yashsingh1/xdaforums huggingface dataset:
[One (M7) Original Android Development] mugetsu666:
Actually u can put it into ruu mode and flash it with a locked bootlaoder and like I said it's not an official fw package it's a custom fw and on top of that only one person was able to get s-off. I have has a couple others flash the firmware and the rom but still not gain s-off because the patch was already applied and I'm sure if the others that flashed the firmware were already s-off they wouldn't report back to me that they didn't have any success. Thank you sir.

androidtechy.com/Team-nocturnal/droidnow.com
[One (M7) Original Android Development] zipsnet:
[MENTION=4282187]mugetsu666[/MENTION] so once you upgrade .11 there's not turning back ... even if you downgrade back to .8 ?? my version-main was upgraded to.11 and downgraded to .8 I have tried for long hrs and no luck :(

-Z
[One (M7) Original Android Development] mugetsu666:
Yeah man, once the update has been taken to .11 it applies the exploit patch and so far I've only had one lucky person to do it and I actually think he was on .8 firmware put running my .11 rom so he was actually able to flash everything and gain s-off before updating. I wish I had another phone I could do some testing on but both of mine are s-off and so is my wife's. One of them is the AT&T version in mint if someone has a tmobile mint version I'd love to trade, but it has to be mint.

androidtechy.com/Team-nocturnal/droidnow.com
[One (M7) Original Android Development] alcaron:
It is really irritating that HTC gives you "developer" access and you jump through all the hoops, but then they hid S-OFF still, what possible point could there be? You made me agree to a bunch of disclaimers now let me do what I want with the phone already...
[One (M7) Original Android Development] cubitusclaudius:
HBOOT 1.54

Hi, can somebody indicate me how to s/off with HBOOT 1.54 ?
[One (M7) Original Android Development] dgtiii:
You can't yet
[One (M7) Original Android Development] cubitusclaudius:
Well after a good search I found this :

But still waiting for things to change...:cool:
[One (M7) Original Android Development] donmarkoni:
What "good search"?! You just had to look at the OP. It is written in big bold red letters you cant s-off with 1.54
[One (M7) Original Android Development] dreamer1212:
Hi, I got s-off and everything seems working, I removed the tampered flage and locked my phone again. However, once I turned my phone to s-on again, the tampered flage came again. I need to turn my phone back to pre-tampered state, because I need to have my camera changed for purple-tint problem. So can revone serve my purpose or have the tampered flage on is the best option I can have?

Thanks
[One (M7) Original Android Development] manups4e:
hi :) just a simple question...why can't we just flash 1.44 hboot to use revone? i mean go to fastboot and type "fastboot flash hboot hboot.img"
[One (M7) Original Android Development] EddyOS:
Simple answer: You can't without S-OFF
[One (M7) Original Android Development] cc999:
Wow

Its been said a million times already:

Once on 1.54 with S-on you CANNOT S-off...........

CC
[One (M7) Original Android Development] spaboleo:
There is no other way than using htcdev yet :(
[One (M7) Original Android Development] Theshawty:
Yes!

WAIT.
[One (M7) Original Android Development] Sloth:
+100000000
[One (M7) Original Android Development] horsetastic:
Lol, how people manage to miss not only the OP but everything else quite literally everywhere saying there's no way to S-OFF hboot 1.54 is beyond me!!

I'm on 1.54 and actively trying to hack the sucker, but I'm under no illusion that it's going to be possible. Man people need to read more! lol!
[One (M7) Original Android Development] Theshawty:
Just keep at it buddy and you'll succeed eventually! :good:
[One (M7) Original Android Development] dgtiii:
Are you completely back on stock, including recovery and no root? Something is tripping the Tampered flag.
[One (M7) Original Android Development] mugetsu666:
Well with the One, the unlock is a little more open. You can flash any and you don't have to flash the kernel separately, it's an all in one flash again. You can flash radios and do almost anything but supercid and change your splash screen or back track. Now u can flash firmware an somewhat do a back track but it won't change an exploit being patched. I hope that helps some.

androidtechy.com/Team-nocturnal/droidnow.com
[One (M7) Original Android Development] Theshawty:
Yeah we should be lucky HTC let us unlock as much as we can with the One. I read that on previous HTC's, you had to flash kernels separately in fastboot because they wouldn't flash in any recovery. Now can also flash radios.
[One (M7) Original Android Development] mugetsu666:
Oh man please don't make me relive those days. Lol, yeah it was hell, but we had some devs that come up with wonderful apps and such that made it a little easier, but man it was a pain and I can't even remember if we ever got radios to flash until we got s-off. Don't miss those days

androidtechy.com/Team-nocturnal/droidnow.com
[One (M7) Original Android Development] horsetastic:
Haha maybe, maybe not.... Long as I don't totally foooook my phone I'm happy to keep trying and playing etc....

I mean I've tried sticking revone and it's s-off commands in to an OTA update file and altering the updater-script to run it, I've tried two flashable zips, first one runs revone -P under busybox and the second runs revone -s 0..... I've tried hex editing the version of a 1.44 hboot within an ota and zip..... But so far nothing has done it hahaha.....

And I haven't bricked either lol.....YET!

And before all the devs jump on me here for hex editing hboots etc blah blah..... My phone, my choice. Plus if I manage to crack it you'll all be wanting my help so :p lol
[One (M7) Original Android Development] donmarkoni:
Well, as you tried everything, did you actually try dd to copy s-off'ed partition 3 to yours? I read that is impossible, and I believe it is, but there is a worm of doubt. :cyclops: I haven't seen anyone tried and posted results afterward.

I am willing to give mine s-off'ed p3, although I know it contains IMEI and probably other stuff as S/N, etc... Also, is there any other partition that should be flash with p3, to mach IMEI's and S/N's?
[One (M7) Original Android Development] horsetastic:
I was actually messing with dd'ing almost all the partitions ages ago when trying to crack the simlock code......It is not possible to dd flash p3, p4, p5, p12 etc etc......Basically any partitions that hold the 'good stuff' can't be touched by any standard route.

Edit.....Whether or not it could be possible to flash over the top using an elevated methed however I don't know.... Didn't even think to try it before to be fair.....hmmmm.... Now you've got me thinking. However I have a feeling that the WP on the partitions in question is set at a very low level boot stage to even flashing through fastboot or recovery they're already protected. I don't even think running busybox to write to them would work or it would have been done already.
[One (M7) Original Android Development] donmarkoni:
Tried fastboot flash zip p3soffed.zip in RUU mode? You can start by trying to flash p13splash in RUU, just to check out. No harm done if it goes wrong, I guess.

Anyway, I never updated any partition, so they are all from April. Well, all important ones, splash does not count. ;) So, if you want to try anything, I'll be around. :cool:

P.S. When I have a "great idea", I always think "is it possible that no one thought of it from billions of people?", but I think it's worth a try on a single case basis. So, everyone, please don't kick me in the nuts right away. :D
[One (M7) Original Android Development] mahesh_9j:
Awesome Job Team !!

Worked in first attempt. Now my developer edition is S-OFF with Super CID :)

Many Thanks !!
[One (M7) Original Android Development] descenpet:
worked on first try :D
[One (M7) Original Android Development] Theshawty:
If I've understood this correctly, the -l flag in -s 3 -l also locks the b/l so I'm both S-ON with a locked b/l? Sorry for the noobishness.
[One (M7) Original Android Development] dronepro:
happened after i did all this :) everything worked, even wrote a step by step for other that worked
[One (M7) Original Android Development] skinsfanbdh:
confirmed working s-off tampered removed and supercid on tmo usa running rayglobe 4.0.1:good: thanks a lot guys this is awesome and it worked first try:good:
[One (M7) Original Android Development] gunnyman:
that's I read it
[One (M7) Original Android Development] CheesyNutz:
i dont see how the "hack" would have anything to do with this
[One (M7) Original Android Development] dronepro:
"UID on the system are inconsistent, you need to wipe your data partition or your device will be unstable."

is what i am getting about 1 hour after doing this.

ideas?
[One (M7) Original Android Development] iElvis:
FWIW, I just got a call, so I doubt it's s-off.
[One (M7) Original Android Development] dronepro:
cool it if you can't help.
[One (M7) Original Android Development] Squirrel1620:
Hang on I need to change my underwear...

Ok I'm good now. Great work man, I can't believe how easy this is compared to what I had to do to get my HTC rezound s off :rolleyes:

Sent from my Tricked out HTC One
[One (M7) Original Android Development] iElvis:
So do a wipe and reflash ARHD? I don't think a TiBU restore would affect your UID.

Edit: Google seems to suggest fixing permissions in recovery might clear it.
[One (M7) Original Android Development] fallenangel408:
mine says unlocked/s-off/CID t-mob010/hboot 1.44.0000

*is that all correct? thanks everyone that helped me :highfive::good::laugh:
[One (M7) Original Android Development] monkboy24:
Well I'm good to go now. Nice and easy with my MacBook pro :o:thumbup:
[One (M7) Original Android Development] Garmig:
T- Mobile HTC One

Had to revert to 4.1.2 due to device not recognized with 4.2.2 ROM

Also i had to add .bin to the revone commands.

Success!

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb push revone /da
local/tmp/
cannot stat 'revone': No such file or directory

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb push revone.bin
ata/local/tmp/
2870 KB/s (646704 bytes in 0.220s)

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
root@android:/ # cd /data/local/tmp
cd /data/local/tmp
root@android:/data/local/tmp # chmod 755 revone
chmod 755 revone
Unable to chmod revone: No such file or directory
10|root@android:/data/local/tmp # chmod 755 revone.bin
chmod 755 revone.bin
root@android:/data/local/tmp # ./revone -P
./revone -P
/system/bin/sh: ./revone: not found
127|root@android:/data/local/tmp # ./revone.bin -P
./revone.bin -P
revone successful - please reboot to continue.
root@android:/data/local/tmp # reboot
reboot

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
root@android:/ # cd /data/local/tmp
cd /data/local/tmp
root@android:/data/local/tmp # ./revone.bin -s 0 -u
./revone.bin -s 0 -u
revone successful.
root@android:/data/local/tmp # ./revone.bin -s 0 -t
./revone.bin -s 0 -t
revone successful.
root@android:/data/local/tmp # exit
exit

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb reboot bootload

C:\Program Files (x86)\Android\android-sdk\platform-tools>
[One (M7) Original Android Development] smithwicks:
Update - Downloaded Android Revolution 10.1 and then started the S-OFF Guide all over again, and it worked.
[One (M7) Original Android Development] mojolive:
ADB on mac - 0S-10.8.4

Well I am by no means and expert but I thought for all the Mac people out there i would just share what I did to gain S-off

I am not responsible if you brick or destroy your device.. this is only written to use as a guide and might not work on yours, but it did work with no problems on my tel... Use at your own risk.

On mac: first read this link and follow it.. it will help you set up ADB on mac

credit to the following link for setting up adb on mac:

http://esausilva.com/2010/10/02/how-to-set-up-adb-android-debug-bridge-in-mac-osx/

basically it is as follows:

-Download the latest Android SDK from Google

-Extract the ZIP file to your desired location

-To get ADB, you need to install the SDK

-Open Terminal

-Type cd ~ this will take you to your home directory

-Type touch .profile this will create a hidden file named profile

-Type open -e .profile this will open the file you just created in TextEdit

-In the file, type export PATH=${PATH}:/pathToTheAndroidSdkFolder/android-sdk-mac_86/platform-tools

-Save file, close TextEdit, Quit Terminal, and Relaunch Terminal

-NOTE: By creating an environment variable you won’t need to cd to the Android/tools folder every time you want to run ADB

You are good to go, type in terminal adb devices, this should give you a serial number, which corresponds to your phone.

once you have done that you are good to go.

So i just followed the OP using the commands listed credit to the opening post::)

-Download revone

-Put the revone file you just download in "platform-tools" (adb folder)

-write all commands in your terminal window.

- write command: adb push revone /data/local/tmp/

- open a terminal window on your mac

- write the command: adb shell

- write command: su

- write command: cd /data/local/tmp

- chmod 755 revone

- ./revone -P

- open another terminal window

- write command: cd /data/local/tmp

- write command: ./revone -s 0 -u

- if successful reboot device manually into bootloader mode (holding power botton and holding down volume button

-check to make sure you have seen at the top of the bootloader screen S-OFF

- restart the device

- open new terminal window

write command: adb shell

- write command: su

- write command: cd /data/local/tmp

- write command: ./revone -t

-reboot photo into bootloader manually (hold powerbutton and volume down) until the phone boots into bootloader

TAMPER is not removed from your boot loader screen.

-restart tel.

to get supercid. do the following

-restart into fastboot mode. (on your tel)

- open new terminal window

write command: fastboot oem writecid 11111111

then you should have it..

this is just want i did.. hope it helps someone..
[One (M7) Original Android Development] Riyal:
Hi! Is the -u parameter necessary if your bootloader is already unlocked?

Referring to this command

Would be great if the revone file has a help parameter to list all the options with descriptions.
[One (M7) Original Android Development] skinsfanbdh:
yup looks sorta like mine except i got cid 11111111
[One (M7) Original Android Development] gunnyman:
Persistent
[One (M7) Original Android Development] DeSaint2:
So has anyone tried a Kansas city shuffle type way of breaking through security? I believe the zerg rush was what it used to be called. Make security look left while the write goes right? Don't know if it's viable but might be something to look into. Not a dev nor a hacker so idk how good the security is.

Also if security is set on real low level boot(not sure if someone could actually find this out somehow maybe with a tool on pc of some sort) could it be possible there is an exploit within the first short period of time before bootloader is loaded?
[One (M7) Original Android Development] daleski75:
I think the only way to get to write the p3 partition is to do a controlled corruption of the hboot afaik so that it then causes it to relinquish the secure flag allowing you to write to it.

Also some other htc phones could be put into this mode by touching some pins together but without a removable battery this will probably be impossible without ripping the phone apart.

s-off will probably be achieved at the same point I am selling my phone knowing my luck!
[One (M7) Original Android Development] cubitusclaudius:
I know I can be stupid as anyone here but I read :

but my question was about finding

another

solution than revone. but thanks anyway for all the useful and useless answers...
[One (M7) Original Android Development] horsetastic:
Could be worth a bash I guess....Though I might be more adventurous and try and flash p4 with supercid and see how that goes lol

---------- Post added at 01:55 PM ---------- Previous post was at 01:54 PM ----------

I have looked at zergrush but it doesn't seem to have been continued after gingerbread....I'm thinking that hole was patched a while back now. Not sure about the low boot stuff....I think that would be very hard to do without a DIAG
[One (M7) Original Android Development] daleski75:
Sounds like you are on a mission to become the first to crack s-off on hboot 1.54!!

I can swear I read somewhere that a guy on the moonshine thread hacked his phone from hboot 1.54 down to 1.44 but it was not an easy task if I find it I will dig out his post/username and maybe you can both get it working for revone.

Found it.

http://xdaforums.com/showpost.php?p=44397385&postcount=400
[One (M7) Original Android Development] horsetastic:
Already been in touch with him lol..... Not sure if I can do it. But by god I'm gonna try haha!
[One (M7) Original Android Development] daleski75:
Ahh well LOL, Just having a look through what he did to see if it looks feasible. Need a stock RUU though which might be hard to come by now.
[One (M7) Original Android Development] DeSaint2:
That seems sketchy at best. Maybe the moonshiners or revolution can make something out of it but he got very lucky it didn't brick.
[One (M7) Original Android Development] OllieD:
Anyone looked into the source code for wpthis.ko.

On the Desire Z they wrote a kernel module that power cycles the emmc chip. This means the chip is rebooted without the write protection enabled.

Although the emmc driver in the kernel could be handling the write protection. In which case we would need to exploit that.
[One (M7) Original Android Development] RuckusDecay:
Well what about if we DD to the partition of the hboot it's still 1.44
[One (M7) Original Android Development] daleski75:
DD will only work to that partition with s-off and the version of hboot makes no difference of you are still s-on
[One (M7) Original Android Development] RuckusDecay:
Seems he used the su cid which skip the error12 for security check. Which I'm guessing it's the only way. Got find a way to su cid I will be back and report.
[One (M7) Original Android Development] greengoldmello:
I have 1.44 HBOOT. I though it was possible to use revone with this one? I always get segfault
[One (M7) Original Android Development] DeSaint2:
If you took any of the most recent updates on T-Mobile AT&T etc the exploit was patched.
[One (M7) Original Android Development] greengoldmello:
Is there any way to undo it? The HTC method of unlocking is really annoying.
[One (M7) Original Android Development] Theshawty:
If you took the .7 update, yes, but if you took the .11 update you're screwed.
[One (M7) Original Android Development] graffixnyc:
Do you mean while s-on? or while s-off as well? because I was able to flash the p3 partition when I was s-off when I was working on the Google Edition conversion like an idiot I came home really drunk and ran a script to flash all the partitions to my one forgetting to omit the p3, hboot and other important partitions. After I clicked and ran the script I thought "noooo!" hahah

Now my silver one has the imei and serial of the donor device. The odd thing is that the GE should be sim unlocked but it tells me it's sim locked. Good thing is I backed up the original partitions. Now I'm just waiting for a new s-off so I can reflash them. I had sent it in to HTC but they wanted 200 bucks to replace the mainboard. I told them nothing was wrong with the mainboard and they are full of it, that it just needed to be fully reflashed. I had them send it back to me. I've been using my black version but I really miss my silver. It was the first device I've ever messed up.. I think it was a combo of being drunk, thinking "I'm s-off I can fix it if something breaks", having two Ones and having a false sense of drunken confidence lol
[One (M7) Original Android Development] daleski75:
Meant whilst s-on
[One (M7) Original Android Development] Theshawty:
I am waiting for S-OFF so I can switch between the GE and Sense versions at my will and also because I like having complete control over my phone (with all the dangers following it).
[One (M7) Original Android Development] Brodad:
I'm not sure how this works exactly, so I'd love if someone more enlightened than me could explain it, but is there any way to remove the code for the tampered flag altogether? In other words, is there any way to permanently remove the possibility of a tampered flag from the bootloader?
[One (M7) Original Android Development] Theshawty:
Possibly with a little hex edit magic but the code for it has to be replaced with zeros (to fill up the space). If you simply remove the code for it, the hboot will become less in size (and if it only differs a single byte, you're gonna render a hard brick)
[One (M7) Original Android Development] DanOMac:
I'm also waiting!!!! Iv just installed modoco switch which is a good ROM for those who wanna try out GPE ROMs but still have the sense option.
[One (M7) Original Android Development] DeSaint2:
Not without using a modified hboot that makes it an unsigned hboot which then in turn defeats the purpose cuz you can't s-on without a signed hboot without bricking your phone.

Good idea though just not possible unfortunately.
[One (M7) Original Android Development] iElvis:
Yes, if you're s-off, there are tools available to mod that text and make it say whatever you want.
[One (M7) Original Android Development] PillowMetal:
True, with the HTC EVO 4G LTE, if you were stuck S-ON (not me) you had to flash kernels through fastboot, and couldn't flash firmware (radios, etc.) at all, You had to relock, flash stock recovery, take the OTA, then re-unlock from HTCDev, get root etc., just to get the latest firmware.

However, I am curious now how you can flash radio images and other firmware from recovery now. I understand you can flash kernels from recovery with commands in the updater-script like this:

package_extract_file("boot.img","/tmp/boot.img");
run_program("/sbin/busybox", "dd", "if=/tmp/boot.img", "of=/dev/block/mmcblk0p35");

So are you saying you can now also flash radios this way with HTCDev unlock by just referring to the correct mmcblk partition? Or is it done differently?

In the past even S-OFF phones had to flash image files (PJ75IMG.zip for example) from the bootloader (which can no longer be done on my HTC One due to the lack of an SD Card) or use fastboot rebootRUU. So this would be a big improvement if all images including firmware can be done from recovery.
[One (M7) Original Android Development] dgtiii:
You can use your method on the One, but there is a much simpler method. Reboot to RUU mode, and firmware can be flashed thru fastboot commands. Radios can be flashed straight thru recovery like any other file, as can kernels.
[One (M7) Original Android Development] mugetsu666:
Yep even with HTC unlock only on the One its u can do so much more than before

androidtechy.com/Team-nocturnal/droidnow.com
[One (M7) Original Android Development] PillowMetal:
Yes, I understand that I can use fastboot oem rebootRUU to flash images, and is my preferred method now that we can't flash from the bootloader with a PN072IMG.zip file without an SD Card. But my question was specifically how things other than kernels (as outlined in my example), like radios, can be flashed through recovery, which is much more convenient for those "low information" flashers out there, because it doesn't require a computer.

In other words, again, can you flash radios with dd commands within the updater_script, just like kernels, if you don't want the user to have to use fastboot rebootRUU?
[One (M7) Original Android Development] dgtiii:
http://xdaforums.com/showthread.php?t=2245615

Radios can be flashed via recovery without S-off on the One