yashsingh1/xdaforums huggingface dataset:
[One (M7) General] H377:
Hi Scotty,

First of all really thank you for your kind contribution to the scene!

I have a HTC One DUAL SIM M7C_DUG 802w HTC__032 HBOOT 2.27.000 OS:2.41.402.3.

Recently I was playing around with temproot but couldn't reach my goal I wanted to try if I can permanently root the device somehow from the ADB session. :) Just playing.... :D

Normally the temproot gives root privileges only within the ADB session you started it, nothing else - as far as I understood. I have to confess that I have mounted the system and root as RW and make some dirs but removed them. And even after a reboot everything was set back to normal: all the new files, dirs were removed. Due to the S-ON I guess...

And now the TAMPERED text is there. Even if the modifications are not on the flash anymore. Is this normal? I mean does the device check the modifications on the fly and if you change anything on the system partition or anywhere else it will flag the device as TAMPERED? I'm still S-ON, lock bootloader....

And I was wondering if I don't get the 4.4.2 OTA becasue of the tampered flag? Can this be?

If yes then I'm thinking of using the Firewater pack to achieve S-OFF and then remove the TAMPERED flag and maybe go back to S-ON to be able to receive the OTA someday.

Do I need anyway to go back to S-ON to receive the OTA? Or is it enough if the bootloader is locked?

Many thanks for your kind reply in advance!
[One (M7) General] scotty1223:
Yes,that is normal. The device does a number of signiture checks while booting,and write protections keep any changes from being permanent. The changes you tried to make triggered the tampered flag to be set. Running an ruu will reset the flag as well.

I would recomend to s off,and stay that way. S off in itself does NOT affect your ability to recieve OTAs. The biggest things that do affect an ota are running a custom recovery and removing carrier bloat. If you remain stock with s off,you'll OTA just fine :)

Having said that,being tampered will not affect your ability to ota,so you don't technically need to do anything.
[One (M7) General] H377:
Thank you so much for your kind help!

I tried to S-OFF with firewater but didn't succeed so I won't do anything yet....
[One (M7) General] scotty1223:
What device do you have? You are welcome to dump p3,upload it and pm me a link and I can take a look.
[One (M7) General] scotty1223:
You can always unlock your bootloader. You can then use firewater or rumrunner. The lock status can be changed as well afterward(to read locked,not unlocked or relocked)
[One (M7) General] H377:
My only problem is that I don't have any kind of RUU or at least a stock recovery for my device so this is the reason why I don't want to unlock the bootlaoder and flash a custom recovery and then root and then s-off. because then if anything happens I cannot go back to stock.... :(

Plus it would be great not to get in HTC's DB for sending me the unlock code... :) Just because of warranty issues....

I would like to manually bacup the stock recovery but no one could help me yet hot to do that.....
[One (M7) General] H377:
Do you know maybe how to mack a backup of the stock recovery? With the dd command? Or with something else?
[One (M7) General] thebott:
Will this work if my bootloader is locked? I am s-off.
[One (M7) General] scotty1223:
Sorry for the late reply, do you have a working means of temp root? If so, yes I can help you back up your stock recovery
[One (M7) General] scotty1223:
Yes, it will work just fine. The lock status is not relevant to the tampered flag. S off is the important factor
[One (M7) General] H377:
No problem!

Yes, temproot works just fine so I can get root privilieges in the ADB session...

Maybe it would be awesome to backup my whole device: hboot, system, etc... If you can help me...
[One (M7) General] scotty1223:
no,prollem :)

ive made a new thread for our discussion,so as not to complicate things here:

http://xdaforums.com/showthread.php?t=2658242
[One (M7) General] Akishima:
Waw, thanks for your tutorial man!

You're trick is totally awesome, I used both of your trick on how to unlocked/locked bootloader and this one on my Desire 601.

I successfully locked my bootloader and remove the tampered flag.

Thanks a bunch man! :good:
[One (M7) General] spider84a:
I have very important question to you guys. After doing the S-ON and LOCKED what is the possibility of geting TAMPERET FLAG?
[One (M7) General] scotty1223:
Run an ruu is your only option.
[One (M7) General] spider84a:
I have done LOCKED and S-ON after i have instaled with success:

RUU 1.28.401.x > Change CID to ORANGB10 -> CWM -> Restore of branded nandroid backup (1.28.69.x) -> Flash stock recovery -> Lock bootloader using revone -l (so no relocked info - locked as it would be always like this) -> update process check (and little - ca. 1,5 MB - update installed without any problems) -> S-ON (fastboot oem writesecureflag 3).

After all above steps my bootloader was like this:

What happend today?TAMPERED flag got resurrected! Funny/sad thing was that when TAMPERED flag returned, my recovery disappeard and bootloader shows some weird securyti warning:

Why?
[One (M7) General] scotty1223:
now were getting somewhere. you prolly do not have a correct stock recovery,or some other bit of firmware or kernel does not match what the phone thinks it should have.

youll need to unlock the bootloader to get back to a working phone where you can deal with the tampered banner,try and find an ruu that will run,or return to s off.

personally i would return to s off and stay that way. even if you need warranty work,there is really no practical reason to turn s on.
[One (M7) General] Ma1Fia:
tnx OP, worked like a charm,
[One (M7) General] bornthor:
scotty, I'm sorry for sounding like a n00b if i am, but my device is s-off but won't boot so I can't use the adb commands. I can get into fastboot, is there a way to get into the adb shell via fastboot? or is there another way to unlock through fastboot? I am having trouble pushing RUU with it locked and I'm assuming its because I relocked it(i know that was dumb)
[One (M7) General] scotty1223:
If you can get to recovery you can use adb there
[One (M7) General] bornthor:
Can't get into recovery. I'm trying to unlock to recovery. When trying to get into recovery it goes to red triangle with exclamation in the middle.
[One (M7) General] scotty1223:
That's the stock recovery. You'll need to reinstall a custom recovery.
[One (M7) General] bornthor:
It's been giving me the error another guy in this thread was getting when it won't allow to push recovery through fastboot. It says remote not allowed maybe..I'm not at the computer right now.
[One (M7) General] bornthor:
I did get it unlocked again by chaning CID to get good token. Thanks again for the help. I knew I could do it this way but I am not experienced enough and thought it may cause other problems. I really appreciate XDA and developers like you that help as much as you do.
[One (M7) General] ragingredbull:
Thanks Scotty, worked a treat
[One (M7) General] xKelvz:
Hmm I did exactly what u taught on the first page and i found out the ***TAMPERED*** still there on my bootloader ==
[One (M7) General] scotty1223:
What device/variant do you have?
[One (M7) General] Forsaked:
Wrong Thread!
[One (M7) General] alberto888zz:
Removed, wrong forum! Sorry!
[One (M7) General] scotty1223:
This thread is for m7
[One (M7) General] devildog08:
Thx a lot M8,

Since Revone was not working I tried this and it worked perfectly.
[One (M7) General] jaspreet4140:
helppp

hlo sir,, I used ur given command to remove tampered and it worked for me first time but when I used unlocked command tampered came again and now no method is working ur command ,revone,guru unlock bootloader....only tampered is not going but all others also working fine...relock,ul,locked

helpppp plz
[One (M7) General] jaspreet4140:
ree

nobody helped me......scotty help plzz
[One (M7) General] scotty1223:
reread the OP,ive included directions on what you need to provide.

i was trying to add the directions, so i could edit the post above,you do not need to post multiple times.
[One (M7) General] jaspreet4140:
re

sorry for mistake.

I. hve htc one with

hboot-1.54

s-off

cid-11111111

main ver 2.24.980.3

rom- stock 5 sense 4.2.2....
[One (M7) General] SpineSurgery:
Hello,

I am on HTC ONE DUAL SIM (802W).

I successfully remove

"Tampered"

banner. But after few restarts, it's back :/

Any advice?
[One (M7) General] omaramiromo:
i am on my way to S OFF..
[One (M7) General] jaspreet4140:
help

heloo [MENTION=221956]Scotty[/MENTION] , when I first used ur tampered cmd it worked fine but when I used unlocked cmd tampered came again and now it is not going.....help....my getvarall is under....

(bootloader) version: 0.5

(bootloader) version-bootloader: 1.54.0000

(bootloader) version-baseband: 4A.25.3263.21

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main: 4.19.401.11

(bootloader) version-misc: PVT SHIP S-OFF

(bootloader) serialno: HT34LW909060

(bootloader) imei: 355859050864966

(bootloader) meid: 00000000000000

(bootloader) product: m7_ul

(bootloader) platform: HBOOT-8064

(bootloader) modelid: PN0714000

(bootloader) cidnum: 11111111

(bootloader) battery-status: good

(bootloader) battery-voltage: 3854mV

(bootloader) partition-layout: Generic

(bootloader) security: off

(bootloader) build-mode: SHIP

(bootloader) boot-mode: FASTBOOT

(bootloader) commitno-bootloader: dirty-5d4c562c

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0

all: Done!

finished. total time: 0.073s

E:\ccccccccccccccccccccccccccccccccc\ADB>adb devices

List of devices attached

HT34LW909060 recovery

E:\ccccccccccccccccccccccccccccccccc\ADB>adb shell

~ # echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988

echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988

1+0 records in

1+0 records out

1 bytes (1B) copied, 0.006135 seconds, 162B/s

~ # exit

exit
[One (M7) General] scotty1223:
The flag is set while s on whenevr the phone finds something not stock. There are several factors that can cause the flag to set,and prolly several we don't know. Your best bet is to run an ruu. However it is possible that something has been modded that is not restored by the ruu,wich is why the banner returns.

You may need to remain s off to keep the banner away.

This is unfortunately one of the risks we take when we root/hack/mod our devices
[One (M7) General] scotty1223:
Reread the OP. Follow the directions in "if this does not work for you"
[One (M7) General] jaspreet4140:
re

I read op [MENTION=3437245]scotty1223[/MENTION] 'if this didn't work' its not going then also
[One (M7) General] scotty1223:
You have not followed the directions. I can't check if you do not provide Wat I ask for
[One (M7) General] jaspreet4140:
re

[MENTION=3437245]scotty1223[/MENTION] I can't understand what u need ...plz tell me I will provide.....I read op also but don't knw wht need....as I already posted u getvarall with cmd progress....
[One (M7) General] AnGrY DuDe:
whats benefit for this i removed mine .but idk whats benefit :D
[One (M7) General] scotty1223:
the red is what you have not supplied.

if this does not work for you

*first reread this thread in its entirety. make sure you have met the prerequisites,and double check your code and make sure you have not forgotten a step,or screwed something up trying to type it (especially if using a terminal emulator),and check that you have not gotten any errors.

if youre still confident you did things correctly,you need to PM me:

1)the results of: fastboot getvar all

2)a link to an uploaded p7.

you get fastboot getvar all by:

-place phone in fastboot

-enter in fastboot getvar all right click,click mark,highlight in white,hit enter or right click to copy

you dump p7 by:

adb shell

su (if needed to get a #)

dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7

transfer the file on internal storage to your pc and upload it

im not trying to be a ****,but its not helpful to post "didnt work" if you screwed something up,or if your not willing to help find a solution. especially if others have found it to work on their same variant.

important:

from now on,i will need a copy of your cmd window as well if we want to get to the bottom of whats happening. some folks seem to be simply writing extra bytes,wich is screwing up the flag location. please make sure this shows an entire session,not just a last part where it looks correct. we cant figure it out if you only show part of what you did.
[One (M7) General] arooni:
thanks i tried this stuff but it doidn't work.
[One (M7) General] nkk71:
the tampered flag being gone :rolleyes:

which part of "if this does not work for you" section in the OP is so confusing?

you need to provide the necessary information, as mentioned (somewhere else):

sorry for the intrusion :angel:
[One (M7) General] scotty1223:
That was way nicer than I would have been(which is why I kept quiet ;) )
[One (M7) General] CamoGeko:
Worked great here on HBOOT 1.56, thanks a lot!
[One (M7) General] l_themis:
Work like a charm! Thanks a lot!:good:
[One (M7) General] Master Bricker:
This also worked great for me on two HTC One units with HBOOT 1.54 & HBOOT 1.56.

Thank you.
[One (M7) General] muneebrocks:
does this work with the sprint version?

I dont want to risk my device by trying this without confirming
[One (M7) General] v_superuser:
Hey, any help how this could be done on the HTC Desire 816. [MENTION=3437245]scotty1223[/MENTION] can you help me with it? Also I tried to flash my own compiled recovery and I got this error - This build is for development purposes only. Do not distribute outside of HTC without HTC's written permission. Failure to comply may lead to legal action.
[One (M7) General] scotty1223:
that text is the result of running a custom recovery and/or kernel. pm me results of:

fastboot getvar all

cat /proc/emmc

cat proc/partitions

and we will go from there what partitions to dump(prolly p3,p6,p7)
[One (M7) General] v_superuser:
Sent it few days back. No reply from you yet, i'm still waiting! :D
[One (M7) General] scotty1223:
Sorry, I have had a lot on my plate the last few days. Will try and take a look soon
[One (M7) General] sparulez:
i'll trying this tip ;)
[One (M7) General] sparulez:
Can i remove also ***UNLOCKED *** string ? thanks
[One (M7) General] scotty1223:
No. You cannot remove the banner entirely without hex editing hboot. You can change the flag so hboot displays "locked" without modding hboot.
[One (M7) General] MFOsaka:
It does. I just did it. It doesn't remove the red text from boot, but it does rid of the tampered flag. It now just says UNLOCKED.

I have hboot 1.57.
[One (M7) General] mohsen3893:
plz help

hi

i have a unlocked and rooted m7 device...and i need its warranty now but its android version is the last version 4.4.2 (sense 6)...does this topic work on my devise?

plz help me how i can restore its warranty?

can i downgrade to older version?
[One (M7) General] MrSm1th:
Will try this tonight on a m7_ul and hboot 1.57. Dont really mind the tampered text but ill try it anyway ;)
[One (M7) General] CamoGeko:
Good luck mate! :good:
[One (M7) General] jthatch12:
I successfully was able to use this method on HBOOT 1.57
[One (M7) General] CamoGeko:
Nice! :D
[One (M7) General] arses:
hi Dear

this is the information of Desire 816

dev: size erasesize name

mmcblk0p1: 00100000 00000200 "sbl1"

mmcblk0p2: 02000000 00000200 "pg1fs"

mmcblk0p3: 00004000 00000200 "board_info"

mmcblk0p4: 00ef7c00 00000200 "reserve_1"

mmcblk0p5: 00040000 00000200 "mfg"

mmcblk0p6: 017afc00 00000200 "pg2fs"

mmcblk0p7: 00040000 00000200 "sbl1_update"

mmcblk0p8: 00040000 00000200 "rpm"

mmcblk0p9: 00200000 00000200 "tz"

mmcblk0p10: 00008000 00000200 "sdi"

mmcblk0p11: 00400000 00000200 "hboot"

mmcblk0p12: 00500000 00000200 "sp1"

mmcblk0p13: 00100000 00000200 "wifi"

mmcblk0p14: 00008000 00000200 "ddr"

mmcblk0p15: 00100000 00000200 "dsps"

mmcblk0p16: 03c00400 00000200 "adsp"

mmcblk0p17: 00500000 00000200 "wcnss"

mmcblk0p18: 00800000 00000200 "radio_config"

mmcblk0p19: 00180000 00000200 "fsg"

mmcblk0p20: 04b00400 00000200 "radio"

mmcblk0p21: 00400000 00000200 "tool_diag"

mmcblk0p22: 00a00000 00000200 "custdata"

mmcblk0p23: 006ffc00 00000200 "reserve_2"

mmcblk0p24: 00100000 00000200 "misc"

mmcblk0p25: 00180000 00000200 "modem_st1"

mmcblk0p26: 00180000 00000200 "modem_st2"

mmcblk0p27: 01400000 00000200 "fataldevlog"

mmcblk0p28: 00001000 00000200 "debug_config"

mmcblk0p29: 00040000 00000200 "pdata"

mmcblk0p30: 00004000 00000200 "control"

mmcblk0p31: 00140400 00000200 "local"

mmcblk0p32: 00010000 00000200 "extra"

mmcblk0p33: 00100000 00000200 "cdma_record"

mmcblk0p34: 00000400 00000200 "fsc"

mmcblk0p35: 00002000 00000200 "ssd"

mmcblk0p36: 00040000 00000200 "skylink"

mmcblk0p37: 01900000 00000200 "carrier"

mmcblk0p38: 01e00000 00000200 "devlog"

mmcblk0p39: 00e28800 00000200 "reserve"

mmcblk0p40: 01000000 00000200 "boot"

mmcblk0p41: 01000000 00000200 "recovery"

mmcblk0p42: 11000000 00000200 "cache"

mmcblk0p43: 90000000 00000200 "system"

mmcblk0p44: 18000000 00000200 "userdata"

AND:

cat proc/partitions

major minor #blocks name

253 0 629148 zram0

179 0 7634944 mmcblk0

179 1 1024 mmcblk0p1

179 2 32768 mmcblk0p2

179 3 16 mmcblk0p3

179 4 15327 mmcblk0p4

179 5 256 mmcblk0p5

179 6 24255 mmcblk0p6

179 7 256 mmcblk0p7

179 8 256 mmcblk0p8

179 9 2048 mmcblk0p9

179 10 32 mmcblk0p10

179 11 4096 mmcblk0p11

179 12 5120 mmcblk0p12

179 13 1024 mmcblk0p13

179 14 32 mmcblk0p14

179 15 1024 mmcblk0p15

259 0 61441 mmcblk0p16

259 1 5120 mmcblk0p17

259 2 8192 mmcblk0p18

259 3 1536 mmcblk0p19

259 4 76801 mmcblk0p20

259 5 4096 mmcblk0p21

259 6 10240 mmcblk0p22

259 7 7167 mmcblk0p23

259 8 1024 mmcblk0p24

259 9 1536 mmcblk0p25

259 10 1536 mmcblk0p26

259 11 20480 mmcblk0p27

259 12 4 mmcblk0p28

259 13 256 mmcblk0p29

259 14 16 mmcblk0p30

259 15 1281 mmcblk0p31

259 16 64 mmcblk0p32

259 17 1024 mmcblk0p33

259 18 1 mmcblk0p34

259 19 8 mmcblk0p35

259 20 256 mmcblk0p36

259 21 25600 mmcblk0p37

259 22 30720 mmcblk0p38

259 23 14498 mmcblk0p39

259 24 16384 mmcblk0p40

259 25 16384 mmcblk0p41

259 26 278528 mmcblk0p42

259 27 2359296 mmcblk0p43

259 28 4587520 mmcblk0p44

179 16 2048 mmcblk0rpmb
[One (M7) General] nkk71:
my guess would be the above three partitions, you need to pull them and send them to [MENTION=3437245]scotty1223[/MENTION]

over PM
[One (M7) General] Vash63:
I'm having trouble on HBOOT 1.55. I can't figure out how to get supersu installed without flashing a custom recovery. "fastboot boot recovery.img" shows OK but then nothing happens. I just flashed the RUU that matched my current radio. Trying to get back to stock... if I do flash a custom recovery and then remove the 'tampered' flag, will I then be able to flash the RUU again and keep the tampered flag off?
[One (M7) General] abumaha:
no work dear here

(bootloader) version: 0.5

(bootloader) version-bootloader: 1.57.0000

(bootloader) version-baseband: 4T.29.3218.08

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main:

(bootloader) version-misc: PVT SHIP S-ON

(bootloader) serialno:

(bootloader) imei:

(bootloader) meid: 00000000000000

(bootloader) product: m7_ul

(bootloader) platform: HBOOT-8064

(bootloader) modelid: PN0710000

(bootloader) cidnum: HTC__102

(bootloader) battery-status: good

(bootloader) battery-voltage: 3872mV

(bootloader) partition-layout: Generic

(bootloader) security: on

(bootloader) build-mode: SHIP

(bootloader) boot-mode: FASTBOOT

(bootloader) commitno-bootloader: dirty-6d8a0b9b

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0
[One (M7) General] scotty1223:
you are s on. re-read the OP
[One (M7) General] lmcmil:
Will this work on my HTC One S?

Already searched but can't seem to find this in the One S forum.

Thanks in advance
[One (M7) General] scotty1223:
im fairly certain the flag is in the same general area. if you want to dump p7 for me i can take a look
[One (M7) General] lmcmil:
Already done it, thanks.

My problem was i couldn't change to SuperCID ( to S-Off the phone ) but already solved it ;)
[One (M7) General] Sloth:
No
[One (M7) General] nek46:
hi remove tampered my htc one m7

great job:good: thanks:laugh:
[One (M7) General] jamalsarwar:
Thanks Alot Brother Love You It Worked ;)

hahahahaha worked like a charm thanks a lot brother love you may God bless you :good::good::good::good::good:
[One (M7) General] thecasimir:
thanks, work fine on hboot 1.57
[One (M7) General] mick_soul:
Is it save to use on hboot 1.61 too?
[One (M7) General] nao2205:
hi, does not work for me....

(bootloader) version: 0.5

(bootloader) version-bootloader: 1.61.0000

(bootloader) version-baseband: 4T.35.3218.16

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main: 7.19.401.2

(bootloader) version-misc: PVT SHIP S-OFF

(bootloader) serialno: SHxxxxxxxxxx

(bootloader) imei: xxxxxxxxxxxxxxx

(bootloader) meid: 00000000000000

(bootloader) product: m7_ul

(bootloader) platform: HBOOT-8064

(bootloader) modelid: PN0710000

(bootloader) cidnum: 11111111

(bootloader) battery-status: good

(bootloader) battery-voltage: 4231mV

(bootloader) partition-layout: Generic

(bootloader) security: off

(bootloader) build-mode: SHIP

(bootloader) boot-mode: FASTBOOT

(bootloader) commitno-bootloader: dirty-0e2a13e5

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0

all: Done!

finished. total time: 0.070s

when i try this method:

C:\adb>adb devices

List of devices attached

SH39JW900987 device

C:\adb>adb shell

root@m7:/ # echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564

echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564

dd: /dev/block/mmcblk0p6: Permission denied

my device is rooted already.

some ideas?
[One (M7) General] alray:
Yep, you should try the right command :silly:

You're not writing to the correct partition neither to the correct location on it (this command is for the M8, look in the OP for the correct command for the m7)
[One (M7) General] steve32mids:
(bootloader) version: 0.5

(bootloader) version-bootloader: 1.61.0000

(bootloader) version-baseband: 4T.35.3218.16

(bootloader) version-cpld: None

(bootloader) version-microp: None

(bootloader) version-main: 7.18.161.51

(bootloader) version-misc: PVT SHIP S-ON

(bootloader)

(bootloader)

(bootloader)

(bootloader) product: m7_ul

(bootloader) platform: HBOOT-8064

(bootloader) modelid: PN0710000

(bootloader) cidnum: VODAP001

(bootloader) battery-status: good

(bootloader) battery-voltage: 4291mV

(bootloader) partition-layout: Generic

(bootloader) security: on

(bootloader) build-mode: SHIP

(bootloader) boot-mode: RUU

(bootloader) commitno-bootloader: dirty-7661b1d7

(bootloader) hbootpreupdate: 11

(bootloader) gencheckpt: 0
[One (M7) General] Kisakuku:
Not sure what you want to know, but definitely a good idea to remove your serial and IMEI from your post.
[Galaxy Note 3 Q&A, Help & Troubleshooting] bulyot:
suggest a free.best and light(doest hog resources app that ask passcode when opening certain applications like messages,facebook,settings,etc?..tnx
[Galaxy Note 3 Q&A, Help & Troubleshooting] Ry2mkk:
https://play.google.com/store/apps/details?id=com.sp.protector.free

I like the features in this one, if you set it, you can make the app pop up a - - - - app has stopped responding screen to which you hold down OK to gain access to the password entry screen for the locked app...
[Galaxy Note II Q&A, Help & Troubleshooting] DeeJay-DEFFI:
If i flashed or manually copied files to System/Apps and setting permisions, widget is not in widgets list. :(

And sorry for my English....