[How-To] From S-OFF to 100% Stock S-ON [Facepalm/JTAG/RevOne/Moonshine/Rumrunner]

Search This thread

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
ONLY FOLLOW THIS GUIDE FOR WARRANTY REPLACEMENTS OR IF YOU NEED TO BE STOCK FOR A SALE. THERE IS NO OTHER REASON TO FOLLOW THIS GUIDE.

ALSO MAKE SURE YOU FOLLOW THE GUIDE PROPERLY. FAR TOO MANY ERRORS ARE BEING MADE BY NOT READING OR FOLLOWING STEPS IN ORDER.



This guide will help you get your phone back to stock after using any of the 5 S-Off methods that either have been or are currently available to us.

Credit to Scotty1223. I edited his One S guide for the DNA.

First post is for Facepalm and JTAG S-off only. RevOne instructions are in the second post. Moonshine and Rumrunner is in post 3.


***IF YOU HAVE A CUSTOM SPLASH SCREEN INSTALLED, THE STOCK SPLASH SCREEN MUST BE FLASHED BEFORE DOING ANYTHING! SEE FOURTH POST FOR LINKS AND INSTRUCTIONS FOR FLASHING THE STOCK SPLASH SCREEN***

***DO NOT ISSUE ANY OF THE WRITESECUREFLAG COMMANDS ON AN ENG HBOOT AS IT WILL BRICK THE DEVICE. JUST FOLLOW THE GUIDE.***



For those who want to return to stock and have used the JTAG method for achieving S-Off, this guide will also work for you. It all depends on what you did AFTER you got your JTAG phone back. If you wrote a new CID using fastboot and HTCDev unlocked, follow the guide as it is written out.

If you didn't write a new CID and use HTCDev unlock and just merely flashed a modified/ENG HBOOT, then the process would be: Fastboot flash stock hboot, RUU to stock, fastboot oem writesecureflag 3, then allow phone to update using the OTA process. You can find the commands/files/steps for these 3 simple steps below as well.


Files needed:

Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU


Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.

IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)

adb reboot bootloader

fastboot devices (your device should be listed)

fastboot oem writecid VZW__001 (2 underscores)

fastboot reboot-bootloader

fastboot getvar cid (verify your stock CID)

fastboot oem writesecureflag 3

fastboot reboot-bootloader

*verify you are locked s-on

fastboot reboot


Should now be 100% stock, S-ON, with CID 100% stock as well.
 
Last edited:

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
Returning to stock from RevOne

It is pretty much the same process, but with a slight deviation.

AGAIN, IF YOU HAVE A MODIFIED/ENG HBOOT, DO NOT ISSUE ANY WRITESECURE FLAG COMMANDS. JUST FOLLOW THE GUIDE.

First, download these two files:

Files needed:

Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU


Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.

IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)

adb reboot bootloader

fastboot devices (your device should be listed)

fastboot oem writesecureflag 3

fastboot reboot-bootloader

*verify you are locked s-on

fastboot reboot

You are now out of box stock.
 
Last edited:

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
Return to stock on Moonshine, Rumrunner and Firewater S-Off

Files needed:

Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU


Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader

You are locked. The s-off process removes the flag from displaying, but it is now locked.

IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)

adb reboot bootloader

fastboot devices (your device should be listed)

fastboot oem writesecureflag 3

fastboot reboot-bootloader

*verify you are locked s-on

fastboot reboot

You are now out of box stock.
 
Last edited:

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
FLASHING THE STOCK HBOOT:
*Credit to .torrented*


1. download 3.06 HBOOT: 3.06 HBOOT
2. Rename stock hboot file to : PL83IMG.zip and place in the folder that contains your fastboot.exe file (On your computer)
3. Flash hboot
Code:
Step 1) adb reboot bootloader

Step 2) fastboot oem rebootRUU

Step 3) CD to directory containing hboot zip (i.e. cd C:\sdk\)

Step 4) fastboot flash zip PL83IMG.zip

*** When it says it is done in the terminal/cmdprompt execute the following *** 
[The green bar only fills up about 75% of the way]

Step 5) fastboot reboot-bootloader




Flashing the Stock Splash Image

*All credit goes to E.T.Heil

1. Download the stock splash image here.
2. Rename file to splash1.img
3. Place the file in the same folder you have adb.exe and fastboot.exe located.
4. Plug in your phone to a USB port, turn on USB debugging and open a command prompt. cd to the directory your adb/fastboot is located
5. Run the following:
Code:
adb devices (your device ID should be displayed)
adb reboot bootloader
Once in the bootloader, run:
Code:
fastboot flash splash1 splash1.img
Once complete, reboot the phone using the menu or
Code:
fastboot reboot
 
Last edited:

Imacellist

Senior Member
Oct 20, 2011
517
196
Modesto, CA
Thank you so much for making this post. This is exactly what I needed. I am not quite sure which method I uses but it was the first one that required changing the CID, unlocking via htc dev and all that stuff. Would that be facepalm? Sorry if this is a dumb question, it was so long ago that I don't quite remember.
 

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
Thank you so much for making this post. This is exactly what I needed. I am not quite sure which method I uses but it was the first one that required changing the CID, unlocking via htc dev and all that stuff. Would that be facepalm? Sorry if this is a dumb question, it was so long ago that I don't quite remember.

Yes that was the Facepalm method. So follow the OP guide for that.
 
  • Like
Reactions: Imacellist

Prodiigy

Member
Jun 9, 2013
22
0
when i run RUU i get error 155 so i tried to flash the 1.15 hboot and i get this error in cmd

D:\Documents and Settings\Jonathan\My Documents\HTC\adt-bundle-windows-x86-20130
219\sdk\platform-tools>fastboot flash zip PL83IMG.zip
sending 'zip' (2047 KB)...
OKAY [ 0.375s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) shift signature_size for header checking...
FAILED (remote: 32 header error)
finished. total time: 0.562s

am i doing something wrong? i want to get my phone back to complete stock because i flashed a rom after moonshining without making a backup first. so i really want to get to stock so i can do the whole process over again (moonshine again if needed)
 

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
when i run RUU i get error 155 so i tried to flash the 1.15 hboot and i get this error in cmd

D:\Documents and Settings\Jonathan\My Documents\HTC\adt-bundle-windows-x86-20130
219\sdk\platform-tools>fastboot flash zip PL83IMG.zip
sending 'zip' (2047 KB)...
OKAY [ 0.375s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) shift signature_size for header checking...
FAILED (remote: 32 header error)
finished. total time: 0.562s

am i doing something wrong? i want to get my phone back to complete stock because i flashed a rom after moonshining without making a backup first. so i really want to get to stock so i can do the whole process over again (moonshine again if needed)

Possibly a bad download, Download the HBOOT again and give it another go.

Also, with that error you are getting during the RUU process, did you lock the bootloader back up before running the RUU? That error sometimes shows up from not doing that.
 
Last edited:
D

Deleted member 2427418

Guest
I don't know if this will help anyone or not, or if this was known and I was just being stupid, but I was getting the ERROR [155] as well when running the RUU and I knew my hboot was correct as well as locked so that wasn't the problem, so I attempted to run the RUU again and saw that it was saying my current version was 1.28.xxxxxx which made me realize that that was the Sense 5 roms version number and not the actual version number of my phone causing it to fail. What I then did was i downloaded an AOSP based rom (but I would surmise that a sense 4 DNA rom would work as well) and flashed that then tried again. After doing that it showed the correct version number in the RUU and processed correctly!!

For a little more in site I was on the following setup:
Moonshine S-OFF
Joelz Stock Sense 5 <-- What caused the Error 155
Carbon ROM (Built by Pio) <--- What fixed the error (Would work with any AOSP or Sense 4 Rom ***Needs tested***)


**Edit**
Also incase anyone was wondering I was doing this to fix my phones radio, for some reason when flashing certain roms it gets stuck in Roaming no matter what you do. To fix it I just take my phone completely back to stock S-ON etc, then go into the bootloader and hit factory reset with the stock recovery and it seems to fix it, then S-Off and unlock again and go about my business. I couldn't actually find an answer besides "RMA the thing" to fix the radio roaming issue, so i figured i'd add that incase anyone else was/is in the same boat. :)
 
Last edited by a moderator:

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
Hmm... I'll do a bit of testing on that with random Sense 5 vs AOSP/Sense 4 ROMs. If that is the case, I'll edit the guide.
 

Imacellist

Senior Member
Oct 20, 2011
517
196
Modesto, CA
I successfully restored my droid dna to untouched stock with this method. I had to exchange my DNA for a new one due to problems I was having and I am trying to do everything I can to make sure that there is no evidence of my tampering. One thing someone mentioned was to take the OTA's to get the device up to current 2.06 since I have been rooted and such since the first day it was available and am on 1.15. I have tried manually checking for software updates and it doesn't seem to find anything. It hasn't prompted me yet and I am wondering if because I am so far behind if they update system isn't checking or something else it wrong. Any thoughts? Any ways to manually update to 2.06 like flashing a new RUU (if that exists)? Thanks.
 

gris1016

Senior Member
Jul 26, 2010
133
9
I flashed the hboot zip and the hboot version is1.33 The phone is s-off and locked on viper rom. The RUU will reboot the phone into the black screen with the silver HTC logo, then the RUU stops working and asks to close the program. I downloaded three times and checked the md5 each time and its good. I am stuck. Any suggestions?
 
Last edited:

Phaded

Senior Member
Apr 6, 2010
1,127
371
216
I flashed the hboot zip and the hboot version is1.33 The phone is s-off and locked on viper rom. The RUU will reboot the phone into the black screen with the silver HTC logo, then the RUU stops working and asks to close the program. I downloaded three times and checked the md5 each time and its good. I am stuck. Any suggestions?

The RUU itself crashes on the computer or the phone crashes and reboots?

Also the hboot I have linked should give you version 1.31 I do believe.
 
Last edited:

chayos00

Senior Member
Feb 19, 2012
81
6
Return to stock on Moonshine S-Off

First, download the stock RUU
Stock RUU: 1.15 RUU: Mirror #1 or Mirror #2

Plug your phone into a USB port, turn on USB debugging and open a command prompt. cd to the directory that has adb/fastboot.


**NOTE** I noticed on the XDA mobile app that it breaks the echo command line up and makes it look like 2 separate commands. Do not separate it. The command starts at echo and ends at 33796.

Run:
Code:
adb devices (verify device ID is listed)
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
exit

Your bootloader is now locked. Lets verify...
Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED**

I am having issues not getting the phone to return to "Locked" status. I have and am running the stock ROM. Just reset back to factory. I am following the commands to the T. Below is what my CMD prompt shows that I typed in, or copied and pasted for the echo command. I was trying to follow the note about the echo command but I could see nothing wrong with it... also in the end I had to type exit command twice for it exit and go back to the prompt for the next folder.

C:\android-adb>adb devices
List of devices attached
FA2C2S510423 device


C:\android-adb>adb shell
root@android:/ # su
su
root@android:/ # echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 s
eek=33796
d of=/dev/block/mmcblk0p3 bs=1 seek=33796 <
4+0 records in
4+0 records out
4 bytes transferred in 0.007 secs (571 bytes/sec)
root@android:/ # exit
exit
root@android:/ # exit
exit

C:\android-adb>
 

Top Liked Posts

  • There are no posts matching your filters.
  • 37
    ONLY FOLLOW THIS GUIDE FOR WARRANTY REPLACEMENTS OR IF YOU NEED TO BE STOCK FOR A SALE. THERE IS NO OTHER REASON TO FOLLOW THIS GUIDE.

    ALSO MAKE SURE YOU FOLLOW THE GUIDE PROPERLY. FAR TOO MANY ERRORS ARE BEING MADE BY NOT READING OR FOLLOWING STEPS IN ORDER.



    This guide will help you get your phone back to stock after using any of the 5 S-Off methods that either have been or are currently available to us.

    Credit to Scotty1223. I edited his One S guide for the DNA.

    First post is for Facepalm and JTAG S-off only. RevOne instructions are in the second post. Moonshine and Rumrunner is in post 3.


    ***IF YOU HAVE A CUSTOM SPLASH SCREEN INSTALLED, THE STOCK SPLASH SCREEN MUST BE FLASHED BEFORE DOING ANYTHING! SEE FOURTH POST FOR LINKS AND INSTRUCTIONS FOR FLASHING THE STOCK SPLASH SCREEN***

    ***DO NOT ISSUE ANY OF THE WRITESECUREFLAG COMMANDS ON AN ENG HBOOT AS IT WILL BRICK THE DEVICE. JUST FOLLOW THE GUIDE.***



    For those who want to return to stock and have used the JTAG method for achieving S-Off, this guide will also work for you. It all depends on what you did AFTER you got your JTAG phone back. If you wrote a new CID using fastboot and HTCDev unlocked, follow the guide as it is written out.

    If you didn't write a new CID and use HTCDev unlock and just merely flashed a modified/ENG HBOOT, then the process would be: Fastboot flash stock hboot, RUU to stock, fastboot oem writesecureflag 3, then allow phone to update using the OTA process. You can find the commands/files/steps for these 3 simple steps below as well.


    Files needed:

    Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
    3.06 RUU: 3.06 RUU


    Steps:
    1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
    2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
    Code:
    adb devices (Your device ID should be listed)
    adb reboot bootloader
    Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.

    IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

    3. run the RUU as admin (right click, run as administrator)
    4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
    5. Run the following:
    Code:
    adb devices (your device should be listed)
    
    adb reboot bootloader
    
    fastboot devices (your device should be listed)
    
    fastboot oem writecid VZW__001 (2 underscores)
    
    fastboot reboot-bootloader
    
    fastboot getvar cid (verify your stock CID)
    
    fastboot oem writesecureflag 3
    
    fastboot reboot-bootloader
    
    *verify you are locked s-on
    
    fastboot reboot


    Should now be 100% stock, S-ON, with CID 100% stock as well.
    29
    Return to stock on Moonshine, Rumrunner and Firewater S-Off

    Files needed:

    Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
    3.06 RUU: 3.06 RUU


    Steps:
    1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
    2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
    Code:
    adb devices (Your device ID should be listed)
    adb reboot bootloader

    You are locked. The s-off process removes the flag from displaying, but it is now locked.

    IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

    3. run the RUU as admin (right click, run as administrator)
    4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
    5. Run the following:
    Code:
    adb devices (your device should be listed)
    
    adb reboot bootloader
    
    fastboot devices (your device should be listed)
    
    fastboot oem writesecureflag 3
    
    fastboot reboot-bootloader
    
    *verify you are locked s-on
    
    fastboot reboot

    You are now out of box stock.
    14
    FLASHING THE STOCK HBOOT:
    *Credit to .torrented*


    1. download 3.06 HBOOT: 3.06 HBOOT
    2. Rename stock hboot file to : PL83IMG.zip and place in the folder that contains your fastboot.exe file (On your computer)
    3. Flash hboot
    Code:
    Step 1) adb reboot bootloader
    
    Step 2) fastboot oem rebootRUU
    
    Step 3) CD to directory containing hboot zip (i.e. cd C:\sdk\)
    
    Step 4) fastboot flash zip PL83IMG.zip
    
    *** When it says it is done in the terminal/cmdprompt execute the following *** 
    [The green bar only fills up about 75% of the way]
    
    Step 5) fastboot reboot-bootloader




    Flashing the Stock Splash Image

    *All credit goes to E.T.Heil

    1. Download the stock splash image here.
    2. Rename file to splash1.img
    3. Place the file in the same folder you have adb.exe and fastboot.exe located.
    4. Plug in your phone to a USB port, turn on USB debugging and open a command prompt. cd to the directory your adb/fastboot is located
    5. Run the following:
    Code:
    adb devices (your device ID should be displayed)
    adb reboot bootloader
    Once in the bootloader, run:
    Code:
    fastboot flash splash1 splash1.img
    Once complete, reboot the phone using the menu or
    Code:
    fastboot reboot
    12
    Returning to stock from RevOne

    It is pretty much the same process, but with a slight deviation.

    AGAIN, IF YOU HAVE A MODIFIED/ENG HBOOT, DO NOT ISSUE ANY WRITESECURE FLAG COMMANDS. JUST FOLLOW THE GUIDE.

    First, download these two files:

    Files needed:

    Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
    3.06 RUU: 3.06 RUU


    Steps:
    1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
    2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
    Code:
    adb devices (Your device ID should be listed)
    adb reboot bootloader
    Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.

    IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4

    3. run the RUU as admin (right click, run as administrator)
    4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
    5. Run the following:
    Code:
    adb devices (your device should be listed)
    
    adb reboot bootloader
    
    fastboot devices (your device should be listed)
    
    fastboot oem writesecureflag 3
    
    fastboot reboot-bootloader
    
    *verify you are locked s-on
    
    fastboot reboot

    You are now out of box stock.
    3
    updated with RevOne and Moonshine...

    If anyone sees anything I missed let me know. Otherwise guide is complete.