I have a sneaky suspicion that this device might not have a software solution for S-OFF.
They are getting better at the software end of things and some of the latter devices (Rezound comes to mind?) involved people shorting the JTAG interface out and causing bus glitches.
HTC has a history of leaving the JTAG location somewhat obvious and accessible, like on the Rezound where the interface was accessible with the battery cover off.
My HTC One S also has the JTAG visible under the sim card door at the top....
I was just looking at images taken of the One by Chipworks and iFixIt and I think the JTAG might be on the board that has the headphone jack and RF frontend test points.
The pads are obviously for testing, just a matter of figuring out which pads are clock, data, etc.
Scotty: If your interested in electronics I say go for it.
I am winding down after 20 years but I still keep a full bench and "dabble"
There are a few guys on youtube that you might pick up some stuff from guys like Dave Jones (EEVBlog), The Signal Path, and Mike's Electric Stuff.
It's a fun hobby and occupation.
I got out because I was offered a position developing and maintaining a custom software package that paid more
Still love my electronics projects and I really do miss field work however.. I had a lot of fun.