agentc13

This is a step by step guide to getting SuperCID for your HTC One S. This only works on the S4 processor version. I got all my information from this post on xda by grankin01. I only modified the instructions from that post for the One S (specifically the T-Mobile US version). So if you find this useful, make sure to stop by there to show some thanks.

You do this at your own risk!!! This could turn your new phone into a very expensive paperweight!!! If you don't know how to do it or are uncomfortable DON'T DO IT!!!

You need to have an ADB environment set up on your computer as well as a hex editor like HxD. As always it is a good idea to make a backup before doing this sort of thing.

SuperCID


1. Open up your command prompt and go to the directory that you have ADB installed to. Type [HIGH]adb shell[/HIGH] and hit enter.

2. Type [HIGH]su[/HIGH] and hit enter.

3. Type [HIGH]dd if=/dev/block/mmcblk0p4 of=/sdcard/mmcblk0p4[/HIGH] and hit enter.

This will dump the partition to your sdcard.

4. Type [HIGH]exit[/HIGH] and hit enter.

Type [HIGH]exit[/HIGH] and hit enter again.

This should take you back to a command prompt for your computer.

5. Type [HIGH]adb pull /sdcard/mmcblk0p4[/HIGH] and hit enter.

NOTE THE SIZE OF THE FILE BEFORE THE NEXT STEP!

6. Open the file (mmcblk0p4) with your hex editor.

7. Look for offset 00000210 or 00000214 and you should see "T-MOB010" with your IMEI number after it.

NOTE: "T-MOB010" is the T-Mobile US version, depending on your carrier this will change, but it will still precede your IMEI. See the link at the end of this post for a list of other CID's.

8. Change T-MOB010 to 11111111 and save the file as mmcblk0p4MOD.

MAKE SURE AT THIS POINT THAT THE FILE IS THE EXACT SIZE IT WAS BEFORE YOU HEX EDITED IT!

9. Now go back to your command prompt and type [HIGH]adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD[/HIGH] and hit enter.

10. Type [HIGH]adb shell[/HIGH] and hit enter.
Then type [HIGH]su[/HIGH] and hit enter again.

This will put you back into the android shell and give you root privileges.

11. Type [HIGH]dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4[/HIGH] and hit enter.


To test if it worked restart the phone into fastboot. Type [HIGH]adb reboot bootloader[/HIGH] and hit enter. Once the bootloader screen comes up type [HIGH]fastboot oem readcid[/HIGH] and hit enter. It should read "11111111".

If you have a One S that is not T-Mobile US, you will need to replace that specific CID instead of "T-MOB010". For a list of all the One S CID's see this thread on xda: [Info]HTC One S CID's.

Last edited by agentc13; February 20th, 2013 at 02:53 PM.

Altaone

Hello,

The warning at the beginning, If I have unlocked and rooted twice, will super cid and s off be a problem for me?

BTW. the instructions for unlock / root could be revised.
I am willing to help if needed

Now I am wishing I could delete post
Got super CID?

Last edited by Altaone; March 21st, 2013 at 09:49 PM.

scotty85

root and unlock are needed to change the CID. it wont matter how many times you have done the process prior.

do you still need help,or have you gotten superCID?

__________________
The Delivery Guy
If someone has helped you,please click the THANKS button on that post.
Please post questions so others can benefit from the answers.
donate to my device fund

jak2rocks

For some reason everything seems to be working fine for me right up until I check the CID and it still says T-MOB010. What could I possibly be doing wrong?

jak2rocks

Never mind. I figured out a way. All I know is that I officially love EStrongs File Explorer!!!

scotty85

what did you do? others have been having trouble,please describe your fix in as much detail as possible

uncledrax

Yeah this doesnt work for me. All looks fine until i read back the CID. Still says TELST001. Any ideas?

ZamanAhmad

Hi I just went through with this SuperCID but when I pull the mmcblk0p4 I changed it to 11111111 but when I looked at the file size it was different
[q] help quick please supercid problems please heelp urgnt please
so i got the file mmcblk0p4 it was 1.00 KB (1,024 bytes) but after i opened it with hxd editor i changed it to SuperCID 111111111 and the file size changed to 1016 bytes (1,016 bytes) what should i do and should i do adb push mmcblk0p4 the non supercid version !
please help quick
THANKS

scotty85

If the file size change, do not write it back to the phone. If you have already written it, write back the original.

mex713

So i tried this about 4 time already and i still get T-MOB010 as my cid

mwohlford

Does this method work after the latest OTA update?

scotty85

welcome to write protection. the JB OTAs,in some cases,seem to have added WP to mmcblk's 4 and 5. some more info and a bunch of different things tried in this thread: Trying to return to stock

maybe. ive seen some folks report it does,lots of reports it doesnt. your only option is to try and see what happens. if your cid doesnt change,as the user above,then you will likely not be able to superCID.

daspi

shell@android:/ # adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD
adb push mmcblk0p4MOD /sdcard/mmcblk0p4MOD
* daemon not running. starting it now on port 5038 *
* daemon started successfully *
error: device not found
1|shell@android:/ #


What am I doing wrong? My phone is in USB debugging mode. Any tips?

scotty85

some basic troubleshooting tips:

daspi

C:\fastboot>adb devices
List of devices attached
HT24RW408116 device

C:\fastboot>fastboot devices
HT24RW408116 fastboot

Seems my connection is fine. All went fine of your steps until the place where I entered the above command. I guess I'll try all steps one more time and see if anything changes and I shall post back. If same results, I will take your drivers and see if it makes a difference. I downloaded mine from a link xda.

daspi

I just downloaded HTCDriver3.0.0.007.exe and ran it as administrator. Ahhhh it just ran and nothing else...what does it do? Sorry my ignorance.

daspi

* daemon started successfully *
shell@android:/ $ su
su
shell@android:/ # dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
dd if=/sdcard/mmcblk0p4MOD of=/dev/block/mmcblk0p4
2+0 records in
2+0 records out
1024 bytes transferred in 0.007 secs (146285 bytes/sec)
shell@android:/ # adb reboot bootloader
adb reboot bootloader
* daemon not running. starting it now on port 5038 *
* daemon started successfully *
error: device not found
1|shell@android:/ #

1|shell@android:/ #
C:\fastboot>adb reboot bootloader
error: device not found

C:\fastboot>fastboot oem readcid
...
(bootloader) cid: T-MOB010
OKAY [ 0.010s]
finished. total time: 0.010s

I am a bit at a loss what fails. It seems the new mmcblk0p4MOD does not overwrite the old setting.

scotty85

some newer builds(including t mobile) have introduced write protection on p4 to prevent us from changing cid.

you will have to run moonshine instead to gain s off

http://moonshine.io/

daspi

My phone is a HTC One S from T-Mobile 3.14.531.17 710RD. Moonshine only lists a HTC One S T-MOB Windows 3.14.531.11. Will this work?

scotty85

in this thread a couple have reported it to work on .17: http://forum.xda-developers.com/showthread.php?t=2325590

if you have trouble getting it to run in windows,the prollem is prolly not the OTA,but windows. i ran moonshine on a dna and couldnt get it to work on windows. ran it from an ubuntu live cd and it worked fine.

Altaone

Hi,
I was on 3.14.531.17 and moonshine worked for me.

daspi

I am glad to report that it worked with Ubuntu run from a USB memory stick. Long live UBUNTU! Thank you for all the help.

blonda16

i have followed the guides here and almost bricked my phone.
i manged to stock restore with help from the legendary Scotty85

now i have BACkUP my device and trying to re-do the tutorials...
i have twrp 2.6.3.0 in recovery and also superSU

all is well accept that when i enter CMD -> adb shell -> su
i get this:

C:\htc-ruu>adb shell
~ # ←[6nsu
su
/sbin/sh: su: not found
~ # ←[6n

should i proceed without it and change the CID or should i re install the superuser ?
when operating my phone twrp app and superSU do open meaning that the device is unlocked and rooted.

pleasse HELP

scotty85

the # indicates you are a root shell,if you hadnt figured it out allready,so you dont need to enter the "su"

facepalm was a little tricky for me on the one s. i had to be running viper rom,rather than stock rooted

if you have troubles,keep in mind its not the only way to skin the cat. you can also try:

http://rumrunner.us/

http://moonshine.io/

firewater s-off

holler if you have questions

TerrorApple

Hey guys,

I'm also running into write protection with my ViperOneS 2.2.0 (JB 4.1.1). I need S-OFF for updating my radio for ViperOneS 3. I read JB OTA adds write protection. So will I be fine when going back to stock (ICS)? ATM I run:
One S S4
HBOOT 2.15
Radio 1.15.50.05.29_10.30.50.08L
TWRP 2.6.3.0
CID: T-MOB101
All I want to do is get SuperCID and S-OFF my device... So what shall I do now?

Thanks!

Last edited by TerrorApple; April 13th, 2014 at 04:42 AM.

scotty85

Just use another method.you no longer need supercid. You can potentially run moonshine,rumrunner,or firewater. I can get you some links if you need them when I get back to my pc.

TerrorApple

Thanks for your reply. Well I tried moonshine, rumrunner and firewater. None of them work.
Moonshine:
Rumrunner:
Firewater:
I disabled my AV and firewall and used a USB2 port. ADB and Fastboot are fine. Bootloader is unlocked. What am I doing wrong?

scotty85

Not really sure what you're doing wrong,I've not had any luck getting the tools to work on windows. You are still rooted and running a custom rom,correct? For rumrunner to work,you may need to be running an insecure kernel(wich viper should have)

Make sure you've met all the prerequisites and try running rumrunner or firewater from an ubuntu 12.04 live cd

TerrorApple

Wow! Thanks for the hint with Ubuntu! First try and everything went fine, got S-OFF now. I hate Windows -.- Thanks for your help!

scotty85

Awsome! Glad that did the trick. Windows is very susceptible to things running in the background trying to hijack comunications with the device,and also requires the use of prollematic drivers. First time I tried ubuntu I had the same results- after prollems with moonshine on windows,it zipped right thru on ubuntu.