__________________
The Delivery Guy
If someone has helped you,please click the THANKS button on that post.
Please post questions so others can benefit from the answers. donate to my device fund
Last edited by scotty85; April 29th, 2013 at 06:52 PM.
The Following 8 Users Say Thank You to scotty85 For This Useful Post:
some frequently asked questions and general info about s-off
*what exactly IS s-off?
the simple answer is "security-off" on the normal checks that the phone does before it allows you to change different partitions,or revert to an older software/firmware combination.
more specifically,what the s-off procedure gives the rezound is a "radio s-off" by changing a setting in the radio NVRAM called the "secure flag" to "off". this method of s-off is ideal,as it is below the radio level of the phone,and will remain no matter what other changes are made. radios,hboots,etc. can all be changed and the radio secure flag will remain off.
ruus can be run,OTAs accepted,etc. and the s-off will stay,until it is purposely changed.
other devices use a "patched" hboot,wich is basically an hboot,that does not listen to the radio secure flag. the radio secure flag is still s-on,the patched hboot simply ignores it. these hboots can be further patched to prevent themselves from being overwritten,so the s-off is not lost during an ruu or OTA. with older phones,this works fine until a new hboot is required for an OS upgrade.
with the rezound and other new devices,this type of s-off is not possible(or we would have had it a long time ago) due to the complex checks that the phone makes when it boots. if the s-on radio checks hboot and finds it to be unsigned,the phone is put into a "do not boot" mode that is only reversible by htc,becoming effectively a hard brick.
"why not patch the radio just like we patched the hboot??" partially because its easier said than done,partially because other checks are going on,and if the radio is found to be unsigned,again, "no boot mode". basically there are just too many checks going on to patch them all. since it all starts with the radio secure flag,its the only practical way to gain complete access to the phone.
*isnt my unlocked via htcdev bootloader the same as s-off? i thot thats what unlocked means?
sorry,no. its not the same. the key difference is that htcdev unlock only allows access to boot/system/recovery. the phone is still s-on,and still doing plently of checks that prevent you from:
-changing firmware
-changing your splash screen
-going backwards in software/firmware build version numbers.
it also does not allow you to write the boot image from the recovery partition,as we all know that have flashed roms on s-on phones. since the kernel lives in the boot image,the kernel can only be changed by:
1)flashing it seperately via hboot or fastboot
or
2)launching your recovery from fastboot.
a permanently installed recovery cannot install kernels with htcdev unlock
*so what does s-off do for me??
-first and foremost,it makes rom flashing and nandroid restoring ALOT easier by allowing the permanently installed recovery to write the boot image,making the PC no longer a required part of the flash/restore equAtion you can now download a rom right to your phone,move it to the root of your sd with a file manager,and boot to a recovery and flash it,without a PC anywhere in sight.(note that i do not download roms to my phone,i prefer to download to pc,then transfer. a personal preference)
-second,it alows changing of firmware,so you can run a "patched" or engnieering hboot,the advantages of will be discussed later
-it lets you upgrade your radio and related firmware wihtout running a huge,signed,full RUU
-it lets you go backwards in build numbers. this is handy becasue you can,without fear,flash the latest leak,and if its bad,revert back to older software/firmware without issue.
-you can change your splash screen,wich is not important functionally,but fun. anything from carman electra, to your cat,to your grandkids can replace the htc splash screen.
-last and not least,the ability to add a patched or engineering hboot,combined with the ability to run any RUU that exists,gives a much greater opportunity to revive a "soft bricked" phone.
-one last big plus is that the procedure will change your unlocked or relocked status back to locked wich,visiually,is good for warranty purposes
*can i get back to 100% s-on stock??
yes,you can. because the process changes you back to locked,you just need to run a signed RUU and turn the secure flag back on. directions in the following post.
*what is an engineering hboot?
an "eng" or "engineering" hboot is simply a bootloader that allows for extra fastboot commands. for most folks,99% of these commands will never be used. the main commands that users of an eng hboot will use,over a stock hboot are: fastboot flash wich is used to flash recoveries,boot images,splash images,hboots,et.
and fastboot boot wich is used to boot(launch) an image directly into phones memory. most common use of this is recovery. you can use it to get recovery running,without having to permantly flash it,thus leaving the stock one installed. this is good for users that want to recieve OTAs,and dont use recovery much.
*what is a patched hboot?
a "patched" hboot is simply an hboot that has been patched to provide some or all of the same commands as a real engineering hboot. they can be considered safer than a real eng hboot,since they are generally made of newer,more reliable hboot versions. eng hboots have generally been around since prior to the phones release. a patched hboot also can block itself from being overwritten by other hboots,wich can be a huge advantage on phones where the radio secure flag is actually "on" as the s-off hboot will always remain,even if OTAs are taken,or RUUs run.
the thunderbolts revolutionary patched hboot is a prime example of a ship hboot patched for eng commands,and preventing itself from being over written.
*how do install or change recovery now that im s-off,but locked?
there are a couple ways to skin this cat:
1)simply allow juopunutbear to install its patched hboot. this will let you use fastboot flash and fastboot boot if you are used to these commands.
2)as a PH98IMG file. splash images,recoveries,hboots,or any other firmware can be changed by packing up the images,along with an android info text document, into a zip file,that is then renamed PH98IMG,placed on the sd card,and updated in hboot.
*how do i change splash screen or fimrware?
*how do i downgrade to an older build version?
donate to my device fund
Last edited by scotty85; September 2nd, 2012 at 03:24 PM.
The Following 7 Users Say Thank You to scotty85 For This Useful Post:
WARNING!!! DO NOT turn your secureflag on unless on a stock,signed hboot.
s-on with an eng signed or patched hboot will hard brick your device immediately.(read: permanently bricked,unrecoverable)
in other words,ONLY use the writesecureflag 3 command AFTER running an RUU. never before.
im sure were mostly to excited to want to go back to s on just yet,since we just got s-off but its a matter of time before this comes up,so here ya go:
*if you have a relocked status in hboot,we now have the technology to change that. reference this thread: [how to]reset your lock status flag and flash lock_bootloader in recovery. verify you are back to locked in hboot,then procede with the following steps to restore stock software and s-on:
1)donwload and run an RUU for the most current build(currently 4.03.605.2)
2)open a cmd window. plug in phone,charge only mode,usb debugging on.
3)run the following:
cd c:\mini-adb_vigor
adb devices
adb reboot bootloader
fastboot devices
fastboot oem writesecureflag 3
fastboot reboot-bootloader
*verify you are locked s-on
fastboot reboot
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Scott>cd c:\mini-adb_vigor
c:\mini-adb_vigor>adb devices
List of devices attached
HTxxxxxxxxxx device
c:\mini-adb_vigor>adb reboot bootloader
c:\mini-adb_vigor>fastboot devices
HTxxxxxxxxxx fastboot
c:\mini-adb_vigor>fastboot oem writesecureflag 3
... OKAY [ 0.051s]
finished. total time: 0.051s
c:\mini-adb_vigor>fastboot reboot-bootloader
rebooting into bootloader... OKAY [ 0.177s]
finished. total time: 0.177s
c:\mini-adb_vigor>fastboot reboot
rebooting...
finished. total time: 0.168s
c:\mini-adb_vigor>
*verified working if you need it for warranty.
Last edited by scotty85; December 14th, 2012 at 06:17 PM.
The Following 8 Users Say Thank You to scotty85 For This Useful Post:
after s-off,you can now have complete control of your phone. you can change whatever you want since its not doing ANY security checks at all. as such you have a much greater responsibility to know what your flashing and why,and that your files are 100% unmolested and uncorrupt.
please be aware that a bad bootloader or radio flash can and will brick your phone,possibly beyond recovery.
you do not any longer have the s-on safety net of htcdev.
on the other forums,im seeing alot of flip-flopping bootloaders around,and most folks dont even know why they want the eng hboot.please think about this.its risky- flashing a a new bootloader is prolly THE biggest risk you can take on your device,as without a bootloader NOTHING will load. i.e.,you have a brick. if your current bootloader suits your needs(ie boots youre phone and supports the fastboot commands you regularly use) then why are you changing it?
s-off is awsome,i know but again,i just want everyone that has been asking various question to realize the the seriousness that having this privelege is. have fun flashing roms and slpash screens,but be extremely cautious/careful with the important parts of your device.
-make sure you know what your flashing,and why
-make sure you have an md5 summer and use it.
-if you just asked "whats an md5??" then learn it
-make sure you are comepletely comfortable with all procedures for things you do.
last and not least,please ask any questions BEFORE your phone makes a short lil buzz,shuts off,and wont come back on
im not trying to scare anyone into staying s-on,i just want everyone to use caution and have safe,happy flashing
ill finish out the blank ones after work or tomoro. please feel free to let me know if theres anything else youd like to see in the faq,or any other questions.
The Following User Says Thank You to scotty85 For This Useful Post:
on the other forums,im seeing alot of flip-flopping bootloaders around,and most folks dont even know why they want the eng hboot.please think about this.its risky- flashing a a new bootloader is prolly THE biggest risk you can take on your device,as without a bootloader NOTHING will load. i.e.,you have a brick. if your current bootloader suits your needs(ie boots youre phone and supports the fastboot commands you regularly use) then why are you changing it?
I use the stock hboot.
Until such time that there is some concrete documented advantage to use an ENG or modified hboot, I'll continue to use the stock hboot.
Scotty, good thread.
Regards,
Howard
The Following User Says Thank You to howardz2 For This Useful Post:
Until such time that there is some concrete documented advantage to use an ENG or modified hboot, I'll continue to use the stock hboot.
Scotty, good thread.
Regards,
Howard
the only advantage of a patched or eng hboot to 99% of users is the fact that it lets you use "fastboot boot" and "fastboot flash".
with a stock,locked hboot,these commands are not available,and one must install things a PH98IMG files rather than fastboot flashing them. its not a huge deal... especially since PH98IMG files can be installed in fastboot as RUUs without having to mess with the sd card or correct naming
its all about what a person is comfortable with.
i run stock hboots as well,but keep them unlocked so i have the above commands available. for most folks i dont reccomend this,as you cannot go back to locked without turning s-on,then s-off again its not a big deal to me,as i have no factory warranty. but for folks that do,they want to preserve the locked status,so unlocking is not a good option.
every now and then if i want to tinker with something,ill flash the eng hboot,but again,thats not something most folks will ever need(or should) do. ill flash a stock hboot back after im done.
Device(s): LG ESTEEM: Oc'd @ 1.7, Samsung galaxy indulge: BASIX ROM, LG Optimus M: rooted-cm7 soon...
Carrier: Not Provided
Thanks: 56
Thanked 12 Times in 11 Posts
ok i am so confused. Ive read and reread the guides on s-off and s-on, rooting, unlocking....im lost...
My end goal is to flash a new rom and kernal on this Rezound. Ive done rooting and flashing before. But, ive never dealt with s-off and s-on. Ive read about it. I understand what it is.
So, basically, i think i need to unlock the bootloader. Isnt that the same thing as S-off?
Do i need to flash a new bootloader so i have fastboot?
T_T . I thought i was pretty good at this until i walked into the htc world :P
Any help clarifying things would be great. Im usually fairly good at building up an understanding, but this Hboot, boot loader, s-off stuff has me spinnnnnnning
[QUOTE=synergy7ok i am so confused. Ive read and reread the guides on s-off and s-on, rooting, unlocking....im lost...
My end goal is to flash a new rom and kernal on this Rezound. Ive done rooting and flashing before. But, ive never dealt with s-off and s-on. Ive read about it. I understand what it is.
So, basically, i think i need to unlock the bootloader. Isnt that the same thing as S-off?
[COLOR="Red"]no. htcdev bootloader unlock ONLY grants access to boot,system,and recovery,and you cannot write boot from a permanent instsalled recovery. the recovery MUST be launcehd from fastboot(directions to "temp install recovery" in the root guide) in order for the recovery to flash the kernel. if the rom is flashed from a permanent recovery,the kernel must be flashed seperately via fastboot or hboot [/COLOR]
Do i need to flash a new bootloader so i have fastboot?
no. with hctdev,you couldnt change the bootloader if you wanted to
the stock unlocked bootloader allows the fastboot boot and fastboot flash commands.
with s-off,a locked hboot does not allow fastboot boot or fastboot flash, so you will need to either:
1)install the jpbear hboot
or
2)just install recoveries and such in hboot. as a PH98IMG file.
T_T . I thought i was pretty good at this until i walked into the htc world :P
Any help clarifying things would be great. Im usually fairly good at building up an understanding, but this Hboot, boot loader, s-off stuff has me spinnnnnnning
with s-off,you have access to everything,and a permantly installed recovery will install kernels. IMO,its way better. it can also be returned to 100% locked s-on stock if needed,something not possible with htcdev.
htcdev will let you change roms and kernels,but not firmware,and is more compolicated to flash. you also cannot go back to locked if you need to turnthe phone in for warranty- only relocked. hope that helps
Do we flash this RUU in recovery? Or do we need to change the name to PH98IMG?
After going S-Off on my warranty Rezound, the charge does not hold at all. Need to go to stock to send it in.
ther RUUs are either a .exe file run on the PC with the phone plugged in,or installed in hboot as a PH98IMG. they are not flashed in recovery.
what firmware are you on? might try going back to gingerbread if on ics and see if that helps.
-run GB ruu
-select clear storage option in hboot
-reinstall recovery and root,if desired
you may even try installing the stock recovery,or running the NEWEST ics leak,and then choosing the clear storage option there.
poor battery life may be coming from the phone having a hard time with 3g/4g,wich is the result of bouncing around firmwares, and should be fixed with the clear storage option.
ive been on ics since the leaks started,and have never had any worse battery life than i had on GB. with the newest leak,i think its actually better.
if youre looking for a stock rom to do the wire trick and s-off,you are misunderstanding... you just need to be on a stockish rom(lots of folks done it on cleanrom) and you can be on ICS or GB as long as you download the appropriate control bear. the important thing,is that root access is needed,so wether your stock GB or ICS,you must be unlocked and rooted
if youre looking to return an s-off phone s-on for warranty,you need to run the current release firmware,wich is at this time 2.01.605.11
Okay just so I'm clear, I found this thread too late to see that I should not have unlocked after s-off and now I probably have to send this phone back, does all kind of wierd things on any ICS build, sensors turn off, phone won't hang up, runs painfully slow. So the closest I can get to stock is going to be: Gingerbread, s-on, relocked, correct? No locked achievable?
After I flash the Gingerbread RUU, I assume it will still be unlocked? If so do I set back to relocked before or after s-on or does it matter?
I don't know if I will still have problems on Gingerbread, I will find out when I flash it today, I am going to guess I will have the same issues, I have tried a couple different ICS leaks and ROMS now after I started having problems and they always come back and are always the same problems, it is interesting though, the phone works great for usually an hour or two after flashing a new ROM then starts screwing up till it's unusable.
On the other point, so I could
1. Flash to Gingerbread
2. Set S-on
3. Do the wire trick again and get S-off
At that point I would be "locked" and then I could reset back to S-on and be 100% stock?
I don't know if I will still have problems on Gingerbread, I will find out when I flash it today, I am going to guess I will
1. Flash to Gingerbread
2. Set S-on
3. Do the wire trick again and get S-off
At that point I would be "locked" and then I could reset back to S-on and be 100% stock?
Outstanding, I am back to Gingerbread, locked and s-on. Last question, I rooted after installing GB because juopunutbear says it needs for the wire trick, I thought I lost root last time after going s-off but not this time so now what is the best way to "unroot" it?
Outstanding, I am back to Gingerbread, locked and s-on. Last question, I rooted after installing GB because juopunutbear says it needs for the wire trick, I thought I lost root last time after going s-off but not this time so now what is the best way to "unroot" it?
Fantastic guide. Im coming over from the thunderbolt, much easier to s-off. Had a few questions. Does the juopunutbear work with the ics ota? If not what is the best way to revert back?
It should, I've tested it on the ICS leak that came out just before the OTA and it worked no problem. Just a tip for s–off at least for me, watch the little video of the guy doing the wire trick, it is just a flick then a flick, a lot faster than it says somewhere in the instructions, I could not get it till I saw how fast the guy does it in the video, since then I'm 3 for 3 s-off on the first try
Last edited by johndawg57; August 9th, 2012 at 09:35 PM.
The Following User Says Thank You to johndawg57 For This Useful Post:
Fantastic guide. Im coming over from the thunderbolt, much easier to s-off. Had a few questions. Does the juopunutbear work with the ics ota? If not what is the best way to revert back?
yup,it works fine. just use the linux or windows download for the newest version listed in the downloads. (3.14.605.5)
The Following User Says Thank You to scotty85 For This Useful Post:
ok recently contacted you on another post and since then all i have screwed up i think. I was first on the sock ics for my rezound but i unlocked it and rooted it. Well then i decided to flash a rom and things went downhill from there. I flashed the new viper 1.0.3 rom and installed a zip file or something to where i csnt do a nadroid backup if i wanted go back to stock rooted and it now has my phone showing S-ON. should i be worried about that. And if i wanna return to stock by a nadroid backup how do i do it since this rom changed something to where i cant restore from nandroid.....i hope this post is not to confusing
ok recently contacted you on another post and since then all i have screwed up i think. I was first on the sock ics for my rezound but i unlocked it and rooted it. Well then i decided to flash a rom and things went downhill from there. I flashed the new viper 1.0.3 rom and installed a zip file or something to where i csnt do a nadroid backup if i wanted go back to stock rooted and it now has my phone showing S-ON. should i be worried about that. And if i wanna return to stock by a nadroid backup how do i do it since this rom changed something to where i cant restore from nandroid.....i hope this post is not to confusing
showing s-on is correct,unless youve run juopunut bears tool to become s-off. you can make or restore a backup simply by going to fastboot and launching your recovery again(step 2 in the root guide)
showing s-on is correct,unless youve run juopunut bears tool to become s-off. you can make or restore a backup simply by going to fastboot and launching your recovery again(step 2 in the root guide)
but thats the thing the last time i tried to do that from this rom i went to recoevery and restore nand backup , once it was complete i hit reboot and it stayed in the splash screen for like thirty minutes....i tried it twice still no success
but thats the thing the last time i tried to do that from this rom i went to recoevery and restore nand backup , once it was complete i hit reboot and it stayed in the splash screen for like thirty minutes....i tried it twice still no success
if you mean how did i put the phone in recovery i downloaded quickboot from the market and hit reboot to recovery and it took me there.
that is what i figured... and why you had trouble. when you do it that way,recovery cannot install your kernel when flashing a rom OR restoring a backup.
you need to read and understand the post i linked. you have 2 options:
1)use the fastboot boot command to launch recovery. there are directions in the linked post,and in the OP of the root guide(install a temporary recovery)
once you do this,your rom or backup will flsah correctly
2)you can install the kernal manually. there are links for that in the thread i linked as well.
that is what i figured... and why you had trouble. when you do it that way,recovery cannot install your kernel when flashing a rom OR restoring a backup.
you need to read and understand the post i linked. you have 2 options:
1)use the fastboot boot command to launch recovery. there are directions in the linked post,and in the OP of the root guide(install a temporary recovery)
once you do this,your rom or backup will flsah correctly
2)you can install the kernal manually. there are links for that in the thread i linked as well.
my personal recomendation would be #1
ok im going to try this and just to make sure im understanding correctly let me ask you this:with the viper rom i installed if i do the recovery correctly i should be able to get back to the stock rom. The only back up i made was a nandroid backup when i was stock rooted.
sorry iif im asking to many question i just wanna make sure im doing it correctly. but thanks for the help
ok im going to try this and just to make sure im understanding correctly let me ask you this:with the viper rom i installed if i do the recovery correctly i should be able to get back to the stock rom. The only back up i made was a nandroid backup when i was stock rooted.
sorry iif im asking to many question i just wanna make sure im doing it correctly. but thanks for the help
Correct. If you do the recovery correctly, your backup will restore fine
The Following User Says Thank You to scotty85 For This Useful Post:
Hello! Lots of good suff here but my eyes are getting blurry ;-)
I have the Resound and in the spring I muddled through the guides and somehow ended up unlocking the boot loader and installing root. When ICS came out I found that I could not get it to update OTA so I managed to do the wire trick and get S-Off. I then installed ICS 3.14.605.12 710RD. The phone now says Locked and S-Off. What I really need to do is to get Root back. I keep reading that phones with S-Off are easier to root but I have not found the guide to perform this to a S-off phone.
*how do install or change recovery now that im s-off,but locked?
there are a couple ways to skin this cat:
1)simply allow juopunutbear to install its patched hboot. this will let you use fastboot flash and fastboot boot if you are used to these commands.
2)as a PH98IMG file. splash images,recoveries,hboots,or any other firmware can be changed by packing up the images,along with an android info text document, into a zip file,that is then renamed PH98IMG,placed on the sd card,and updated in hboot.
Scotty,
I searched around and couldn't find a direct answer on this... I'm S-Off with JB_Hboot so I'm good right now but if I flash the latest (new global radio) ruu I'll be back to a locked and stock recovery so I can't use fastboot commands. So how do you reflash JB_Hboot [option 1] or convert the Amon Ra Recovery to a PH98IMG.zip file [option 2] (I didn't get the android info text document part).
Edit: Maybe not... Looks like the recovery in that zip file is old and not the latest Amon Ra 3.15. Consequently, back to my original question... Can you just zip up the image with any "android-info.txt" file and name it PH98IMG.zip??
Thanks!!
Last edited by Aveamantium; August 14th, 2012 at 02:28 PM.
I searched around and couldn't find a direct answer on this... I'm S-Off with JB_Hboot so I'm good right now but if I flash the latest (new global radio) ruu I'll be back to a locked and stock recovery so I can't use fastboot commands. So how do you reflash JB_Hboot [option 1] or convert the Amon Ra Recovery to a PH98IMG.zip file [option 2] (I didn't get the android info text document part).
Edit: Maybe not... Looks like the recovery in that zip file is old and not the latest Amon Ra 3.15. Consequently, back to my original question... Can you just zip up the image with any "android-info.txt" file and name it PH98IMG.zip??
yes. if youre s-off,you can use pretty much any android info text document.
The Following User Says Thank You to scotty85 For This Useful Post:
if youre s-off,you should allready be back to locked.
-run ruu
-run command
thats it
you can actually run any ruu,as long as its an official one from htc. however,using an older one will propmt the phone for OTAs after,so just use the newest availble,wich at present will be 3.14.605.12. there are not full ruus for 4.03.605.1 or .2 yet,only OTAPkgs.
The Following User Says Thank You to scotty85 For This Useful Post:
Ok. Thanks. If I understand correctly then, flashing that file as a PH98IMG was like accepting an OTA? I was running a BAMF Tonked rom, did a wipe and flashed that and it put me back to stock. With stock recovery.
Last edited by Mr. Boom; August 25th, 2012 at 10:23 AM.
Ok. Thanks. If I understand correctly then, flashing that file as a PH98IMG was like accepting an OTA? I was running a BAMF Tonked rom, did a wipe and flashed that and it put me back to stock. With stock recovery.
if the file your refering to is a full,ruu,then yes. flashing it will return you to 100% stock.
also,a PH98IMG is now available for 4.03.605.2,i spoke before i searched
I always feel like ducking and covering myself when i have to ask a question that i'm too dumb to figure out, but anyway I'm on cleanrom DE 1.4 and I had to flash the firmware patch thing when I installed it, so i'm sorry if this is dumb but that means i'm still on GB right? So I would use the GB windows version of the s-off tool? Or do I use the ICS s-off tool?
I always feel like ducking and covering myself when i have to ask a question that i'm too dumb to figure out, but anyway I'm on cleanrom DE 1.4 and I had to flash the firmware patch thing when I installed it, so i'm sorry if this is dumb but that means i'm still on GB right? So I would use the GB windows version of the s-off tool? Or do I use the ICS s-off tool?
if you are on GB firmware,id actually reccomend to relock and run the GB ruu. re-unlock and install superuser. then download and run the GB control bear.
jpbear recomends to be on a rooted stock rom,and the process does seem to be alot more stable/easy when you follow that advice. ive done 2 phones on stock GB,one on stock ICS,and one on custom ics rom with ics firmware. the custom rom one took several tries for the wire trick to work.
.exe and .zip versions of 2.01.605.11 can be found here: Shipped ROMs
The Following User Says Thank You to scotty85 For This Useful Post:
Looking for some help again . I have to send my phone back and for some reason the bootloader was unlocked after s-off after i ran the global ruu, so im trying to s-on so i can s-off, to then s-on but locked. When I get to the fastboot oem write secureflag 3 command i get an info command error. Any ideas?
Edit- got back to s-on, missed the space between flag and 3
Last edited by nasboy; August 31st, 2012 at 02:06 PM.