s-off guide/info/return to stock

Last Updated:

  1. scotty85

    scotty85 Guides Guide

  2. scotty85

    scotty85 Guides Guide

    some frequently asked questions and general info about s-off

    *what exactly IS s-off?
    the simple answer is "security-off" on the normal checks that the phone does before it allows you to change different partitions,or revert to an older software/firmware combination.

    more specifically,what the s-off procedure gives the rezound is a "radio s-off" by changing a setting in the radio NVRAM called the "secure flag" to "off". this method of s-off is ideal,as it is below the radio level of the phone,and will remain no matter what other changes are made. radios,hboots,etc. can all be changed and the radio secure flag will remain off.

    ruus can be run,OTAs accepted,etc. and the s-off will stay,until it is purposely changed.

    other devices use a "patched" hboot,wich is basically an hboot,that does not listen to the radio secure flag. :eek: the radio secure flag is still s-on,the patched hboot simply ignores it. these hboots can be further patched to prevent themselves from being overwritten,so the s-off is not lost during an ruu or OTA. with older phones,this works fine until a new hboot is required for an OS upgrade.

    with the rezound and other new devices,this type of s-off is not possible(or we would have had it a long time ago) due to the complex checks that the phone makes when it boots. if the s-on radio checks hboot and finds it to be unsigned,the phone is put into a "do not boot" mode that is only reversible by htc,becoming effectively a hard brick.

    "why not patch the radio just like we patched the hboot??" partially because its easier said than done,partially because other checks are going on,and if the radio is found to be unsigned,again, "no boot mode". basically there are just too many checks going on to patch them all. since it all starts with the radio secure flag,its the only practical way to gain complete access to the phone.

    *isnt my unlocked via htcdev bootloader the same as s-off? i thot thats what unlocked means?
    sorry,no. its not the same. the key difference is that htcdev unlock only allows access to boot/system/recovery. the phone is still s-on,and still doing plently of checks that prevent you from:
    -changing firmware
    -changing your splash screen
    -going backwards in software/firmware build version numbers.

    it also does not allow you to write the boot image from the recovery partition,as we all know that have flashed roms on s-on phones. since the kernel lives in the boot image,the kernel can only be changed by:
    1)flashing it seperately via hboot or fastboot
    2)launching your recovery from fastboot.

    a permanently installed recovery cannot install kernels with htcdev unlock

    *so what does s-off do for me??
    -first and foremost,it makes rom flashing and nandroid restoring ALOT easier by allowing the permanently installed recovery to write the boot image,making the PC no longer a required part of the flash/restore equAtion :D you can now download a rom right to your phone,move it to the root of your sd with a file manager,and boot to a recovery and flash it,without a PC anywhere in sight.(note that i do not download roms to my phone,i prefer to download to pc,then transfer. a personal preference)
    -second,it alows changing of firmware,so you can run a "patched" or engnieering hboot,the advantages of will be discussed later
    -it lets you upgrade your radio and related firmware wihtout running a huge,signed,full RUU
    -it lets you go backwards in build numbers. this is handy becasue you can,without fear,flash the latest leak,and if its bad,revert back to older software/firmware without issue.
    -you can change your splash screen,wich is not important functionally,but fun. anything from carman electra, to your cat,to your grandkids can replace the htc splash screen.
    -last and not least,the ability to add a patched or engineering hboot,combined with the ability to run any RUU that exists,gives a much greater opportunity to revive a "soft bricked" phone.
    -one last big plus is that the procedure will change your unlocked or relocked status back to locked wich,visiually,is good for warranty purposes

    *can i get back to 100% s-on stock??
    yes,you can. because the process changes you back to locked,you just need to run a signed RUU and turn the secure flag back on. directions in the following post.

    *what is an engineering hboot?
    an "eng" or "engineering" hboot is simply a bootloader that allows for extra fastboot commands. for most folks,99% of these commands will never be used. the main commands that users of an eng hboot will use,over a stock hboot are:
    fastboot flash wich is used to flash recoveries,boot images,splash images,hboots,et.
    fastboot boot wich is used to boot(launch) an image directly into phones memory. most common use of this is recovery. you can use it to get recovery running,without having to permantly flash it,thus leaving the stock one installed. this is good for users that want to recieve OTAs,and dont use recovery much.

    *what is a patched hboot?
    a "patched" hboot is simply an hboot that has been patched to provide some or all of the same commands as a real engineering hboot. they can be considered safer than a real eng hboot,since they are generally made of newer,more reliable hboot versions. eng hboots have generally been around since prior to the phones release. a patched hboot also can block itself from being overwritten by other hboots,wich can be a huge advantage on phones where the radio secure flag is actually "on" as the s-off hboot will always remain,even if OTAs are taken,or RUUs run.

    the thunderbolts revolutionary patched hboot is a prime example of a ship hboot patched for eng commands,and preventing itself from being over written.

    *how do install or change recovery now that im s-off,but locked?
    there are a couple ways to skin this cat:
    1)simply allow juopunutbear to install its patched hboot. this will let you use fastboot flash and fastboot boot if you are used to these commands.
    2)as a PH98IMG file. splash images,recoveries,hboots,or any other firmware can be changed by packing up the images,along with an android info text document, into a zip file,that is then renamed PH98IMG,placed on the sd card,and updated in hboot.

    *how do i change splash screen or fimrware?

    *how do i downgrade to an older build version?

    donate to my device fund :)
  3. scotty85

    scotty85 Guides Guide

    DO NOT turn your secureflag on unless on a stock,signed hboot.

    s-on with an eng signed or patched hboot will hard brick your device immediately.
    (read: permanently bricked,unrecoverable)

    in other words,ONLY use the writesecureflag 3 command AFTER running an RUU. never before.

    im sure were mostly to excited to want to go back to s on just yet,since we just got s-off :eek: but its a matter of time before this comes up,so here ya go:

    *if you have a relocked status in hboot,we now have the technology to change that. reference this thread: http://androidforums.com/rezound-all-things-root/659453-how-reset-your-lock-status-flag.html and flash lock_bootloader in recovery. verify you are back to locked in hboot,then procede with the following steps to restore stock software and s-on:

    1)donwload and run an RUU for the most current build(currently 4.03.605.2)
    2)open a cmd window. plug in phone,charge only mode,usb debugging on.
    3)run the following:

    cd c:\mini-adb_vigor

    adb devices

    adb reboot bootloader

    fastboot devices

    fastboot oem writesecureflag 3

    fastboot reboot-bootloader

    *verify you are locked s-on

    fastboot reboot

    Code (Text):
    1. Microsoft Windows [Version 6.1.7601]
    2. Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    4. C:\Users\Scott>[COLOR="Red"]cd c:\mini-adb_vigor[/COLOR]
    6. c:\mini-adb_vigor>[COLOR="red"]adb devices[/COLOR]
    7. List of devices attached
    8. HTxxxxxxxxxx    device
    11. c:\mini-adb_vigor>[COLOR="Red"]adb reboot bootloader[/COLOR]
    13. c:\mini-adb_vigor>[COLOR="red"]fastboot devices[/COLOR]
    14. HTxxxxxxxxxx    fastboot
    16. c:\mini-adb_vigor>[COLOR="red"]fastboot oem writesecureflag 3[/COLOR]
    17.                               ... OKAY [  0.051s]
    18. finished. total time: 0.051s
    20. c:\mini-adb_vigor>[COLOR="red"]fastboot reboot-bootloader[/COLOR]
    21.      rebooting into bootloader... OKAY [  0.177s]
    22. finished. total time: 0.177s
    24. c:\mini-adb_vigor>[COLOR="red"]fastboot reboot[/COLOR]
    25.                      rebooting...
    26. finished. total time: 0.168s
    28. c:\mini-adb_vigor>
    *verified working if you need it for warranty. :)
    acoastal, undone98, DaveHiro and 5 others like this.
  4. scotty85

    scotty85 Guides Guide


    i feel all the new rooters need to see this:

    please be careful!

    after s-off,you can now have complete control of your phone. you can change whatever you want since its not doing ANY security checks at all. as such you have a much greater responsibility to know what your flashing and why,and that your files are 100% unmolested and uncorrupt.

    please be aware that a bad bootloader or radio flash can and will brick your phone,possibly beyond recovery.

    you do not any longer have the s-on safety net of htcdev.

    on the other forums,im seeing alot of flip-flopping bootloaders around,and most folks dont even know why they want the eng hboot.please think about this.its risky- flashing a a new bootloader is prolly THE biggest risk you can take on your device,as without a bootloader NOTHING will load. i.e.,you have a brick. if your current bootloader suits your needs(ie boots youre phone and supports the fastboot commands you regularly use) then why are you changing it? :confused:

    s-off is awsome,i know :D but again,i just want everyone that has been asking various question to realize the the seriousness that having this privelege is. have fun flashing roms and slpash screens,but be extremely cautious/careful with the important parts of your device.

    -make sure you know what your flashing,and why
    -make sure you have an md5 summer and use it.
    -if you just asked "whats an md5??" then learn it ;)
    -make sure you are comepletely comfortable with all procedures for things you do.

    last and not least,please ask any questions BEFORE your phone makes a short lil buzz,shuts off,and wont come back on :eek:

    im not trying to scare anyone into staying s-on,i just want everyone to use caution and have safe,happy flashing :)
    acoastal, al23, undone98 and 2 others like this.
  5. mtbhk44

    mtbhk44 Well-Known Member

    You're a good man Scotty
    scotty85 likes this.
  6. chknhwk

    chknhwk Well-Known Member

    scotty85 likes this.
  7. scotty85

    scotty85 Guides Guide

    added to the faq,and a very imortant disclaimer.

    ill finish out the blank ones after work or tomoro. please feel free to let me know if theres anything else youd like to see in the faq,or any other questions. :)
    GodofBore likes this.
  8. howardz2

    howardz2 Active Member

    I use the stock hboot.

    Until such time that there is some concrete documented advantage to use an ENG or modified hboot, I'll continue to use the stock hboot.

    Scotty, good thread.

    scotty85 likes this.
  9. scotty85

    scotty85 Guides Guide

    the only advantage of a patched or eng hboot to 99% of users is the fact that it lets you use "fastboot boot" and "fastboot flash".

    with a stock,locked hboot,these commands are not available,and one must install things a PH98IMG files rather than fastboot flashing them. its not a huge deal... especially since PH98IMG files can be installed in fastboot as RUUs without having to mess with the sd card or correct naming :D

    its all about what a person is comfortable with.

    i run stock hboots as well,but keep them unlocked so i have the above commands available. for most folks i dont reccomend this,as you cannot go back to locked without turning s-on,then s-off again :eek: its not a big deal to me,as i have no factory warranty. but for folks that do,they want to preserve the locked status,so unlocking is not a good option.

    every now and then if i want to tinker with something,ill flash the eng hboot,but again,thats not something most folks will ever need(or should) do. ill flash a stock hboot back after im done.
  10. synergy7

    synergy7 Well-Known Member

    ok i am so confused. Ive read and reread the guides on s-off and s-on, rooting, unlocking....im lost...

    My end goal is to flash a new rom and kernal on this Rezound. Ive done rooting and flashing before. But, ive never dealt with s-off and s-on. Ive read about it. I understand what it is.

    So, basically, i think i need to unlock the bootloader. Isnt that the same thing as S-off?

    Do i need to flash a new bootloader so i have fastboot?

    T_T . I thought i was pretty good at this until i walked into the htc world :p

    Any help clarifying things would be great. Im usually fairly good at building up an understanding, but this Hboot, boot loader, s-off stuff has me spinnnnnnning :D
  11. scotty85

    scotty85 Guides Guide

  12. Brent372

    Brent372 Well-Known Member

    Sorry if this was covered and I missed it, but where do we obtain this?
  13. scotty85

    scotty85 Guides Guide

  14. JTAC

    JTAC Member

  15. scotty85

    scotty85 Guides Guide

    ther RUUs are either a .exe file run on the PC with the phone plugged in,or installed in hboot as a PH98IMG. they are not flashed in recovery.

    what firmware are you on? might try going back to gingerbread if on ics and see if that helps.
    -run GB ruu
    -select clear storage option in hboot
    -reinstall recovery and root,if desired

    you may even try installing the stock recovery,or running the NEWEST ics leak,and then choosing the clear storage option there.

    poor battery life may be coming from the phone having a hard time with 3g/4g,wich is the result of bouncing around firmwares, and should be fixed with the clear storage option.

    ive been on ics since the leaks started,and have never had any worse battery life than i had on GB. with the newest leak,i think its actually better. :)
  16. undone98

    undone98 Well-Known Member

    a few quick questions

    first where would the best stock rom for this be?

    and second i'm still a little fuzzy on where to find the md5 i'll be checking against

    EDIT: actually downloaded the zip file for s-off and found the md5's so i get that part

    but i am still looking for clarification as to what classifies as a stock for ics and where the best place to obtain it is
  17. scotty85

    scotty85 Guides Guide

    if youre looking for a stock rom to do the wire trick and s-off,you are misunderstanding... you just need to be on a stockish rom(lots of folks done it on cleanrom) and you can be on ICS or GB as long as you download the appropriate control bear. the important thing,is that root access is needed,so wether your stock GB or ICS,you must be unlocked and rooted

    if youre looking to return an s-off phone s-on for warranty,you need to run the current release firmware,wich is at this time 2.01.605.11 :)
  18. johndawg57

    johndawg57 Member

    Okay just so I'm clear, I found this thread too late to see that I should not have unlocked after s-off and now I probably have to send this phone back, does all kind of wierd things on any ICS build, sensors turn off, phone won't hang up, runs painfully slow. So the closest I can get to stock is going to be: Gingerbread, s-on, relocked, correct? No locked achievable?

    After I flash the Gingerbread RUU, I assume it will still be unlocked? If so do I set back to relocked before or after s-on or does it matter?

  19. scotty85

    scotty85 Guides Guide

    do you still have prollems on gingerbread? thats the beauty of s-off,youre not stuck on ICS.

    just run the ruu for 2.01.605.11 and then "clear storage" in hboot prior to replacing the stock recovery.

    but without turning s-on,then s-off again,yes,relocked is the best you can get.
  20. johndawg57

    johndawg57 Member

    I don't know if I will still have problems on Gingerbread, I will find out when I flash it today, I am going to guess I will have the same issues, I have tried a couple different ICS leaks and ROMS now after I started having problems and they always come back and are always the same problems, it is interesting though, the phone works great for usually an hour or two after flashing a new ROM then starts screwing up till it's unusable.

    On the other point, so I could

    1. Flash to Gingerbread
    2. Set S-on
    3. Do the wire trick again and get S-off

    At that point I would be "locked" and then I could reset back to S-on and be 100% stock?
  21. scotty85

    scotty85 Guides Guide

  22. johndawg57

    johndawg57 Member

    Outstanding, I am back to Gingerbread, locked and s-on. Last question, I rooted after installing GB because juopunutbear says it needs for the wire trick, I thought I lost root last time after going s-off but not this time so now what is the best way to "unroot" it?
  23. scotty85

    scotty85 Guides Guide

    run the 2.01.605.11 RUU :)
  24. nasboy

    nasboy New Member

    Fantastic guide. Im coming over from the thunderbolt, much easier to s-off. Had a few questions. Does the juopunutbear work with the ics ota? If not what is the best way to revert back?
  25. johndawg57

    johndawg57 Member

    It should, I've tested it on the ICS leak that came out just before the OTA and it worked no problem. Just a tip for s
    nasboy likes this.

Share This Page