[HTC One S] bluebenno:
I have a TMobile with (downgraded to) hboot 1.06, 1.08ts radio and S-OFF. It did not flash via fastboot, still shows tampered and unlocked after my attempts.

mkdir TMP
cd TMP
unzip ../OTA_Ville_U_ICS_40_S_TMOUS_2.35.531.12-2.35.531.7_release_306848u5s8i4b18xs094yw.zip
unzip firmware.zip

# fastboot flash radio radio.img
sending 'radio' (34345 KB)...
OKAY [ 2.980s]
writing 'radio'...
FAILED (remote: not allowed)
finished. total time: 3.013s

# fastboot flash wcnss wcnss.img
sending 'wcnss' (5120 KB)...
OKAY [ 0.715s]
writing 'wcnss'...
FAILED (remote: not allowed)
finished. total time: 0.747s

# fastboot flash radio_config rcdata.img
sending 'radio_config' (0 KB)...
OKAY [ 0.142s]
writing 'radio_config'...
FAILED (remote: not allowed)
finished. total time: 0.175s

For future references, I save all the md5's...

# md5sum ../OTA_Ville_U_ICS_40_S_TMOUS_2.35.531.12-2.35.531.7_release_306848u5s8i4b18xs094yw.zip
cca668e517ac0be8306c604e7a43f0e9 ../OTA_Ville_U_ICS_40_S_TMOUS_2.35.531.12-2.35.531.7_release_306848u5s8i4b18xs094yw.zip

[root@hhh 0]# unzip firmware.zip
Archive: firmware.zip
warning [firmware.zip]: 256 extra bytes at beginning or within zipfile
(attempting to process anyway)
inflating: android-info.txt
inflating: boot.img
inflating: hboot_ville_1.14.0005_signedbyaa.nb0
inflating: radio.img
inflating: rcdata.img
inflating: recovery.img
inflating: wcnss.img
[root@hhh 0]#
[root@hhh 0]# md5sum *
0746b4f96db3631b0805da251c988e9f android-info.txt
e83588964ca99dba369e4d350d2552df boot.img
dacc8eab2f1a565d491fe582567ddb46 firmware.zip
44edc8b0eda79f5499d9dbd2fca7a2e5 hboot_ville_1.14.0005_signedbyaa.nb0
6d03e5be9cbdfe456dbcbb64cf0fea61 radio.img
f2d2d61f58a9f41324303c1362101cdb rcdata.img
4a4e3d77449a6bf1f2d8b9ee5a214424 recovery.img
1490d5147aa788c604135177f6017225 wcnss.img
[root@hhh 0]#

radio.img

# mount -o loop -t vfat radio.img /mnt
# ls /mnt
image MODEM.B02 MODEM.B07 MODEM_F1.B03 MODEM_F1.B07 MODEM_F1.B13 MODEM_F1.B23 MODEM_F1.MDT MODEM_F2.B03 MODEM_F2.B07 MODEM_F2.B13 MODEM_F2.B23 MODEM_F2.MDT
MDATA.CFG MODEM.B03 MODEM_F1.B00 MODEM_F1.B04 MODEM_F1.B08 MODEM_F1.B14 MODEM_F1.B25 MODEM_F2.B00 MODEM_F2.B04 MODEM_F2.B08 MODEM_F2.B14 MODEM_F2.B25 MODEM.MDT
MODEM.B00 MODEM.B04 MODEM_F1.B01 MODEM_F1.B05 MODEM_F1.B09 MODEM_F1.B21 MODEM_F1.B26 MODEM_F2.B01 MODEM_F2.B05 MODEM_F2.B09 MODEM_F2.B21 MODEM_F2.B26 RADIOVER.CFG
MODEM.B01 MODEM.B06 MODEM_F1.B02 MODEM_F1.B06 MODEM_F1.B10 MODEM_F1.B22 MODEM_F1.B29 MODEM_F2.B02 MODEM_F2.B06 MODEM_F2.B10 MODEM_F2.B22 MODEM_F2.B29

# md5sum /mnt/*
md5sum: /mnt/image: Is a directory
ed3fb5a6d4e06115f733746910c7331e /mnt/MDATA.CFG
4212f211660f904e776a7147ebc714bf /mnt/MODEM.B00
0a970960db74b24e07833fef35596993 /mnt/MODEM.B01
2b334560d8a48745050b6aee310cd490 /mnt/MODEM.B02
6ef98608f2e49fb55f72f4da5932089f /mnt/MODEM.B03
66557b0d0e160a9ed2f045cd3c1f6073 /mnt/MODEM.B04
fb37367e92d6c0188023beb387727ec0 /mnt/MODEM.B06
a2fe203af2ab82d9c182fadf059a873e /mnt/MODEM.B07
0cade6f85876909eaa856780f6e64268 /mnt/MODEM_F1.B00
751581083c77ff0374d44ea427d617ed /mnt/MODEM_F1.B01
6a210a29e843676eaf3e2c276773e606 /mnt/MODEM_F1.B02
98dbb06c42244a4275be4cb4e5bf324c /mnt/MODEM_F1.B03
d2977aadbad2986ae720afb08b56225b /mnt/MODEM_F1.B04
5b9a53d96b3852e23b8e14a932bb8e8c /mnt/MODEM_F1.B05
bae565bc385845e730347df331491051 /mnt/MODEM_F1.B06
71f4f900263c1c96f57fe73531cf442c /mnt/MODEM_F1.B07
6a8bf382be3d2df8fda0726e0bbb7fc7 /mnt/MODEM_F1.B08
5b4f2e5595431849e34118117f59304a /mnt/MODEM_F1.B09
1b78d37f8627c507d0a4f23c51b53f7c /mnt/MODEM_F1.B10
32cfa9bb441dc99750974cafc4ca234b /mnt/MODEM_F1.B13
447c1fca37c202e05330d243332f2b0d /mnt/MODEM_F1.B14
30a9d6a8f45597faa2288a3432cd7010 /mnt/MODEM_F1.B21
68d73ba97e2a7a440c97e16b3a9ed000 /mnt/MODEM_F1.B22
a55506862be5096d3c4250d4877ecb2b /mnt/MODEM_F1.B23
f8e80ec79567444666247cf12d68d5a4 /mnt/MODEM_F1.B25
6ff79aaa14e2b4ff96469cc72a108273 /mnt/MODEM_F1.B26
9b5345cc6516022fcea4691dfc7e772b /mnt/MODEM_F1.B29
9713a6578b15dcc6f59fb7ae467f7885 /mnt/MODEM_F1.MDT
1a25e70d6932eb7b0b3e302a26205244 /mnt/MODEM_F2.B00
f92ce637cec4935a95ec9781e6d4148f /mnt/MODEM_F2.B01
1652c79ef509d46816f85feedf35ee53 /mnt/MODEM_F2.B02
976aeaf87b1745ba7f322c5310a2e83c /mnt/MODEM_F2.B03
62ed3b9cb754ee3e0858cf32725fb042 /mnt/MODEM_F2.B04
dcaa38b7abbb04a7acf3d18e7b81f59e /mnt/MODEM_F2.B05
bae565bc385845e730347df331491051 /mnt/MODEM_F2.B06
71f4f900263c1c96f57fe73531cf442c /mnt/MODEM_F2.B07
94f8992326d2f7efae06f350f39f81d9 /mnt/MODEM_F2.B08
008083cfe601a50799bf49c86aead6c2 /mnt/MODEM_F2.B09
c172a002e426e8eb536367968b535988 /mnt/MODEM_F2.B10
3abc99ee5f821779f711a339dc5e4471 /mnt/MODEM_F2.B13
193ca32e6a5aa2e6d5c872e5f9548b68 /mnt/MODEM_F2.B14
30c5c776c548057546556f005b3112bd /mnt/MODEM_F2.B21
68d73ba97e2a7a440c97e16b3a9ed000 /mnt/MODEM_F2.B22
d9045d31a4b937ab1e58451212a13ea6 /mnt/MODEM_F2.B23
f8e80ec79567444666247cf12d68d5a4 /mnt/MODEM_F2.B25
be3c7b59f71be2221618c8d12e619843 /mnt/MODEM_F2.B26
05c5d793d3ebd84fce471abe9cf688f4 /mnt/MODEM_F2.B29
348ded456ea65ef6fef9de30a20847e1 /mnt/MODEM_F2.MDT
ad9b7f8617b17468bb1943797a416572 /mnt/MODEM.MDT
9dcf9d20a505f0567dc0dcf65ff890ac /mnt/RADIOVER.CFG

# cat /mnt/RADIOVER.CFG
SSD:1.13.50.05.25

wcnss:

# mount -o loop -t vfat wcnss.img /mnt

# ls /mnt
wcnss.b00 wcnss.b01 wcnss.b02 wcnss.b04 wcnss.mdt

# md5sum /mnt/*
84a7472b20e0b3af6453757552c8207d /mnt/wcnss.b00
d6068dc9434a48089033a65e147502e6 /mnt/wcnss.b01
7da2f96f44b8d25686403732da451afc /mnt/wcnss.b02
e4867c182ac1e1409c439a1a329de1cf /mnt/wcnss.b04
c726afbd8bd521af41eecbccb4a070da /mnt/wcnss.mdt
#

No idea on the radio config filesystem format:

# strings rcdata.img
QCT_UMTS_RADIO_VER=1
DisH=4
AGPSNVSetting=1
EnDTM=0
MSCMode=10
HSDPACat=24
HSUPACat=6
IMEISVN=17
GEA3=0
AGPSNVSetting=1
QCT_UMTS_RADIO_END=1
#

---------- Post added at 09:25 PM ---------- Previous post was at 09:04 PM ----------

at first I use force, when that doesn't work I use Violence. The Radio @ the bootloader now shows 1.13.50.05.25 ( still tampered and unlocked showing ). The HSDPA data+ (cat16) seems 10-20% faster.

Thanks heaps for posting this too. :good:

Boot into recovery (TWRP)

adb into phone and do a "mkdir /sdcard/2fl"

push files to phone:
# adb push radio.img /sdcard/2fl/
3431 KB/s (35169280 bytes in 10.007s)

# adb push rcdata.img /sdcard/2fl/
3 KB/s (141 bytes in 0.042s)

# adb push wcnss.img /sdcard/2fl/
3405 KB/s (5242880 bytes in 1.503s)

adb to phone:
# cd /sdcard/2fl

/sdcard/2fl # dd if=radio.img of=/dev/block/mmcblk0p17
68690+0 records in
68690+0 records out
35169280 bytes (33.5MB) copied, 9.181901 seconds, 3.7MB/s

/sdcard/2fl # dd if=wcnss.img of=/dev/block/mmcblkp19
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.169724 seconds, 29.5MB/s

/sdcard/2fl # dd if=rcdata.img of=/dev/block/mmcblkp20
0+1 records in
0+1 records out
141 bytes (141B) copied, 0.000336 seconds, 409.8KB/s

This is how to tell the partitions...

/sdcard/2fl # cat /proc/emmc
dev: size erasesize name
mmcblk0p23: 000ffa00 00000200 "misc"
mmcblk0p22: 00fffe00 00000200 "recovery"
mmcblk0p21: 01000000 00000200 "boot"
mmcblk0p33: 67fffc00 00000200 "system"
mmcblk0p30: 00140200 00000200 "local"
mmcblk0p34: 0ffffe00 00000200 "cache"
mmcblk0p35: 97fffe00 00000200 "userdata"
mmcblk0p26: 01400000 00000200 "devlog"
mmcblk0p28: 00040000 00000200 "pdata"
mmcblk0p36: 27be00000 00000200 "fat"
mmcblk0p31: 00010000 00000200 "extra"
mmcblk0p17: 02d00000 00000200 "radio"
mmcblk0p18: 00a00000 00000200 "adsp"
mmcblk0p16: 00100000 00000200 "dsps"
mmcblk0p19: 00500000 00000200 "wcnss"
mmcblk0p20: 007ffa00 00000200 "radio_config"
mmcblk0p24: 00400000 00000200 "modem_st1"
mmcblk0p25: 00400000 00000200 "modem_st2"
/sdcard/2fl #