[HTC One S] frickinjerms:
legit pseudo bootloader method

ok lets try this again...

i got the tamper gone and im back on the 1.06.0000 hboot with pseudo s-on so even though my device is s-off / unlocked / tampered.. my hboot says otherwise :D can you say warranty claim? :D

what i did was download this 1.14.0004-HBOOT that i got from this post thanks to blackwing182 and Opentang for telling me where to go and what to get and scotty1223 for the 1.14.0004 zip :)

now download my hboot zip attachment pseudo.zip at the bottom of the post here which is the 1.06.0000 hboot that i modded with fake s-on / *** LOCKED *** / blank disclaimer

and this was what i did

make sure you cd into the directory you put these files in!

adb reboot bootloader
fastboot oem rebootRUU
fastboot flash zip hboot_8960_1.14.0004.zip

this was the output

sending 'zip' (375 KB)... OKAY [ 0.266s]
writing 'zip'... INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOstart image[hboot] unzipping & flushing...
INFO[RUU]UZ,hboot,0
INFO[RUU]UZ,hboot,100
INFO[RUU]WP,hboot,0
INFO[RUU]WP,hboot,100
OKAY [ 3.469s]
finished. total time: 3.734s

then typed

fastboot oem boot

it then looked like everything went cray but don't panic

... INFOBoot/Recovery signature checking...
INFOsetup_tag addr=0x80400100 cmdline add=0xC02F3584
INFOTAG:Ramdisk OK
INFOTAG:skuid 0x2ED01
INFOTAG:hero panel = 0x2940043
INFOTAG:engineerid = 0x0
INFOTAG: PS ID = 0x0
INFOTAG: Gyro ID = 0x0
INFODevice CID is not super CID
INFOCID is T-MOB010
INFOsetting->cid::T-MOB010
INFOserial number: HT24DW404269
INFOcommandline from head: console=ttyHSL0,115200,n8
INFOcommand line length =713
INFOactive commandline: poweron_status=1 reset_status=0 board_vi
INFOlle.disable_uart3=0 diag.enabled=0 board_ville.debug_uart=0
INFOuserdata_sel=0 androidboot.emmc=true androidboot.pagesize=20
INFO48 skuid=0 ddt=20 ats=0 androidboot.lb=1 td.td=1 td.sf=0 td
INFO.ofs=328 td.prd=1 td.dly=0 td.tmo=300 imc_online_log=0 andr
INFOoidboot.efuse_info=FFSL androidboot.baseband=1.11.50.05.28 a
INFOndroidboot.cid=T-MOB010 androidboot.devicerev=3 androidboot.
INFObatt_poweron=good_battery androidboot.carrier=TMUS androidbo
INFOot.mid=PJ4011000 androidboot.keycaps=qwerty androidboot.dq=F
INFOAIL androidboot.mode=normal androidboot.serialno=HT24DW40426
INFO9 androidboot.bootloader=1.06.0000 androidboot.nledhw=0 zygo
INFOte_oneshot=off kmemleak=off rpm_debug.enable=0 console=ttyHS
INFOL0,115200,n8
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=local
INFOaARM_Partion[5].name=cache
INFOaARM_Partion[6].name=userdata
INFOaARM_Partion[7].name=devlog
INFOaARM_Partion[8].name=pdata
INFOaARM_Partion[9].name=fat
INFOaARM_Partion[A].name=extra
INFOaARM_Partion[B].name=radio
INFOaARM_Partion[C].name=adsp
INFOaARM_Partion[D].name=dsps
INFOaARM_Partion[E].name=wcnss
INFOaARM_Partion[F].name=radio_config
INFOaARM_Partion[10].name=modem_st1
INFOaARM_Partion[11].name=modem_st2
INFOpartition number=18
INFOValid partition num=18
INFOTZ_HTC_SVC_SET_DDR_MPU ret = 0
INFOsmem 90006000 (phy 90006000): TZ_HTC_SVC_UPDATE_SMEM ret = 0
INFOTZ_HTC_SVC_LOG_OPERATOR ret = 0
INFOTZ_HTC_SVC_ENC ret = 0
INFOTZ_HTC_SVC_DISABLE ret = 474079232 (0x1C41E000)
INFOjump_to_kernel: machine_id(3751), tags_addr(0x80400100), ker
INFOnel_addr(0x80408000)
INFO-------------------hboot boot time:25399 msec
FAILED (status read failed (Too many links))
finished. total time: 7.063s

yall should remember that from when we were getting s-off after the boot command :P

now the device won't boot into android it'll sit on your boot animation (it did for me anyway)

but after about 20 seconds or so you'll have adb access (hope you had adb debugging turned on :P)

so now type in

adb reboot bootloader

and presto you should be on a stock 1.14.0004 hboot without that malarkey tamper flag (i had to type the reboot bootloader twice because it regularly rebooted the first time.. YMMV)

now that youre in your bootloader again its time for some dejavu but with my hboot this time :D

fastboot oem rebootRUU
fastboot flash zip pseudo.zip

this was the output, just like before..

sending 'zip' (383 KB)... OKAY [ 0.266s]
writing 'zip'... INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOstart image[hboot] unzipping & flushing...
INFO[RUU]UZ,hboot,0
INFO[RUU]UZ,hboot,100
INFO[RUU]WP,hboot,0
INFO[RUU]WP,hboot,100
INFO..... OK
OKAY [ 3.375s]
finished. total time: 3.641s

and once again

fastboot oem boot

and the output looks like things went haywire again, but still normal so stay calm

... INFOBoot/Recovery signature checking...
INFOsetup_tag addr=0x80400100 cmdline add=0xC02E02E4
INFOTAG:Ramdisk OK
INFOTAG:skuid 0x2ED01
INFOTAG:hero panel = 0x2940043
INFOTAG:engineerid = 0x0
INFOTAG: PS ID = 0x0
INFOTAG: Gyro ID = 0x0
INFODevice CID is not super CID
INFOCID is T-MOB010
INFOsetting->cid::T-MOB010
INFOserial number: HT24DW404269
INFOcommandline from head: console=ttyHSL0,115200,n8
INFOcommand line length =737
INFOactive commandline: poweron_status=1 reset_status=0 board_vi
INFOlle.disable_uart3=0 diag.enabled=0 board_ville.debug_uart=0
INFOuserdata_sel=0 androidboot.emmc=true androidboot.pagesize=20
INFO48 skuid=0 ddt=20 ats=0 androidboot.lb=1 td.td=0 td.sf=0 td
INFO.ofs=328 td.prd=1 td.dly=0 td.tmo=300 hlog.ofs=632 un.ofs=69
INFO8 imc_online_log=0 androidboot.efuse_info=FFSL androidboot.
INFObaseband=1.11.50.05.28 androidboot.cid=T-MOB010 androidboot.
INFOdevicerev=3 androidboot.batt_poweron=good_battery androidboo
INFOt.carrier=TMUS andro
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=local
INFOaARM_Partion[5].name=cache
INFOaARM_Partion[6].name=userdata
INFOaARM_Partion[7].name=devlog
INFOaARM_Partion[8].name=pdata
INFOaARM_Partion[9].name=fat
INFOaARM_Partion[A].name=extra
INFOaARM_Partion[B].name=radio
INFOaARM_Partion[C].name=adsp
INFOaARM_Partion[D].name=dsps
INFOaARM_Partion[E].name=wcnss
INFOaARM_Partion[F].name=radio_config
INFOaARM_Partion[10].name=modem_st1
INFOaARM_Partion[11].name=modem_st2
INFOpartition number=18
INFOValid partition num=18
INFOTZ_HTC_SVC_SET_DDR_MPU ret = 0
INFOsmem 90006000 (phy 90006000): TZ_HTC_SVC_UPDATE_SMEM ret = 0
INFOTZ_HTC_SVC_LOG_OPERATOR ret = 0
INFOTZ_HTC_SVC_ENC ret = 0
INFOTZ_HTC_SVC_DISABLE ret = 474079232 (0x1C41E000)
INFOjump_to_kernel: machine_id(3751), tags_addr(0x80400100), ker
INFOnel_addr(0x80408000)
INFO-------------------hboot boot time:33225 msec
FAILED (status read failed (Too many links))
finished. total time: 4.547s

and once again it might not make it past the boot animation (i didn't but once again YMMV)

but just like before wait for a moment and

adb reboot bootloader

it only took one try this time and hooray you'll have a completely stock looking bootloader that is still all yours to torture :D

now you'll notice once you hit reboot that you still may not be able to get into android... NO BIG!

since these zip files formatted the cache in an ugly way, thats why it wont boot cuz android can't mount your cache anymore and gets pissed..

just go to recovery from your bootloader instead or if you were just so anxious that you went ahead normally..

adb reboot recovery

now itll say cant mount /cache this cant mount /cache that.. but whatever go wipe cache and dalvik anyway (disregard the errors it puts out)

then go to power off instead of reboot system and let it chill for a second or two and then turn her back on..

it will boot into android and rebuild your dalvik and done n done :D

so now the only way someone will know you are s-off is if they pull your hboot and sniff around the hex or key in

fastboot oem readsecureflag

it will come back as secure_flag: 0 which mean s-off :D

AND i just tried fastboot flashing a different version of twrp then rebooting my bootloader and the tamper flag didn't reappear! take THAT htc :D