[HTC One SV] Modding.MyMind:
FOR ALL K2 VARIANTS (K2_CL, K2_UL, K2_U, K2_PLC_CL)​

Advantages

- No more hassle with htcdev, tokens, or unlock codes

- No more submitting your phones personal info to htc

- The ability to get back to 100% stock without any visual traces or records of having been S-Off or unlocking your bootloader.

PLEASE PAY CLOSE ATTENTION TO THIS TUTORIAL AS I WILL SHOW YOU HOW TO CHANGE THE FLAG FOR LOCK, RELOCK, UNLOCK, AND TAMPERED!!

I INSIST THAT YOU READ ALL OF THIS BEFORE YOU TAKE FURTHER ACTION - IF YOU FAIL TO FOLLOW INSTRUCTIONS THE ONLY ONE TO BLAME IS YOURSELF. AFTER YOU HAVE READ THIS TUTORIAL AND COME TO UNDERSTAND THIS PROCEDURE THEN BY ALL MEANS GO AHEAD AND CARRY OUT THE NECESSARY STEPS TO ACCOMPLISH WHATEVER GOALS YOU MAY CURRENTLY HAVE AT THIS TIME.​

- This tutorial may be easier on the eyes if viewed by the actual web browser vice an app or phone device.

Many thanks to [MENTION=3142060]old.splatterhand[/MENTION] for being generous and providing me some files which allowed me to confirm this tutorial for all K2 variants.

Confirmed Working - Credits

Myself - K2_CL

[MENTION=5089229]russellvone[/MENTION] - K2_CL

Lordvincent 90 - K2_CL

[MENTION=5561514]DrBassman[/MENTION] - K2_CL

REQUIREMENTS FOR THIS TUTORIAL FOR THE PURPOSE OF LEARNING AND APPLYING IT

- This tutorial will be based on an already UNLOCKED Bootloader with TAMPERED flag

- Must be S-OFF

- Must be rooted

- Proper ADB and Fastboot files

- Hex editor (HxD)

- Knowledge of Hex and DD (aka - Data Destroyer)

If you do not know what DD is then please read the following which I extracted from WIKI for the simplicity of this tutorial - Otherwise, skip this and move along.

Let's get started shall we - the following commands highlighted in RED are your commands to execute:

- Go ahead and plug your device in to your PC with a USB cable.

- Open up CMD and change its directory to the location of your proper ADB and Fastboot files

- Establish a proper connection with your device. It should look something like this:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb devices[/B][/COLOR]
List of devices attached
HT3********* device

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>

- If connection is established then direct to your devices' adb shell:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb shell[/B][/COLOR]
root@android:/ #

- Go ahead and gain superuser rights to your devices' adb shell:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
root@android:/ # [COLOR="Red"][B]su[/B][/COLOR]
su
root@android:/ #

- Now we need to copy a partition (mmcblk0p7) to your sdcard using DD. Insure you do not make a typo:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
root@android:/ # su
su
root@android:/ # [COLOR="Red"][B]dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img[/B][/COLOR]
dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
31155+0 records in
31155+0 records out
15951360 bytes transferred in 2.259 secs (7061248 bytes/sec)
root@android:/ #

- Now we need to pull this image (mmcblk0p7) to our pc:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
root@android:/ # su
su
root@android:/ # dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
31155+0 records in
31155+0 records out
15951360 bytes transferred in 2.259 secs (7061248 bytes/sec)
root@android:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
root@android:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb pull /sdc
ard/mmcblk0p7.img[/B][/COLOR]
2523 KB/s (15951360 bytes in 6.172s)

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>

- Go ahead and repeat these steps for (mmcblk0p3).

- At this time go ahead and open up your hex editor (HxD) and at the top right change from

hex

in the drop down bar to

dec

- you will do this (if necessary) for all images pertaining to this tutorial.

- Drag\drop (mmcblk0p3.img) in to the hex editor (HxD).

- Now hit

ctrl+F

or go to the

Search

tab, then click on

Find

.

- Search for

HTCU

. You will see the following:

Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15

000033728 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033744 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033776 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[COLOR="Red"][B]000033792[/B] 00 00 00 00 [B]48 54 43 55[/B] 01 00 00 00 00 00 00 00 ....[B]HTCU[/B]........[/COLOR]
000033808 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033824 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033840 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033856 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

- Drag\drop (mmcblk0p7.img) in to the hex editor (HxD).

- Now hit

ctrl+G

or go to the

Search

tab, then click on

Goto...

.

- Search for DEC OFFSET

4265984

.

- You will see something like this:

Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15

04265920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265936 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265952 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265968 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[COLOR="Red"][B]04265984[/B] [B]68 25 32 C6 02[/B] 00 00 00 00 00 00 00 00 00 00 00 [B]h%2Æ.[/B]...........[/COLOR]
04266000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266016 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266032 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

- Now that we have what we needed loaded and prepped we want to see what needs adjustment regarding lock, unlock, relock, and tampered.

- These two partitions are already stamped with the bootloader being unlocked as well as being tampered so finding what we are looking for makes it easy as seen above.

- mmcblk0p3 is the partition which determines if our device is locked, unlocked, or relocked.

- mmcblk0p7 is the partition which determines if our device is tampered with or not.

- Let's look at mmcblk0p3. We see in red, HTCU, which we already know means Unlocked, because as I mentioned in the beginning, this tutorial is based on an already unlocked bootloader and tampered device.

[COLOR="Red"][B]000033792[/B] 00 00 00 00 [B]48 54 43 55[/B] 01 00 00 00 00 00 00 00 ....[B]HTCU[/B]........[/COLOR]

- We want to lock or relock our device. To relock is, "HTCL". To Lock is, "00 00 00 00".

- Our goal is creating a dd command which will implement these changes for us to our partition already on our device.

- To lock:

echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796

- To relock:

echo -ne "HTCL" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796

- To unlock:

echo -ne "HTCU" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796

- The command for seek is what determines the decimal search of that partition when implementing the echo command from start to finish, from left to right as it writes it out. This is why earlier I told you to change it from hex to dec in your hex editor. If you look at seek=33796 and go back to your hex editor you will notice the dec offset says 33792 then underneath that it says 33808.

Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15

000033792 00 00 00 00 48 54 43 55 01 00 00 00 00 00 00 00 ....HTCU........
000033808 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

- To determine the exact decimal location where the dd command will start writing to you must first look at the top of your hex editor where it shows '00 01 02 03 04 05, etc'. You will take the offset for 33792 and look at where HTCU begins then scroll to the top which in this case it aligns to '04', so we add 04 to the offset of 33792 which gives us a total of 33796. This becomes our seek (our starting point).

- Now that we have established this concept with mmcblk0p3.img, lets go and take a look at mmcblk0p7.img.

- We already know our device has been tampered with. If you search for tamper or tampered you will find results and these results eventually bring you to where we already are as mentioned above and if following along then what you are currently looking at on your pc.

- This one is really simple. Either your device is tampered or it is not. In this case we notice '02' which signifies the setup for being tampered.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00411800 68 25 32 C6 02 00 00 00 00 00 00 00 00 00 00 00 h%2Æ............

- Let's go ahead and change it to '00' with the following dd command:

echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988

- To restore back to tampered you will just replace 00 with 02.

(FOR K2_PLC_CL USERS, REPLACE 00 WITH 04, INSTEAD OF 02 - Credit goes to [MENTION=360988]DOrtego[/MENTION] for notifying me of this)

- Now to show you how to execute these commands. I will only use one command for this example since it will be the same for all of them. The following in RED will be your commands to execute. A lot of these will be due to insuring you are set up prior to executing the dd command itself, so if you are already good to go then just seek for the dd command and follow along:

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb devices[/B][/COLOR]
List of devices attached
HT********** device

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb shell[/B][/COLOR]
root@android:/ # [COLOR="Red"][B]su[/B][/COLOR]
su
root@android:/ # [COLOR="Red"][B]echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988[/B][/COLOR]
ock/mmcblk0p7 bs=1 seek=4265988 <
1+0 records in
1+0 records out
1 bytes transferred in 0.012 secs (83 bytes/sec)
root@android:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
root@android:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit

C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>

I will also show you how to go back to S-ON, but you BETTER make sure you have your stock HBoot.img flashed, Stock Boot.img flashed, etc OR YOU WILL BRICK YOUR DEVICE INDEFINITELY!!!

YOU MUST FIRST BE IN FASTBOOT - THERE WILL BE NO USING ADB NOR A TERMINAL EMULATOR FOR THIS STEP

To go from radio S-OFF to radio S-ON enter the following :

[B]fastboot oem writesecureflag 3[/B]

To go from HBoot S-Off to HBoot S-On just flash a stock HBoot to remove the modified version.

[B]adb reboot bootloader[/B]

// booting in to bootloader

[B]fastboot devices[/B]

// establishing connection between device and PC

[B]fastboot oem rebootRUU[/B]

// booting in to RUU

[B]fastboot flash zip filename.zip[/B]

// .zip with stock HBoot image

[B]fastboot reboot-bootloader[/B]

// confirm mod S-Off HBoot now reads new S-On from stock HBoot

[B]fastboot reboot[/B]

// boot OS

So, there you have it everyone! Enjoy, and profit!

--- Happy Hunting!