some frequently asked questions and general info about s-off
*what exactly IS s-off?
the simple answer is "security-off" on the normal checks that the phone does before it allows you to change different partitions,or revert to an older software/firmware combination.
more specifically,what the s-off procedure gives the device is a "radio s-off" by changing a setting in the radio NVRAM called the "secure flag" to "off". this method of s-off is ideal,as it is below the radio level of the phone,and will remain no matter what other changes are made. radios,hboots,etc. can all be changed and the radio secure flag will remain off.
ruus can be run,OTAs accepted,etc. and the s-off will stay,until it is purposely changed.
other devices use a "patched" hboot,wich is basically an hboot,that does not listen to the radio secure flag.
the radio secure flag is still s-on,the patched hboot simply ignores it. these hboots can be further patched to prevent themselves from being overwritten,so the s-off is not lost during an ruu or OTA. with older phones,this works fine until a new hboot is required for an OS upgrade.
with the new devices,this type of s-off is not possible(or we would have had it a long time ago) due to the complex checks that the phone makes when it boots. if the s-on radio checks hboot and finds it to be unsigned,the phone is put into a "do not boot" mode that is only reversible by htc,becoming effectively a hard brick.
"why not patch the radio just like we patched the hboot??" partially because its easier said than done,partially because other checks are going on,and if the radio is found to be unsigned,again, "no boot mode". basically there are just too many checks going on to patch them all. since it all starts with the radio secure flag,its the only practical way to gain complete access to the phone.
*isnt my unlocked via htcdev bootloader the same as s-off? i thot thats what unlocked means?
sorry,no. its not the same. the key difference is that htcdev unlock
only allows access to boot/system/recovery. the phone is still s-on,and still doing plently of checks that prevent you from:
-changing firmware
-changing your splash screen
-going backwards in software/firmware build version numbers.
it also does not allow you to write the boot image from the recovery partition,as we all know that have flashed roms on s-on phones. since the kernel lives in the boot image,the kernel can only be changed by:
1)flashing it seperately via hboot or fastboot
or
2)launching your recovery
from fastboot.
a permanently installed recovery cannot install kernels with htcdev unlock
*so what does s-off do for me??
-first and foremost,it makes rom flashing and nandroid restoring ALOT easier by allowing the permanently installed recovery to write the boot image,making the PC no longer a required part of the flash/restore equAtion
you can now download a rom right to your phone,move it to the root of your sd with a file manager,and boot to a recovery and flash it,without a PC anywhere in sight.(note that i do not download roms to my phone,i prefer to download to pc,then transfer. a personal preference)
-second,it alows changing of firmware,so you can run a "patched" or engnieering hboot,the advantages of will be discussed later
-it lets you upgrade your radio and related firmware wihtout running a huge,signed,full RUU
-it lets you go backwards in build numbers. this is handy becasue you can,without fear,flash the latest leak,and if its bad,revert back to older software/firmware without issue.
-you can change your splash screen,wich is not important functionally,but fun. anything from carman electra, to your cat,to your grandkids can replace the
htc splash screen.
-last and not least,the ability to add a patched or engineering hboot,combined with the ability to run any RUU that exists,gives a much greater opportunity to revive a "soft bricked" phone.
-one last big plus is that the procedure will change your
unlocked or
relocked status back to
locked wich,visiually,is good for warranty purposes
*can i get back to 100% s-on stock??
yes,you can. because the process changes you back to
locked,you just need to run a signed RUU and turn the secure flag back on. directions in the following post.
*what is an engineering hboot?
an "eng" or "engineering" hboot is simply a bootloader that allows for extra fastboot commands. for most folks,99% of these commands will never be used. the main commands that users of an eng hboot will use,over a stock hboot are:
fastboot flash wich is used to flash recoveries,boot images,splash images,hboots,et.
and
fastboot boot wich is used to boot(launch) an image directly into phones memory. most common use of this is recovery. you can use it to get recovery running,without having to permantly flash it,thus leaving the stock one installed. this is good for users that want to recieve OTAs,and dont use recovery much.
*what is a patched hboot?
a "patched" hboot is simply an hboot that has been patched to provide some or all of the same commands as a real engineering hboot. they can be considered safer than a real eng hboot,since they are generally made of newer,more reliable hboot versions. eng hboots have generally been around since prior to the phones release. a patched hboot also can block itself from being overwritten by other hboots,wich can be a huge advantage on phones where the radio secure flag is actually "on" as the s-off hboot will always remain,even if OTAs are taken,or RUUs run.
the thunderbolts
revolutionary patched hboot is a prime example of a ship hboot patched for eng commands,and preventing itself from being over written.
*how do install or change recovery now that im s-off,but locked?
there are a couple ways to skin this cat:
1)simply allow juopunutbear to install its patched hboot. this will let you use
fastboot flash and
fastboot boot if you are used to these commands.
2)as a PxxxIMG file. splash images,recoveries,hboots,or any other firmware can be changed by packing up the images,along with an android info text document, into a zip file,that is then renamed PxxxIMG,placed on the sd card,and updated in hboot.
donate to my device fund
