[GUIDE] [T-Mobile] Unlock Bootloader, Install Custom Recovery, Root, S-Off

VolcanicSkunk said:

This guide is for the T-Mobile HTC One M8. Bootloader Version: 3.16.0.0000

Disclaimer: I am not responsible for your device. You are performing the steps detailed in this post at your own risk. Support for any phone unlocked through this method falls upon you. Assume that this method voids any warranty that may have come with your phone. Also, currently there is no known way to restore the T-Mobile variant to complete stock settings after using HTC Dev Unlock and/or achieving S-Off. Maybe at a later date this could be possible, but not yet.
*Please do not quote this post. It's so long.*
Support for recoveries, firewater, or other tools used herein should be asked in their respective thread or forum.
Firewater does not work on every T-Mobile M8. If, when running firewater, you see "Whelp, this sucks..." firewater will not work on your phone. Right now firewater is the only method to achieve S-Off on our M8 variant.

This thread is for people that understand what this whole post means. If you are unsure of the terms, please search. The terminology is readily available and nothing should be difficult to find.

I work and go to graduate school, so this thread will be updated periodically, but I will not be able to provide a lot of support. This guide reflects my steps to achieve root and S-Off, and is just intended to give someone new to the phone an easy to read step-by-step guide of what the process will be.

I also hope we can condense the large amount of information floating around about achieving S-Off on our variant into one thread.

Required Files:
HTC Dev Unlock Process:
Google Android SDK zip:
http://developer.android.com/sdk/index.html
Java Runtime Environment:
http://java.com
HTC Sync (Windows Only):
http://www.htc.com/www/help/

Recovery (choose one):
Team Win Recovery Project (TWRP) 2.7.x for GSM Phones
http://teamw.in/project/twrp2/225
PhilZ Touch ClockworkMod (CWM) Recovery
http://xdaforums.com/showthread.php?t=2703223

S-Off:
Firewater
http://firewater-soff.com/instructions/
Firewater M8 Original Thread
http://xdaforums.com/showthread.php?p=51698035

Useful Commands:

adb devices
(after installing adb, this will tell you if your phone is detected by the computer)
expected output:

Code:

C:\sdk\platform-tools>adb devices
	List of devices attached
	FAXXXXXXXXXX	device

fastboot devices
(after copying the fastboot utility downloaded during the HTC Dev Unlock process to your sdk\platform-tools\ directory, this will tell you if your phone is detected by the computer)
expected output:

Code:

C:\sdk\platform-tools>fastboot devices
	List of devices attached
	FAXXXXXXXXXX	fastboot

1. Unlock bootloader via HTC Dev Unlock (http://www.htcdev.com/bootloader)

a. At the top of the page, either register for a new account or log in with an existing one
b. Under "Supported Devices" choose "All Other Supported Models"
c. Click "Begin Unlock Bootloader"
d. A prompt will ask you to continue. Read this. If this prompt scares you, stop immediately. Otherwise, press "Yes" to continue
e. Accept the legal terms and conditions.
f. Follow the on-screen steps provided.

Step 1
After powering down, press Volume Down and while pressing Volume Down, press Power holding both buttons to start the device into Bootloader mode. If you have difficulty, power up normally, go to Settings->Battery and deselect Fast boot. Power down and try again.
Step 2
Use the Volume buttons to select up or down. Highlight Fastboot and press the Power button.
Step 3
Connect the device to the computer via a usb cable
Step 4
Download the fastboot binary for your OS using the provided links​

g. Follow the on-screen steps provided

Step 5
Open a command Prompt: Windows: Start->"cmd" Mac: Applications->Utilities->Terminal.app Linux: Terminal
Type in Command Prompt: fastboot oem get_identifier_token.
Step 6
You will see a long block of text. Copy and paste this text into the the token field below (in the Windows command prompt: Right Click > Mark > highlight the block of text > Right click to copy. Mac users can use cmd-option to mark and select text.).
When copying the token, start with this line:
<<<< Identifier Token Start >>>>
And end with this line:
<<<<< Identifier Token End >>>>>
(Note: Do not copy the INFO or (bootloader) prefix)
Step 7
Paste this string of text into the token field and hit Submit in order to receive your unlock code binary file. You will receive this information in your email.​

h. After hitting submit, HTC will send you an email. Sender is HTC-Unlockbootloader. Subject is "The key to unlocking your HTC Device."

Email Message:

Attached to the email is Unlock_code.bin. This is the file you will need to download in order to unlock your bootloader. This file is device specific. You cannot use this file to unlock any other HTC phone. Please do not try as this will probably result in a brick.
Click the link provided in the email to continue the steps to unlock your bootloader​

i. Follow the on-screen steps provided

Step 8
You will receive an email with the attachment: Unlock_code.bin. Save this file in the same folder as your fastboot files (For Example: C:\Android).
If, after a short period of time, you have not yet received the mail, or you have received an email from HTC, but does not contain an attached file, it is possible that more stringent spam filters and anti-virus programs will block this mail or attachment.
In order to ensure that you receive the email with the attachment, we suggest you consider using a non-corporate email server as corporate servers tend to have more stringent attachment policies. If you have not received the email at all, please check your spam folder in your email client to check if the email was filtered out.
Step 9
In the command prompt type: fastboot flash unlocktoken Unlock_code.bin. In the command prompt you will see the following message:

Code:

fastboot flash unlocktoken Unlock_code.bin
		sending 'unlocktoken' <0KB>...
		OKAY [ 0.151s]
		writing 'unlocktoken'...
		<bootloader> unlock token check successfully
		OKAY [0.006s]
		finished. total time: 0.158s

Step 10
On your phone you will now see the disclaimer. Please read this carefully as this action may void your warranty. Use the Volume buttons to highlight your choice, and the Power button to make your selection. If you select Yes, your phone will be reset to its’ factory default settings, and your bootloader will be unlocked. If you select No, your phone will reboot and no modifications will have been made.
Step 11
To re-lock your bootloader, in the command prompt, type: fastboot oem lock.
Note: This will not restore the factory default lock, but will simply re-lock the bootloader so no further changes can be made. Furthermore, if you want to unlock your bootloader again, simply repeat step 9 with your original unlock key file to unlock your phone again.​

j. Congratulations, your phone now has an unlocked bootloader! If your phone hasn't done so already, reboot it and let it sit at the welcome screen for the requisite 5-10 minutes to settle. Turn off your phone, and reboot to HBOOT with volume down + power button. Select fastboot.
​

​

2. Install a custom recovery

As far as I know, there are two recoveries that are fully functional with our M8 variant:

TWRP
PhilZ Touch CWM​

a. Download your chosen recovery from the above links.
b. Rename it recovery.img
c. Drop it in the same folder as your adb and fastboot binaries.
d. After booting to fastboot mode, make sure your device is still plugged in and run the following command in your command window:

fastboot devices
Your computer shouldn't have any troubles recognizing your phone since we just went through the bootloader unlock, but it's always best to be safe.​

e. Now run the command:

fastboot flash recovery recovery.img
Expected output:

Code:

C:\sdk\platform-tools>fastboot flash recovery recovery.img
	sending 'recovery' <14,818KB>...
	OKAY [ 0.871s]
	writing 'recovery'...
	OKAY [ 1.501s]
	finished. total time: 2.543s

f. Congratulations! You now have a custom recovery installed.
g. I recommend immediately making a backup of your fresh operating system (pre-root) by selecting HBOOT from the fastboot menu, then selecting and booting into recovery
h. After booting into your new custom recovery select backup from your list of options and proceed to select your backup location (internal or micro sd) and continue to the backup. It will be quite large, but this will provide you a good starting point should you ever need to restore to factory settings for any reason.
i. I use TWRP, because it will automatically prompt you to install root and SuperSU upon rebooting from recovery.

I am unsure how to achieve root after flashing PhilZ Touch. If anyone provides the info I will add it to this guide.​

​

3. Achieve S-Off (Hopefully!)

The instructions to attaining S-Off are listed on the firewater s-off page linked above. They are really comprehensive and you should follow them to the letter. Make sure that you read through their prerequisites as well.

Note: On prerequisite number four, it states that you must be "HTCDEV unlocked/rooted." Please read this as you must be HTCDEV unlocked AND rooted.​

I didn't want to post the firewater team's instructions here (I didn't ask permission yet), so this section will be more for information regarding the S-Off process that I have gathered from other threads and this one going forward.

Issues seen with Firewater:

Firewater does not work on every T-Mobile M8. If, when running firewater, you see "Whelp, this sucks..." firewater will not work on your phone.

The speculation is, there are different components used during the builds due to sourcing those components from different companies. It seems that some people believe that the phone build date may indicate the devices that have components that are compatible with the exploit. So we'll document this to try to see who achieved S-Off on which build dates.

Issue: Firewater hangs but does not give the "Whelp this sucks..." message:
Possible Solutions: Your device is likely compatible. You must be persistent. Keep trying.

Hit Ctrl+C to exit the exploit and try again starting from "adb reboot" (from @Fenny)
Unplug your USB cable, reboot your phone manually. Once it boots up, plug in your USB cable (from @epsix)
Plug in your USB cable, adb reboot. Once it boots, go to Developer Options and uncheck and recheck USB Debugging (from @epsix)
Install BusyBox (from @renn9420)​

Issue: After running adb reboot command and pushing firewater phone shows up as "offline"
Possible Solutions: Make sure that you granted su permissions to your adb shell through SuperSU

I had this happen to me. I would go to run the command and suddenly, the phone is disconnected. I ran through the adb reboot steps a couple of times and finally when executing firewater it ran. Went through the steps 3 times before it ran.​

Build Dates S-Off Achieved On:

04/01/2014
04/04/2014
04/07/2014
04/12/2014​

Build Dates S-Off Not Achieved On:

04/03/2014 x2
04/08/2014
04/09/2014
04/10/2014
04/11/2014​

​

4: Other

a. @Fenny noticed that /data/preload/ gets emptied after HTC Dev Unlock. If you're hanging onto your stock ROM and don't plan to change to a custom OS you'll want to replace these files. Go here to replace them: http://xdaforums.com/showthread.php?t=2714522​

Thanks go to:
@beaups - firewater
@Dees_Troy - TWRP
@Phil3759 - PhilZ Touch
@Fenny - Stock + ROM, Hacked HBOOT, Preload data & more
@Turge - ViperOneM8
@Chainfire - SuperSU
@jcase - for looking into getting weaksauce working on our phones

Click to expand...

Click to collapse

irrelephant said:

04/07/2014 build date no go... Got the whelp message as well.

Sent from my HTC One_M8 using Tapatalk

Click to expand...

Click to collapse

Behold_this said:

As I've said in the other thread it is the luck of the draw. Assembly date and location have little to do with it. It's a matter of what components were put into your device and that is a matter of what components were available at the time of assembly.

Just because one device was produced with exploitable components on one day doesn't mean another device wasn't produced with unexploitable components on the same day. A run of a particular component can run out at any time. When it does the next available run of components will be used.

Click to expand...

Click to collapse