[HTC Sensation XL] cj chitwood:
I realize I'm in the wrong forum for my phone, but I just wanted to throw my two cents in here because we have a common goal.

I'm trying to S-OFF my Doubleshot (MyTouch 4G Slide), and I've stumbled across this writesecureflag thing too. But in reading your thread, I've noticed, that in a couple of spots the command was given

fastboot oem writesecureflag 0

and in others it was given

fastboot writesecureflag 0

The latter will FAIL. Apparently, the one of you who was looking for an answer did not catch that the person saying "it didn't work for me" (with a "command error" message) MISTYPED the command. Also, I noticed at one point someone posted "secuerflag" vs. "secureflag".

One thing you MUST be absolutely sure of if you're going to be modifying your devices is SPELLING as well as command syntax. If either is incorrect, you're GOING to get errors, or worse, the command will work as expected but perhaps with the wrong argument. If the incorrect argument is still valid, you could hose something and have no clue what you did because you'd have full success with the command, but it would successfully write data you didn't want written.

For your perusal, here are my outputs from the requested commands (keep in mind, I'm not running a Sensation):

fastboot oem h

[root@localhost platform-tools]# ./fastboot oem h
...
(bootloader) command list
(bootloader) checkSbl1
(bootloader) checkHWSecurity
(bootloader) keytest
(bootloader) heap
(bootloader) boot
(bootloader) reset
(bootloader) powerdown
(bootloader) rebootRUU
(bootloader) heap_test
(bootloader) rtask
(bootloader) task
(bootloader) enableqxdm
(bootloader) gencheckpt
(bootloader) readpid
(bootloader) writepid
(bootloader) readcid
(bootloader) writecid
(bootloader) readimei
(bootloader) writeimei
(bootloader) readsecureflag
(bootloader) writesecureflag
(bootloader) list_partition_emmc
(bootloader) load_emmc
(bootloader) check_emmc
(bootloader) check_emmc_mid
(bootloader) read_mmc
(bootloader) load_modem_emmc
(bootloader) get_wp_info_emmc
(bootloader) send_wp_info_emmc
(bootloader) get_ext_csd_emmc
(bootloader) get_sector_info_emmc
OKAY [ 0.037s]
finished. total time: 0.037s
[root@localhost platform-tools]#

fastboot oem readsecureflag

[root@localhost platform-tools]# ./fastboot oem readsecureflag
...
(bootloader) secure_flag: 3
OKAY [ 0.006s]
finished. total time: 0.006s
[root@localhost platform-tools]#

fastboot oem writesecureflag 0[.b]

[root@localhost platform-tools]# ./fastboot oem writesecureflag 0
...
(bootloader) doubleshot_init_sd, SD card already power on
(bootloader) sdcc_init_memory_device done
(bootloader) [FAT_ERROR] fat_open_file: can not find SMART_IO.CRD
(bootloader) [JAVACARD_ERR] SMART_IO.CRD cann't find
(bootloader) writesecureflag: Permission denied, value 1
OKAY [ 0.171s]
finished. total time: 0.171s
[root@localhost platform-tools]#

If it matters (again, not a Sensation), my HBOOT screen is as follows:

DOUBLESHOT PVT SHIP S-ON RL
HBOOT-1.44.0007
MICROP-0353
eMMC-boot
Jun 27 2011,14:08:29

What I believe is required here is something similar to (though I doubt identical) a Goldcard. Obviously, reading the output of the command, it's looking for a file called "SMART_IO.CRD" on the MicroSD card. Without that file, you can't write the flag.

I wonder, however, if it's looking just for the file to see that it exists, or if it needs something actually in the file. Frankly, if it weren't for other people reporting a failure, I'd not have even tried what I did here today. However, if I had spare phones and wasn't afraid of bricking, I'd try putting a blank file called SMART_IO.CRD on the SD and see if that lends any further hints in the output (such as perhaps searching for XML content or specific variables).

BTW, the "set" command via terminal emulator will help you zero. "set" returns a list of operating system variables and their contents, which have nothing to do with your bootloader or its S-ON/S-OFF flag because by the time your OS has variables your bootloader has already shut down.

Sincerely hope this helps someone -- it would be great to have a simple fastboot command to set S-OFF and gain permaroot without providing serial numbers to people I've never heard of before owning a MyTouch 4G Slide (not that I think they'd be dishonest, just that I don't know them or if they have any connections to HTC warranty dept). Of course, that's no better than going straight to HTC themselves with the device identifier data. Which, come to find out, even though the MyTouch 4G Slide is in the supported devices list, does not have the "get_identifier_token" command available in "fastboot oem" commands.

Regards

CJ