 1st root, s-off attempt :
http://forum.xda-developers.com/showthread.php?t=2130585
1st attempt quote from post
Hi there,
Developers, gonna be developers and android noobs
I got a small issue with mu EVO 3d GSM...
Firstly Id like to apologize if this has been asked...
Problem: I need to get past BOOTLOADER BLOCK !!!
Before you carry on reading -
Bought this phone online, from China, Original HTC!!! but with 1 or 2 chinese apps installed, Android 2.3.4...
This was standard when I first entered bootloader (out of the box)
***LOCKED***
SHOOTER_U PVT SHIP S-OFF RH
HBOOT-1.49.0012
RADIO-10.13.9020.08_2M
eMMC-boot
What is suprising is it needed to say Locked and s-on...
So I wanted to root and s-off...
Tried Revolutionary... Everything ran well, after 2nd reboot into bootloader, error - Communications between phone and PC has been interrupted
After that I retried and it said - 'Your device is already s-off' then it wanted to download and install CWM Recovery 4.0.142 Revolutionary...
HTCDEV - Step 13 didnt happen, it just stayed on the normal bootloader screen (in Fastboot USB)
Flashed a earlier version of HBOOT (1.49.007) before Revolutionary ROOT method(revolutionary didnt support HBOOT 1.49.0012), i noticed everytime i 'completed' revolutionary method with error, my HBOOT changed to 1.49.1107 for some reason, IDK
Now my bootloader setup is:
***Revolutionary***
SHOOTER_U PVT SHIP S-OFF RH
HBOOT-1.49.1107
RADIO-10.13.9020.08_2M
eMMC-boot
In CWM Recovery - I flashed SU.zip, it removed /bin and /xbin, and wanted to start copying or rooting file and then showed an error msg 'installation aborted', booted into ROM and SU app requested SU access???
BTW... downloaded and tried 3 RUU's all 3 for 3d of course and all 3 gave the same error - MODEL ID ERROR (i need the correct model) and in fastboot...
Use same Rev code : fastboot flash unlocktoken Unlcok_code.bin
Half the time it is done successfully but with no disclaimer screen (stays on fastboot) and changes hboot to 1107
OR
Gives error (Remote : Partition no avaiblable) or (Remote : not allowed)
Try fastboot oem lock, Doesnt lock and same result as mentioned above and every now and then it says loading custom splash sceen failed, htc disclaimer screen???
If anyone has had this problem or similar, please help, I would really appreciate it
Thnks in advance!!!
END
Now, Ive got a similar problem,
HBoot
1.58.5858 Jpbear
Unlocked
So I flashed the RUU_Shooter_U_TWM_TW_1.23.921.5_Radio_10.55.9020.00_10.13.9020.29_M_release_207920_signed.exe, it was the closest I could find with HBoot 1.49.0012 and gb 2.3.4...
Okay, np it flashed it with no problems... but little did I know, I lost root, bootloader relocked with disclaimer screen and lost s-off... Im buggered
So after messing around including almost bricking my phone, flashing new hboots, trying htcdev unlock with rogers, EMEA and sprint, no luck...
The only result is it showing the disclaimer screen (as mentioned in 1st boot attempt) that i cant select yes...
I tried flashing recovery, however when I flash recovery, it either hangs with HTC screen for a min or two then reboots or just hangs there forever...
Somewhere along the line I tried booting into Android and it jut boot in fastboot, for some unknown reason it also didnt pickup the PG86IMG.zip file I had on, it actually didnt pickup and PG86IMG files???
I also came across writesecureflag 3 in fastboot, gave it a try and it gave me a ***security warning***...
After that, I coud flash a PG86IMG but when I tried the htcdev unlock, I select ye, no response, removed battery and it said ***unlocked***, but when I flash a recovery, it flashes recovery in cmd but cant boot into it or it just doesnt flash onto the phone???
Somehow in between all of this I could get past the "yes" in unlock bootloader which was pure luck of the joy of the moment made me forget what I did before, I also tried flashing these RUU's
RUU_SHOOTER_U_ICS_35_S_HTC_Europe_3.28.401.1_Radio_11.77.3504.00U_11.25.3504.06_M_release_262714_signed
RUU_SHOOTER_U_ICS_35_S_Rogers_WWE_3.28.631.1_Radio_11.77.3504.00U_11.25.3504.06_M_release_262715_signed(1)
RUU_SHOOTER_U_ICS_35_S_hTC_Asia_WWE_3.28.707.1_Radio_11.77.3504.00U_11.25.3504.06_M_release_264110_signed
When booted in TWN-TW RUU, I could install Rom manager and flash CWM through that but through fastboot, it didnt boot through it
fastboot flash recovery recovery.img
fastboot boot recovery.img
RESULT: hangs on htc screen for a min or 2 then reboot into OS
Now im currrently on Asia ICS, hboot jbear 1.58.5858, htc recovery...
And in want of root, s-off, and most important able to Unlock Bootloader by selecting yes with a response,
please ANY help would be of use
thnx in advance
Its not much but will have a small paypal reward for those who helped (btw it will prob help others aswel)
[TAGS] : root issue, s-off problem, unlock bootloader cant select yes, evo 3d hboot not detecting PG86IMG, evo 3d bootloop
wow, you got a used or refurbished 3d which was already s-off. if you had posted before doing anything ,all you needed to do was flash a recovery and flash su zip. When you have s-off with custom hboot, like you had, you cannot unlock through htcdev and you don't have to. S-off with custom hboot means you can already flash any hboot ,recovery,Rom ,kernel or any mods.
You never needed HTC dev unlock.
you said.you are s-on with jbear.hboot? I.don't think.that's possible ,.check again if it's s-off or s-on . If it's s-on then it cannot be jbear.
You never lost s-off when you ran the RUU, you lost s-off by running the write secureflag command . It was your luck you were on stock.hboot , if you were on custom one,your evo 3d was dead for sure. Now flash the RUU that is made for your phone. then follow instructions from unlimited.io or ramjet73's thread , flash recovery then su zip. If you want another Rom you can directly flash that Rom without su.
Again, you never needed the htcdev. But now you will need it for the wire trick.
Thnx for responding, u made my day xD
mnomaanw said:
wow, you got a used or refurbished 3d which was already s-off. if you had posted before doing anything ,all you needed to do was flash a recovery and flash su zip. When you have s-off with custom hboot, like you had, you cannot unlock through htcdev and you don't have to. S-off with custom hboot means you can already flash any hboot ,recovery,Rom ,kernel or any mods.
You never needed HTC dev unlock.
you said.you are s-on with jbear.hboot? I.don't think.that's possible ,.check again if it's s-off or s-on . If it's s-on then it cannot be jbear.
You never lost s-off when you ran the RUU, you lost s-off by running the write secureflag command . It was your luck you were on stock.hboot , if you were on custom one,your evo 3d was dead for sure. Now flash the RUU that is made for your phone. then follow instructions from unlimited.io or ramjet73's thread , flash recovery then su zip. If you want another Rom you can directly flash that Rom without su.
Again, you never needed the htcdev. But now you will need it for the wire trick.
Click to expand...
Click to collapse
So, okay, I messed around abit more, not as if I could do any further damage besides bricking LOL
So this is my position and will leave it till next response...
***Relocked*** (can unlock, relock np because of s-on, if s-off, I cant, it just hangs after selecting yes, no response)
HBoot 1.49.0012
I have fastboot and OS access,
cant flash recovery or zip, etc, can change cid
Hboot doesnt read PG86IMG.zip files at all,
Goes through PG86... list, hangs 2 sec on PG86IMG.zip, says checking or parsing PG86IMG.zip for less than a sec then 'cancels', goes to hboot screen
Rev tool does not work
1st attempt - (1st line)Zerging root...
result- Cannot aquire root
for 2nd consecutive to 3,4,5,etc attempt
- goes to 2nd line in rev tool,
result gives error Communications with phone stopped,
When flashing recovery, it flashes perfectly, when fastboot boot recovery.img or hboot>recovery, hangs for a while then reboots
So flashing files through fastboot is a no go (generally gives error > remote:not allowed)
Thus conclusion, im considering the downgrade/unbrick method but It doesnt pickup and PG86IMG files (check exact speeling p.s. have done this alot)
I did a day ago aquire root, 4ext recovery but wanted unlock boot loader, so s-on, the only way to unlock, then got myself to this delema, stupid I know :silly:
So if you have any tricks up your sleeve, let me know please and thnx
I recently bought my new Evo 3D from eBay. As far as I can tell, it is in perfect shape. I was hoping to flash it to Page Plus and was dismayed when I realized how impossible the rooting process looked. I began with downgrading my 1.58 HBOOT to 1.40. Now I am attempting to flash the 1.13 RUU so I can finally move on in this process, but every time I attempt to flash it (or any other RUU), I get the error, "Error [131]: CUSTOMER ID ERROR." Now most fastboot commands do not work, and my phone bootloops with the stock ROM. Any idea how to fix it?
I used the juopunut bear wire trick for s-off so excuse me if I'm a little ignorant here with the downgrade method. Once you are down to hboot 1.40 (which sounds like you were successful with) can't you use the revolutionary s-off tool?
Once s-off you can easily run any ruu but I guess I don't understand why you need to downgrade even further to s-off, when revolutionary (I thought) works with hboot 1.40 and 1.30
Brian706 said:
I used the juopunut bear wire trick for s-off so excuse me if I'm a little ignorant here with the downgrade method. Once you are down to hboot 1.40 (which sounds like you were successful with) can't you use the revolutionary s-off tool?
Once s-off you can easily run any ruu but I guess I don't understand why you need to downgrade even further to s-off, when revolutionary (I thought) works with hboot 1.40 and 1.30
Click to expand...
Click to collapse
As I understand I can't use Revolutionary without booting into Android (since it needs ADB), which is currently impossible because of the bootloop.
I should also point out that HTCDev unlock fails for me. On hboot 1.58 the fastboot commands are successful, but I am never presented with the unlock dialog on the phone. On hboot 1.4 most fastboot commands fail. Also, I can easily restore to stock by flashing a PG86IMG which includes hboot 1.58.
Macadamia Daze said:
As I understand I can't use Revolutionary without booting into Android (since it needs ADB), which is currently impossible because of the bootloop.
Click to expand...
Click to collapse
Oh, I see now!
Macadamia Daze said:
I should also point out that HTCDev unlock fails for me. On hboot 1.58 the fastboot commands are successful, but I am never presented with the unlock dialog on the phone. On hboot 1.4 most fastboot commands fail. Also, I can easily restore to stock by flashing a PG86IMG which includes hboot 1.58.
Click to expand...
Click to collapse
So far, in every case I've seen, running the latest RUU has solved the bootloader unlock issue for people. I would run the 1.58 RUU and see if you can unlock the bootloader. Then go from there.
Or as I saw mentioned in the other thread, use the PG86IMG version of the RUU or extract it yourself from the exe. Flashing through the bootloader does not perform a cid check.
Brian706 said:
Oh, I see now!
So far, in every case I've seen, running the latest RUU has solved the bootloader unlock issue for people. I would run the 1.58 RUU and see if you can unlock the bootloader. Then go from there.
Or as I saw mentioned in the other thread, use the PG86IMG version of the RUU or extract it yourself from the exe. Flashing through the bootloader does not perform a cid check.
Click to expand...
Click to collapse
So far, I have yet to have any success despite flashing many RUUs. I took a break for quite a while, but decided I may try again. I am downloading now the 2.08 RUU, which one thread suggested.
Macadamia Daze said:
I should also point out that HTCDev unlock fails for me. On hboot 1.58 the fastboot commands are successful, but I am never presented with the unlock dialog on the phone. On hboot 1.4 most fastboot commands fail. Also, I can easily restore to stock by flashing a PG86IMG which includes hboot 1.58.
Click to expand...
Click to collapse
If I remember correctly, the HTCDev unlock doesnt work for the earlier bootloaders. It says so on the very first page when its walking you through the steps. I could be wrong but you may wanna keep that in mind