[HTC Wildfire S] munjeni:
All is in HTC partition (cid, imei, s-flag ...etc).

I think I found where s-flag lies in aria/wfs, its 0x480820 phys offset, its after imei offset 0x480800, it looks like:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000820 98 FE 32 54 00 00 00 00 01 00 00 00 CF A5 83 92 .ţ2T........ĎĄ.’

Why I think? Because offset to s-flag on emmc bassed device lies in mmcblk0p7 and s-flag offset is well known and looks like:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000800 98 FE 32 54 00 00 00 00 FF FF FF FF FF FF FF FF .ţ2T....˙˙˙˙˙˙˙˙
00000810 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000820 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000830 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000840 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000850 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000860 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000870 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000880 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000890 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000008F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000900 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000910 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000920 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000930 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000940 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000950 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000960 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000970 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000980 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000990 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
000009F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000A00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

so security on is 0x01 or security off is 0x00 after oxff data, so pay special attention to (.ţ2) string! that is htc partition of the aria or wfs, its have (.ţ2) string allso! So I think this: 98 FE 32 54 00 00 00 00 01 00 00 00 CF A5 83 92 have 0x01 and I think that 0x01 between T2 and DA is s-on !!!

No.human.beaing, I think you have good idea!