yashsingh1/xdaforums huggingface dataset:
[One (M7) Original Android Development] cc999:
Developes

One correction is the Developers Edition is S-ON not S-OFF when purchased.

I know I have one.

CC
[One (M7) Original Android Development] prank1:
It has been awhile, and my knowledge is out of date but I think this is still correct...

There are two ways S-OFF is achieved, Radio S-OFF and S-OFF via a patched HBOOT.

The patched HBOOT is modified in a way that it will ignore the Secureflag and assume the phone is S-OFF, even if the Secure Flag says it's S-ON.

This kind of method for S-OFF isn't all fantastic since anything that overwrites/updates the HBOOT (such as in an OTA) can remove your modified HBOOT and replace it with another one which will see the Secureflag and go by what it says; S-ON.

I think in the Desire HD's early days its S-OFF was achieved via this method before it was Radio S-OFF'ed.

Radio S-OFF is the best kind of S-OFF since this actually changes the SecureFlag setting to S-OFF.

So you can have any HBOOT you want, even the latest official version, but when it goes to check the SecureFlag setting when you turn on the phone it will see it's set to S-OFF and so the HBOOT in return will give you S-OFF access.

The only way to change a Radio S-OFF back to S-ON is via the fastboot oem writesecureflag 3 command, which will change the SecureFlag back to S-ON.

I assume that RevOne achieves S-OFF via the Radio S-OFF method, because once you have S-OFF'ed your HTC ONE via RevOne you are free to flash any HBOOT you want and S-OFF remains. In fact newer phones that have Radio S-ON are designed to detected unsigned (patched) HBOOTs (i.e. the ones that are designed to fool the phone into thinking it's S-OFF) and 'hard brick' if they do, so I assume Radio S-OFF remains the only way now.

Now with OTA turning S-OFF phones to S-ON. The OTA would have to reset the SecureFlag to 3 (S-ON) which I don't think I have seen any OTA for any phone do. Sure it would certainly remove S-OFF via a patched HBOOT by flashing its own official HBOOT, but for the OTA to check the SecureFlag status and change it to 3 if it sees anything else is unheard of. Also this command is very dangerous and could brick your phone; if you are S-OFF'ed to begin with there may be other things that have been changed on your phone which might bugger up if you S-ON.

Generally I have assumed that if you are Radio S-OFF'ed (like the HTC ONE is) then you are going to stay on S-OFF no matter what you flash and the only way to get back to S-ON is by manually running the fastboot oem writesecureflag 3 command.
[One (M7) Original Android Development] RuckusDecay:
Exactly. You hit it right on the money. The OP should put this on the first post. The hboot really is nothing the radio is the important one. I was getting horrible signal like no 4g LTE or it would keep cutting off so I knew what was happening, the OTA RADIO'S. My hboot didn't change but I knew that s-on was on the radio dough so I knew I couldn't run revone. I'm just here patiently waiting. But seems good news is around the corner.
[One (M7) Original Android Development] sokoko:
So can somebody answer to me@!!!!!If i will do the HtcDev unlock and one day i want to return i to stock like: Locked and not tampered.Can i do it or it will always will be relocked and tampered?
[One (M7) Original Android Development] grim489:
If you relock and run an ruu it will say relocked. It won't say tampered anymore but it will say relocked
[One (M7) Original Android Development] OllieD:
If you are on HBoot 1.54 and they do not find a new exploit you will be stuck with relocked and tampered.

If you are on HBoot 1.54 and they do find a new exploit there is no guarantee that you will be able to undo the HTCDev unlock.

It would depend on the level of access the new exploit (if their is one) is capable of.

Long story short.

If you are desperate for root today and have HBoot 1.54 you will have to chance it or flip a coin. Personally I will be waiting hopefully for a way to unlock without using HTCDev.
[One (M7) Original Android Development] beats4x:
So with this knowledge here, could we flash am older radio and successfully run revone?

Sent from my Venom injected One powered by ElementalXKernel
[One (M7) Original Android Development] ilal2ielli:
If that was the case, a newer radio would overwrite the radio that you s-off'ed and going by the example posted, you'd lose s-off. Considering no one has lost s-off by updating radio, it doesn't sound like it would work.

Easy for someone to flash older radio and try though.
[One (M7) Original Android Development] russel5:
this not work, i try
[One (M7) Original Android Development] hotaru2k3:
the s-off flag isn't stored in the "radio" partition, but it is controlled by the radio.

if it's possible to downgrade the hboot and the radio, revone might work.
[One (M7) Original Android Development] DeSaint2:
I believe when you update a radio it only updates a portion of the radio partition. Another theory, which someone who is more knowledgeable than I could probably confirm, is that there are 2 separate partitions pertaining to the radio. One that houses connection data etc and one that contains the boot commands with the security checks. The latter makes more sense.
[One (M7) Original Android Development] prank1:
I will reiterate, once you have S-OFF'ed your HTC One it will stay S-OFF no matter what you flash.

The only way to go back to S-ON is to run fastboot oem writesecureflag 3

There is NO other way to go from S-OFF to S-ON.

Doesn't matter what radio you flash, it will NOT affect the secureflag status (S-OFF/S-ON)

Once you have set S-OFF, you can 'forget' about it and enjoy its benefits. The only reason to change back to S-ON is for warranty purposes.

Things you can safely do with S-OFF

- Install any HTC ONE RUU, upgrade/downgrade doesn't matter

- Install any version HBOOT even 1.54. Upgrade/downgrade doesn't matter. You can downgrade the HBOOT if you wish and retain S-OFF

- Install any Radio version

- Change 'RELOCKED' to 'UNLOCKED' or 'LOCKED' without HTCDev

- Change CID/MID

Any of these actions won't affect S-OFF

Once you have S-OFF, the only way to brick your phone is to botch up flashing the HBOOT (and/or radio too I think).

That's not including running the command fastboot oem writesecureflag 3 whilst on anything other than a signed official HBOOT
[One (M7) Original Android Development] PillowMetal:
I just S-Offed on the Sprint HTC One hboot 1.44 from May 8 using ADB, and wanted to share how I did it without being HTCDev unlocked or rooted, and without using terminal emulator (which most Sprint users are doing and requires unlock and root). Not only that, I did not even unlock through revone and therefore did not have to remove TAMPERED or UNLOCKED.

Even though you may have some errors along the way, you can save yourself a lot of time if you only repeat the steps that are necessary. Once you use ADB to push the revone executable to your phone (adb push revone /data/local/tmp) and ADB SHELL to set the permissions (chmod 755 revone), you do NOT have to repeat these steps ever again. All these commands do is get the file on your phone and set the permissions correctly to execute it.

That being said, I used the following steps after changing into the /data/local/tmp directory in the adb shell:

1. ./revone -P

As long as you're getting "failed to map memory" errors, just keep using up arrow and enter to repeat the command until you either get a "success" reported OR "error code = 2". Either way you will need to power off the phone with the power button held at this point (simulated battery pull), then press power to turn it back on. When the phone boots back up, if you had gotten the error code message, repeat step 1, if you had gotten success, move onto step 2.

2. ./revone -s 0 (note I did not use the -u parameter to unlock, because I am going to stay locked and use fastboot flash zip for flashing, which does not require you to be unlocked, only S-Off)

Again you may get "failed to map memory" errors, but just keep repeating the command until success or error is displayed. Reboot (power hold) and repeat as necessary. If you get an error code on this step, I am not sure if you need to start back over at step 1, because I didn't get an error code, but I did get failed to map memory, and just repeated the command.

At one point, I actually had successful S-Off reported after step 2, but when booting back into the bootloader it was still S-On, so I just rebooted and started over at step 1. The whole process took about 10 minutes.

I am now going to verify I have no problems flashing custom recovery and root while the bootloader is locked, then will take the 1.31 OTA. I can do this because even though revone does not work on the new hboot that comes with that OTA, once S-Off you no longer need to rely on revone to do anything for you. If worst came to worst, I could always RUU back to the older 1.29 with hboot 1.44 and stay there, because I'm S-Off!!.

Good luck, and I'll report back if I run into any problems flashing with a locked bootloader.
[One (M7) Original Android Development] maddie01:
And this will provide an exploit to SOff the HTC One that has 1.54 hboot?? For those that did OTA update and all locked out?
[One (M7) Original Android Development] PillowMetal:
partition mmcblk0p31 contains the radio (modem) and is flashed with "radio.img"

partition mmcblk0p17 contains the radio configuration and flashed with "rcdata.img"

partition mmcblk0p3 contains the S-On/S-Off flag, is named "pg1fs" and cannot be flashed with an image file.

Therefore, once you are S-Off, you remain S-Off for good.

Correct!
[One (M7) Original Android Development] hotaru2k3:
actually, you can write to the pg1fs partition with s-off, so you could go s-on that way. that's how the first version of revone had an option to go back to s-on.

but as long as you don't mess with that partition, what you said is correct.
[One (M7) Original Android Development] RuckusDecay:
Well I was thinking that since I'm on t-mo I have the 1.44 hboot the only thing that change was the radio i believe went from 4A.14.3250.15_10.34.1150.02L to 4A.17.3250.20_10.40.1150.04L.
[One (M7) Original Android Development] beats4x:
Same here. I was thinking about flashing the older radio until someone above me said there were three different partitions for the radio.
[One (M7) Original Android Development] Eschmacher:
I posted last night how I was getting a segmentation fault error. I rooted my phone and tried giving myself root before running ./revone -P, this time I got error code -6.

Any ideas?
[One (M7) Original Android Development] zounduser:
Are u on the 1.54 hboot?
[One (M7) Original Android Development] Eschmacher:
No, 1.44 but my software version is 1.27.531.11, which I've heard has basically broken revone for now.
[One (M7) Original Android Development] mugetsu666:
Yep if u took the update to get the latest tmobile version it's patched the exploit. I've has 3 out of 5 ppl report back to me about using my little trick a few pages back of flashing the .7 version and using the .8 firmware or below and then using revone, but 2 of the 3 where only on the official .8 so they only had to flash our .7 rom. If you wanna give it try, go for it but please let me know and if we get a few more successful attempts, I'll right up a full how to thread

androidtechy.com/Team-nocturnal/droidnow.com Sign up for [MENTION=310414]Copya[/MENTION]pp with this link, and we'll both get 5 GB of free cloud storage in addition to the usual 15 GB: https://copy.com?r=DrfOMd
[One (M7) Original Android Development] Gudio142:
It's been released few hours ago, but does it work for HTC One? And what does that exactly do with those devices?

Twitter: https://twitter.com/TeamAndIRC/status/366750399442591745

I can see it's an adb backup file.
[One (M7) Original Android Development] Mash23:
It's a root exploit. Let's see if it's any good for us.
[One (M7) Original Android Development] OllieD:
Root exploit does not seem to work for me.

The Cisco app doesn't crash like it's supposed to.

No root shell for me.

European HTC One.

HBoot 1.54
[One (M7) Original Android Development] daleski75:
Not sure if it would do us any good or are you thinking the root exploit would bypass the issue with motochopper?
[One (M7) Original Android Development] Tetsumi06:
You tell me.....

http://xdaforums.com/showthread.php?p=44529929#post44529929

----------------------o('_')o----------------------

Sent from an HTC One using xda app and Bulletproof TrickDroid ROM 8.0
[One (M7) Original Android Development] OllieD:
Yeah I was hoping a working root exploit may lead me to a method to s-off my phone.

If I could get a root shell I could investigate further.
[One (M7) Original Android Development] horsetastic:
Doesn't appear to do anything here...
[One (M7) Original Android Development] daleski75:
The problem is that no one has identified the root cause of the issue (no pun intended!) so it could be.

1. hboot

2. 4.2.2

3. root access

4. mixture of all 3

As no one knows (well besides the dev's but they aren't talking I am guessing) which part is failing it is very hard to say if gaining root access by another exploit would even work considering we can easily root our phones and type adb shell followed by su.

But if you get it working or get different behaviour post it here and I am sure everyone will do what they can to help you out.

---------- Post added at 11:05 AM ---------- Previous post was at 11:02 AM ----------

I think you are clutching at straws and probably not a good idea to keep posting this over and over across both threads about s-off.
[One (M7) Original Android Development] sokoko:
The thing is that even if you want just to root you need to unlock you bootloader.I dont want s-off for example only root for some mods.But still i must unlock with HtcDev .So if a root exploit would been found it should be enough?
[One (M7) Original Android Development] bgg71:
Did anybody get s-off on tmobile htc one on the last Rom ...531.11.

I would really appreciate if you could post your steps since mine fails with error code 6.

I flushed the RUU to ake sure everything is back to stock, then enabled USB debugging, unlocked boot loader flushed a custom recovery and rooted with Hansoon's tool and ran revone from root toolbox terminal. Tried also with adb from windows or from OS X.

No luck.

Thank you so much or any help.
[One (M7) Original Android Development] murtezahu:
so ive been trying this on cm 10.1 (latest nightly) thru terminal emulator... must have tried atleast 10 times, and when i do the ./revone.bin -P command, i get a reboot. anybody have any advice for me?

ps. my hboot is 1.44.0000
[One (M7) Original Android Development] bgg71:
Here is my hboot View attachment 2184162
[One (M7) Original Android Development] bgg71:
View attachment 2184178
[One (M7) Original Android Development] murtezahu:
ok... so here is how i got it to work...

i used command: ./revone -p

(note the lower case p; it then said invalid command, and the next line said action successful, from there i followed regular instructions, and i got s-off and removed the tampered flag)

hope this helps anybody else having the same issues i was.

cheers.
[One (M7) Original Android Development] bgg71:
That didn't work for me. When I continued with next command after reboot ( ./revone -s 0 -u) it failed with code 1. Actually do I need all of those? I am already unlocked. So perhaps just ./revone -s may work?
[One (M7) Original Android Development] trenzador:
this has finally worked for me, i'll add my tips from a noob perspective here.

Firstly if you can't understand the instructions and follow them through give up immediately.

I had the most succes with using capital P but small case s and u

I tried about 8 or 9 times before I achieved s-off and removing tamper came after s-off on first try.

I started to find things working smoothly when i went through the full load up of instructions each time. by this i mean i open the shell then i open the path then i load chmod as instructed then i use 'su' as i am rooted and unlocked then when i finally did this properly it seemed to work easy.

Thanks to the team for the work that goes into this.
[One (M7) Original Android Development] bgg71:
Would you mind telling us what device are you on? CID? MID? ROM? HBOOT?
[One (M7) Original Android Development] iElvis:
^^ This

The guys who built the GE conversion initially copied the entire partition map of a GE phone onto an s-off One, and thereby created an s-on GE (that didn't work because the IMEI was now wrong). Don't know if they were able to fix it.

http://xdaforums.com/showpost.php?p=43479462&postcount=158

But for 99% of users, writesecureflag is the only way to go back.
[One (M7) Original Android Development] jgeorge15:
I see nobody has quite answered your question yet, for us T-Mobile US users if we're S-On and have updated to the .11 or used the RUU to .11 there is no S-Off option for us yet, if people are reporting they were able to achieve S-Off after updating to the .11 I highly suspect that they are lying. Most likely they were on the .8 update and downgraded to .7 and S-Off. But from .11 even if you downgrade the ROM to .7 you cannot acheive S-Off. Since T-Mobile didn't give us the Original Stock RUU we have no way of downgrading everything, even though our hboot says 1.44 I suspect that they have either not been changing the number for the hboot or it has something to do with the upgraded opendsp, but whatever the case is you're stuck with S-On until they find an exploit for this or someone finds a way to downgrade everything back to how it was on .7

Hope this answers your questions
[One (M7) Original Android Development] bgg71:
Thank you. I sort of had a gut feeling that the answer was something like that. ;(

But at least I will not be trying again.
[One (M7) Original Android Development] mugetsu666:
Actually that's been answered a few times, that if took the update or updated period to .11 without s-off then ur sol, unless u want to try using the .8 firmware and flashing the .7 version u can attempt to try it. I know for a fact it's worked for one person and if you're on .8 without updating and having issues gaining s-off, then flash the .7

Rom by Team-nocturnal and you should be able to gain s-off with ease and I can confirm this with a 3 out of 3 attempts. Hope that helps more.

androidtechy.com/Team-nocturnal/droidnow.com Sign up for [MENTION=310414]Copya[/MENTION]pp with this link, and we'll both get 5 GB of free cloud storage in addition to the usual 15 GB: https://copy.com?r=DrfOMd
[One (M7) Original Android Development] mimin0:
I'm still puzzled by this :( Is this statement true or false:

if your phone has ever been updated to .11 without s-off then you can't gain s-off until a new exploit is found?

I'm currently on .7 by restoring nandroid backup of the t-mobile stock, but only after having been updated to .11. And revone keeps throwing error -6 just as with .11. So I kinda tend to agree with jgeorge15 that there is no hack as of today.
[One (M7) Original Android Development] mugetsu666:
Like I said u can attempt it after u have jumped the gun on the update, I can only confirm 1 person for this to have worked for AFTER TAKING THE UPDATE. If you have been on a custom rom or Haven't updated yet and u still have the old firmware on ur phone and are having issues with revone working, than flash the .7 version or use a backup and it should go smoother. I can confirm this from 3 out of 3 user attempts. Please read more carefully.

androidtechy.com/Team-nocturnal/droidnow.com Sign up for [MENTION=310414]Copya[/MENTION]pp with this link, and we'll both get 5 GB of free cloud storage in addition to the usual 15 GB: https://copy.com?r=DrfOMd
[One (M7) Original Android Development] RuckusDecay:
Where's this .8 firmware you guys use and also the Rom I would like to give it a go. Just want to use the same files and order and ser how it goes.
[One (M7) Original Android Development] suprano:
Guys, even if you revert back to .7, you won't be able to gain S-OFF. If you already updated officially to .11, then rooted, flashed custom and tried revone, it won't work. The only way to get it to work on .7 is to run a full .7 RUU but I have yet to find it myself. The issue is not with just the firmware version but other files (I'm not sure of) as well. I have personally tried several times to gain S-OFF by reverting back to stock to 're-root, running .11 RUU, downgrading back to .7 and so on. If there's is a .7 RUU somewhere, yeah that might help other than that..well idk. I've personally gave up gaining S-OFF until the developers come out with something but yeah, best wishes to whoever is still trying to gain S-OFF atm.

Root It & Boot It.
[One (M7) Original Android Development] Sloth:
How would flashing a rom based on .7 make it possible to get RevOne to work??? :confused:
[One (M7) Original Android Development] InflatedTitan:
Trying to s-on again. Tells me partition signature failed. Any thoughts?
[One (M7) Original Android Development] gartner83:
First thought...don't S-ON...ever:cool:. Unless you have to return it or sell it.

Second thought...you did use the "fastboot oem writesecureflag 3"?
[One (M7) Original Android Development] InflatedTitan:
Yessir. Exactly. And yea I'm sending it in for warranty. I've done it once before but not its signature failing. :confused:
[One (M7) Original Android Development] gartner83:
Are you locked? I think you should be locked at first.

./revone -l
[One (M7) Original Android Development] TabascoJoe:
I went S-OFF , did a full GE conversion, then went back to a stock ROM, but kept the GE radio and the Black GE Bootloader with 1.54. Not knowing that 1.54 broke S-OFF I went back to S-ON. Now I am stuck with this hybrid of a Stock/GE phone. Everything works, but I would like to go back to full stock. Is there any hope for my situation?

I have tired several RUU's , none worked. When I try a CID change I get this error:

(bootloader) [SD_ERR] The project does not support SD card

(bootloader) E0902910 E0902E20

FAILED (status read failed (Too many links))

finished. total time: 0.004s

Oh and my CID is the ATT CID.
[One (M7) Original Android Development] horsetastic:
Unless you physically typed in fastboot oem writesecureflag 3 then you should still be s-off....
[One (M7) Original Android Development] TabascoJoe:
I used the All-In-One Toolkit to S-ON, I assume that is using fastboot oem writesecureflag 3 to lock it.
[One (M7) Original Android Development] horsetastic:
Quite possibly...You could be in a sticky situation to be honest......I think you're best bet is to flash a custom ROM and wait for a new s-off exploit....
[One (M7) Original Android Development] TabascoJoe:
Another issue I have is that I received a replacement HTC ONE from ATT due to an unrelated issue. So I have to send back my old ONE. With it having the GE Bootloader with Tampered and Relocked, do you think ATT will make a stink?
[One (M7) Original Android Development] horsetastic:
I reckon so. However if they're sending you a replacement before hand then there's not much they can do lol....
[One (M7) Original Android Development] TabascoJoe:
Let's hope, since that phone cannot be full restored... Unless ATT has some other method to S-OFF and restore the bootloader.
[One (M7) Original Android Development] horsetastic:
Yes they will have a special repair centre that will be able to j-tag your device, or something similar....They'll have the diag files too. S-Off is easy for them haha!
[One (M7) Original Android Development] prank1:
Yes that's exactly what it does
[One (M7) Original Android Development] godutch:
Why would anyone in their right mind s-on an s-off device? You can send in your phone for warranty s-off just fine, just make sure you return to stock and lock the bootloader. I did that without any problems, of course n=1 but still...
[One (M7) Original Android Development] TabascoJoe:
Has anyone had issues or heard stories about ATT not accepting or charging for a modified Bootloader or ROM when doing an exchange?