Develop Bugs

[S-ON] Return back to full stock S-ON

This method is to take your device back to full stock for whatever reason you may need.
This will make your phone s-on and locked again without tamper notification.
Must have ADB drivers installed. If you s-off then you should have these.
These procedures will EASILY BRICK you device if not done exactly. Copy and paste each command exactly. Double and triple check your entries to ensure you typed or copied them exactly.
1. Change CID back to stock.
Code:
reboot into fastboot
fastboot oem writecid CWS__001
^^This command is important. Make sure you type 8 characters in CWS__001
2. Remove tampered flag and relock.
Code:
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
3. Flash RUU from here.
4. Turn back to s-on. Reboot to fastboot
Code:
fastboot oem writesecureflag 3
5. Check in fastboot you are s-on and locked

jmztaylor said:
This method is to take your device back to full stock for whatever reason you may need.
This will make your phone s-on and locked again without tamper notification.
Must have ADB drivers installed. If you s-off then you should have these.
These procedures will EASILY BRICK you device if not done exactly. Copy and paste each command exactly. Double and triple check your entries to ensure you typed or copied them exactly.
1. Change CID back to stock.
Code:
adb shell
su
echo -ne "CWS__001" | dd of=/dev/block/mmcblk0p5 bs=1 seek=20
2. Remove tampered flag and relock.
Code:
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
3. Flash RUU from here.
4. Turn back to s-on. Reboot to fastboot
Code:
fastboot oem writesecureflag 3
5. Check in fastboot you are s-on and locked
Click to expand...
Click to collapse
another way to change cid while s off is to
Code:
fastboot oem writecid CWS__001

there is also a zip to relock:
http://androidforums.com/droid-dna-all-things-root/691712-how-reset-your-lock-status-flag.html
be aware it has not been tested on the one vx,since i dont have this device. id dump mmcblk0p3 and check the lock flag location if your interested in pursuing this option. if it works,it makes things pretty noob proof:
-fastboot oem writecid xxxxxxxx
-flash lock zip
-run ruu
-fastboot oem writesecureflag 3
no copy/pasting commands that can brick your device if typed or copied wrong

Stock RUU no longer available at link
scotty1223 said:
there is also a zip to relock:
http://androidforums.com/droid-dna-all-things-root/691712-how-reset-your-lock-status-flag.html
be aware it has not been tested on the one vx,since i dont have this device. id dump mmcblk0p3 and check the lock flag location if your interested in pursuing this option. if it works,it makes things pretty noob proof:
-fastboot oem writecid xxxxxxxx
-flash lock zip
-run ruu
-fastboot oem writesecureflag 3
no copy/pasting commands that can brick your device if typed or copied wrong
Click to expand...
Click to collapse

noobsaibot34 said:
Stock RUU no longer available at link
Click to expand...
Click to collapse
With a bit of searching im sure you can find stock ruus for your device. I have faith
The important part of my post and the link I posted was the zip file to lock your bootloader.
Sent from my HTC PG09410 using Tapatalk 2

[Q] Making stock backup and unlocking bootloader

I'm reading for few days now and I'm confused in two things:
1) unlocking bootloader
When using Hasoon2000 All-in-one toolkit I get different token, also fastboot oem get_identifier_token gives every time different token :/
Am I doing something wrong or it is normal?
2) making stock backup
Please correct me if I'm wrong
First I have to unlock bootloader, then I have to run custom recovery with: fastboot boot [TWRP or Philz touch recovery.img it will allow me to backup stock recovery and stock ROM (ROM will be cleaned after unlocking bootloader)
Then flash custom recovery fastboot flash recovery xxx.img
and if I want to have stock rooted flash only supersu or flash custom rom.
Am I right?

Globus.gd said:
I'm reading for few days now and I'm confused in two things:
1) unlocking bootloader
When using Hasoon2000 All-in-one toolkit I get different token, also fastboot oem get_identifier_token gives every time different token :/
Am I doing something wrong or it is normal?
2) making stock backup
Please correct me if I'm wrong
First I have to unlock bootloader, then I have to run custom recovery with: fastboot boot [TWRP or Philz touch recovery.img it will allow me to backup stock recovery and stock ROM (ROM will be cleaned after unlocking bootloader)
Then flash custom recovery fastboot flash recovery xxx.img
and if I want to have stock rooted flash only supersu or flash custom rom.
Am I right?
Click to expand...
Click to collapse
I'm not sure about the identifier token, didn't notice if it gives different tokens or not. Have you actually managed to unlock the bootloader though? You should try and do all these things without using all-in-one toolkits, you'll learn a whole lot more that way, especially when it comes to troubleshooting and fixing your device. It's not as difficult as you think it is. :good:
Yes unlock bootloader. Only Philz/CWM makes backup of stock recovery, TWRP doesn't make a backup of it. Rather use adb to make a backup of stock recovery. Boot the custom recovery of your choice and then flash the SuperSU app to get root or you can use towelroot if it works for your device.
Restart your phone(can go into OS) connect to PC, open command prompt and cd to adb folder.
Code:
adb shell cat /proc/emmc - [B]this will give out a list of all patitions on your device.[/B]
On my device it's in mmcblk0p43 , I'm sure it'll be the same for you as well, can just use above command to make sure. You can also type the command in a terminal emulator on your device if you have one installed cat /proc/emmc
So for my recovery block(Yours probably too) continue in command prompt on PC:
Code:
adb shell
su - [B]to gain super user status, just accept on device when prompted.[/B]
dd if=/dev/block/mmcblk0p43 of=/sdcard/recovery.img - [B]or[/B]
dd if=/dev/block/mmcblk0p43 of=/sdcard2/recovery.img - [B]if you want it on external sd card[/B]
There you made a backup of your recovery partition, you can immediately transfer it to the PC(adb folder) if you want by typing:
Code:
exit - [B]to exit shell prompt and go back into normal adb prompt[/B]
adb pull /sdcard/recovery.img [B](Or of course /sdcard2/ if you used external sd.)[/B]
To pull it to another directory just press spacebar after recovery.img and type in path directory to where you want to pull it.

BerndM14 said:
Have you actually managed to unlock the bootloader though?
Click to expand...
Click to collapse
No, I asked on htcdev why generated token is different every time I use fastboot command,

Help a Newbie to rid GPE RUU

Hi folks
I have recently bought a HTC One M8 on ebay which was converted to play edition by the seller using GPE RUU. I know very little about this but would like to attempt to return to stock whilst ensuring no flagged messages are left on.
I have searched and only come across guides that are specific to specific circumstances. Does anyone have or know of a general and safe guide that would work in my case?
Any help greatly appreciated.
Thanks in Advance
Sid

Do you have any idea what version the phone was running before GPe? Can you see the model number at the bottom of the back of the phone?

EddyOS said:
Do you have any idea what version the phone was running before GPe? Can you see the model number at the bottom of the back of the phone?
Click to expand...
Click to collapse
model: OP6B100
No idea what it was running before.

OK, going by that ID we can assume it's an EU unbranded handset. Or we can at least we can treat it as such. So, assuming you want to go back to 100% stock Sense (but keep S-OFF) do the following:
First, download the following to your fastboot folder:
4.16.401.10 RUU ZIP - https://drive.google.com/file/d/0B17smFr95pleU2NqcVB3NWxoNnM/view (rename it ruu.zip - not ruu.zip.zip)
htc_fastboot.exe - https://www.androidfilehost.com/?fid=95897840722646249
1.54.401.5 FW ZIP - http://www.androidfilehost.com/?fid=23329332407589439 (rename it firmware.zip)
TWRP - http://techerrata.com/file/twrp2/m8/openrecovery-twrp-2.8.4.0-m8.img (rename it to recovery.img)
HTC Sync Manager (for the drivers) - http://www.htc.com/uk/support/software/htc-sync-manager.aspx (install it and then uninstall Sync Manager but leave the drivers)
1. First things first, change the CID to Super CID - fastboot oem writecid 11111111
2. Once done, reboot the bootloader to confirm it's showing the Super CID - fastboot reboot-bootloader
3. Once confirmed it's set, we now need to set the right MID in case this was changed by the seller. To do this, we can use TWRP. Flash TWRP (downloaded earlier) - fastboot flash recovery recovery.img
4. Once flashed, boot into TWRP and connect the phone to your PC
5. Once the drivers are installed, make sure the PC sees the phone by typing adb devices
6. So long as it's been shown as a connected device, type adb shell
7. We can now change the MID to the EU unbranded one by using the following command (copy/paste this as it has to be exact)
Code:
echo -ne '\x30\x00\x50\x00\x36\x00\x42\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
8. Once done, we can now 'lock' the bootloader using the following command (whilst still in adb shell)
Code:
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
9. And we can also reset the tamper flag at the same time
Code:
echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564
10. Once all that is done, type exit to leave adb shell and then reboot the phone into the bootloader through the reboot menu in TWRP
11. Once back at the bootloader, you should find the phone is now 'LOCKED' and it shouldn't say 'TAMPERED' at the top either but should still have the black bootloader interface that the GPe has. We can now set it all back to Sense
12. Reboot the phone into RUU mode - fastboot oem rebootRUU
13. Once in RUU mode, flash the firmware ZIP - fastboot flash zip firmware.zip
14. The process will fail the first time and reboot. Run the same command again once it's rebooted - fastboot flash zip firmware.zip
15. Once finished, reboot the phone to the bootloader to confirm you now have the white 'Sense' bootloader - fastboot reboot-bootloader
16. Assuming it's correctly flashed, reboot back into RUU mode - fastboot oem rebootRUU
17. We can now flash the RUU using the htc_fastboot package - htc_fastboot flash zip ruu.zip
18. Once finished, reboot back to the bootloader one last time - fastboot reboot-bootloader
19. Once back in the bootloader, change the CID to HTC__001 - fastboot oem writecid HTC__001
20. Reboot the bootloader to confirm the change has been successful - fastboot reboot-bootloader
21. Once back at the boot loader, disconnect the phone and boot into recovery and do a factory reset
22. Once the reset finishes, reboot the phone
That should get it all working but any issues obviously let us know

Fastboot folder? I did say i was a newbie! thanks

OK, perhaps it might be worth reading up on fastboot/adb before doing anything as the above isn't for the faint-hearted!
EDIT: I've attached my 'fastboot' folder. Extract it to the root of your C: drive so it's easy to get to. All the commands in my guide are done through a command prompt in Windows starting in that folder, e.g. C:\platform-tools\fastboot oem rebootRUU
https://drive.google.com/file/d/0B8L4pkbzdlR3Z3dsNGZfSWhCeTA/view

ok, I have installed fastboot adb andi have a folder called adb in my c:. I am now downloading all the items listed above and renaming as appropriate and moving to the folder named adb. am I on the right track?

Getting there. You could've just downloaded/extracted the folder I linked to on your C: drive but as long as the contents is somewhere you can easily find you should be OK

i have the same problem but mine is in a loop.... my htc m8 is an 0P6B700, ive tried to convert it to a lollipop GOOGL001 but it didnt work... and i am stuck in bootloader.... i have already installed the twrp 2.8... and i have the working the fastboot in my pc... but i dont know what to do....
i want to install a lollipop rom.. but its ok if i need back to stock.
Any help will be appreciated
thanks.

tonytdc1000 said:
i have the same problem but mine is in a loop.... my htc m8 is an 0P6B700, ive tried to convert it to a lollipop GOOGL001 but it didnt work... and i am stuck in bootloader.... i have already installed the twrp 2.8... and i have the working the fastboot in my pc... but i dont know what to do....
i want to install a lollipop rom.. but its ok if i need back to stock.
Any help will be appreciated
thanks.
Click to expand...
Click to collapse
Please start your own thread rather than hijacking someone else's, and also post your output from fastboot getvar all so we can work out what's best to get you back up and running

I know your getting help here, but...Can I ask..
When you bought the One M8 on eBay, did the ad or photos say you were buying an M8 unlocked and Converted from Sense to GPE.
If Not, you do know youve been sold an incorrect product and you have a case against the seller for false advertising, so save yoursewlf the issues, exersize your rights and send it back.
Plus, you say you are new to flashing / unlocking, so if you brick this M8, you dont have any returns room.
Just wanted to say that and hope it helps. Good Luck

EddyOS said:
Please start your own thread rather than hijacking someone else's, and also post your output from fastboot getvar all so we can work out what's best to get you back up and running
Click to expand...
Click to collapse
Ok i will... thanks

EddyOS said:
Getting there. You could've just downloaded/extracted the folder I linked to on your C: drive but as long as the contents is somewhere you can easily find you should be OK
Click to expand...
Click to collapse
Hi Eddy
Thanks for all your support, i have successfuly completed step 1, 2 and 3. Now I need some assistance in flashing TWRP. How do i do this and what do i use?
regards

3 was flashing TWRP so if you've done that you now enter recovery via the bootloader.

quick question regarding tamper flag and locking bootloader

hey guys just a quick question. ive unlocked my bros m8 and got super cid and flashed the latest .401 (0P6BIMG_M8_UL_L50_SENSE60_MR_HTC_Europe_4.16.401.10_Radio_1.25.214500021.06G_20.68.4196t.01_F_release_417809_signed) all is fine.
my question is i know im able to remove the tamper flag if needed after locking the bootloader, but if i leave it "unlocked" and not lock the bootloader will i still receive stock updates? and if the need should arise that i send it back to htc will they cause an issue over super cid even if i remove the tamper flag and lock the bootloader?

If I'm correct your HTC One M8 currently got the following configuration:
HBoot unlocked
Software Status Unofficial
S-OFF
SuperCID 11111111
Am I correct?
If so you could remove the tampered flag by
Code:
adb devices
adb shell
su
echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564
exit
adb reboot bootloader
If need occurs to send it back you the coud flash the HTC One M8 using a RUU to re-optain original ROM status and after this perform the commands
Code:
fastboot writecid HTC__102 (if using a WWE RUU with SKU x.xx.401.x)
as well as
Code:
adb devices
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
exit
adb reboot bootloader
to get a realy locked bootloader. To also obtain S-ON, you got to finally type
Code:
fastboot oem writesecureflag 3

HTCNerdYoda said:
If I'm correct your HTC One M8 currently got the following configuration:
HBoot unlocked
Software Status Unofficial
S-OFF
SuperCID 11111111
Am I correct?
If so you could remove the tampered flag by
Code:
adb devices
adb shell
su
echo -ne '\x00' | dd of=/dev/block/mmcblk0p6 bs=1 seek=5314564
exit
adb reboot bootloader
If need occurs to send it back you the coud flash the HTC One M8 using a RUU to re-optain original ROM status and after this perform the commands
Code:
fastboot writecid HTC__102 (if using a WWE RUU with SKU x.xx.401.x)
as well as
Code:
adb devices
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
exit
adb reboot bootloader
to get a realy locked bootloader. To also obtain S-ON, you got to finally type
Code:
fastboot oem writesecureflag 3
Click to expand...
Click to collapse
fantastic thanks. question though whats the command you mentioned after flashing the ruu do? after doing s-on ill need to use sunshine again to get s-off right?

You would have to use Sunshine to S-off again, and if you have the same motherboard, you won't have to pay again. (It's licensed to that specific mobo). However, S-off is getting harder to obtain, so I would suggest leaving it S-off unless you have some pressing need (like warranty service) Also, if you have modified anything that an S-on phone would balk at, you may insta-brick when you go back S-on. I would always suggest doing a full RUU prior to reverting to S-on.
Short of HTC balking and not honoring your warranty, there are no real downsides to leaving the device S-off, and plenty of upsides.

jshamlet said:
You would have to use Sunshine to S-off again, and if you have the same motherboard, you won't have to pay again. (It's licensed to that specific mobo). However, S-off is getting harder to obtain, so I would suggest leaving it S-off unless you have some pressing need (like warranty service) Also, if you have modified anything that an S-on phone would balk at, you may insta-brick when you go back S-on. I would always suggest doing a full RUU prior to reverting to S-on.
Short of HTC balking and not honoring your warranty, there are no real downsides to leaving the device S-off, and plenty of upsides.
Click to expand...
Click to collapse
brilliant thanks a lot!

[Q] Help ! Not Able to Flash Custom Recovery on S-OFF Htc One M8

As Shown in Attached Screen Shots My HTC One M8 is S-OFF, CID-11111111 But Written ***LOCKED***...
Q.1 -What Does This " ***LOCKED*** " Means?
Q.2 - If this Phone has S-OFF .. and i want to flash TWRP Recovery.. then why this error coming everytime i try o flash ? (Failed (Remote: Not Allowed) as Shown on ADB Screen Shot...
am i missing any step... or should i have to still use sun shine ?
Thanx in Advance ...

Unlock the bootloader via the HTC dev site, then you can flash custom recoveries. It's free and you are s-off so you can set the flag back to LOCKED anyway.

Mr Hofs said:
Unlock the bootloader via the HTC dev site, then you can flash custom recoveries. It's free and you are s-off so you can set the flag back to LOCKED anyway.
Click to expand...
Click to collapse
Hasn't there also been an echo command to set the flag to unlocked, or am I mistaken?! With S-OFF at hand this should work and he should be able to flash the custom recovery in faceboot mode after this has been done.
EDIT: when device is fully booted, edit installed and adb debugging enabled one can do as follows:
Unlock
adb devices
adb shell
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
exit
adb reboot bootloader
Send by the swarm intelligence of my coffee machine (AKA HTC One M9).

Mr Hofs said:
Unlock the bootloader via the HTC dev site, then you can flash custom recoveries. It's free and you are s-off so you can set the flag back to LOCKED anyway.
Click to expand...
Click to collapse
thank you... actually i just did S-OFF and did not unlock boot loader.. thank you

HTCNerdYoda said:
Hasn't there also been an echo command to set the flag to unlocked, or am I mistaken?! With S-OFF at hand this should work and he should be able to flash the custom recovery in faceboot mode after this has been done.
EDIT: when device is fully booted, edit installed and adb debugging enabled one can do as follows:
Unlock
adb devices
adb shell
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796
exit
adb reboot bootloader
Send by the swarm intelligence of my coffee machine (AKA HTC One M9).
Click to expand...
Click to collapse
Problem Solved by unlocking boot loader via "htcdev".... but thanks anyways