[GUIDE] Rumrunner S-OFF for HTC Desire V (T328w, Wind)

Search This thread

mr.wasssup

Member
Jul 4, 2013
43
18
This is an easy-to-follow and complete guide on how to achieve S-OFF on HTC Desire V (T328w, Wind) using the Rumrunner tool (primary for HTC One, adapted for us)

Rumrunner copyright notice: As per the license terms on the official Rumrunner site: http://rumrunner.us/ mirror links of Rumrunner software are not allowed. Using Rumrunner packages hosted on other sites or from other members is risky/outdated and official support is not applicable if you cannot S-OFF or end up bricking your device. You should always download the latest Rumrunner version from the official site: http://rumrunner.us/downloads-2/

Step-by-step procedure before attempting to S-OFF (with non-universal builds of Rumrunner):
1. Your HTC Desire V must be unlocked & rooted.
If it's not rooted, the bootloader must first be unlocked. Follow the instructions in the "Unlocking bootloader" section in this guide:http://xdaforums.com/showthread.php?t=2265618.
2. Go to Settings > Developer options > check USB debugging. (If you cannot see Developer options, go to Settings > About > Software information > More > tap on Build number 7 times until you get a pop-up message saying: You are now a developer!)
3. Go to Settings > Power > uncheck Fast boot.
4. Uninstall HTC Sync if you have it, as well as all other phone software (Samsung Kies, PDANet, etc.)
5. Disable all your internet security software (antivirus, antispyware such as Windows Defender, etc) and disable firewall (you need unrestricted internet access otherwise Rumrunner will fail).
6. Disable Screen lock security on your HTC Desire V. (Go to Settings > Security > Screen lock > select None) (no passcode lock/no pattern lock/no face lock)
7. A working internet connection on the device.
8. Required a stock ROM but also been successfully tested on Baidu 5.1 & Baidu ROM43
9. Install HTC drivers: here
Hint: If you previously had HTC Sync installed, you should have the drivers already. You can uninstall HTC Sync separately, without removing the drivers.
If you got an error during installing the driver in mode android 1.0, try alternative PDANet drivers
10. You need adb and fastboot: here/mirror
11. Use your HTC USB cable to connect the device to a USB 2.0 port on your PC. (Do not connect through USB hubs or USB 3.0 ports)
12. Connect to FASTBOOT USB mode and test if your phone is accessible via adb fastboot. (Hold the power button down until the phone powers off. Press Volume Down and Power buttons to start the device into Bootloader mode. Use the Volume buttons to select up or down. Highlight Fastboot and press the Power button. Connect the device via the original HTC USB cable to a USB 2.0 port in your PC . Now, click on Start > Run > Type "CMD". This will open the DOS Command Prompt window. Navigate through DOS to your adb folder. Mine is located at C:/ Android so i type in the following order:
Code:
CD C:\Android 
fastboot devices
This will display your HTC Desire V 's serial number, indicating that you have successfully established USB connection. Here's my log from the Command Prompt window:
Code:
C:\Documents and Settings\Administrator> CD C:\Android 
C:\>cd Android
C:\ Android >fastboot devices
HT273P******    fastboot
If you see nothing after entering the fastboot devices command, then there is a problem with the USB connection - you may have a faulty USB cable and/or you need to install the correct HTC USB drivers depending on your OS).
13. Charge your HTC Desire V to 100%. Some users have reported that if the battery level is below 50%, the S-OFF procedure will sometimes fail.
14. Download the rumrunner_proto_0.7.1 version of Rumrunner according to your OS: http://rumrunner.us/downloads-2/.
Hint: Yes, it`s for HTC Desire X, but method is the same.
15.Connect your HTC Desire V using the HTC USB cable via a USB 2.0 port and boot up the phone. Leave it on its homescreen. Close any open Command Prompt windows. Unzip the Rumrunner file on your hard drive C:\. Make sure that you have administrator rights on the computer. Double-click on soju.exe to start the S-OFF operation (or right-click on soju.exe to run as Administrator).
15.a) Agree to the terms and conditions you are prompted with in soju (Yes)
15.b) Allow the exploit to do its work (Yes).
Your device will reboot 4-6 times throughout the process.
Do not touch device! Wait until the console appears "Press ENTER to exit". Disconnect your HTC Desire V
15.c) Reboot device in the bootloader & check S-OFF
6.jpg
Here is my complete log from successful Rumrunner S-OFF execution:
==================== rumrunner S-OFF 0.7.1 ==============================

rumrunner S-OFF comes with NO WARRANTY (express or implied)
and NO GUARANTEE OF FITNESS for any particular task.
We have made every effort we can to make this a safe process for users
however the authors disclaim any liability for damage to your phone
or other materials or devices used during this process.

The entire risk of running rumrunner S-OFF lies with you, the user.
By using this software you acknowledge and accept that the authors
are not liable for any loss, material or otherwise howsoever caused.

Do you understand the implications of this warning?
(Yes/No)
Yes

Dear User: We will expect that YOU:
(1) Know how to use ADB and FASTBOOT binaries
---- [Yes, use these tools to test USB connection BEFORE running rumrunner] ----

(2) Realize that rumrunner S-OFF cannot support every CUSTOM rom in this world
(3) Understand that irc support IS NOT A GENERAL HELPDESK
(4) Are able to identify and download the CORRECT package for YOUR device
(5) Know how to enable USB-debugging on YOUR device (Yes, do that now)
(6) Understand that you may NOT repack or redistribute rumrunner S-OFF

Ok?
(Yes/No)
Yes
!! Do NOT for any reason taunt, unplug, drop, eat or pet your device !!
Please wait....
..........
Checking for updates......
Test 1: Rebooting into bootloader
Waiting for fastboot (14/120)
Waiting
Test 2: Booting device
Waiting for ADB (21/120)
must ferment longer...

must sanitize, skunky rum is nasty
hold please.............................................................
[------------------------------------------------------------]
Rebooting into bootloader (again)
Waiting for fastboot (14/120)
Waiting for ADB (20/120)
must ferment longer...

chilling..................
it's a little stinky here, hmm....

heh, just a shot glass for this one....
bottles are packed, here we go, shhhhhh....

hmm, cap is on tighter than I expected........
heh, just a shot glass for this one....
pouring (1).................................
heh, just a shot glass for this one....
pouring (2)........................
heh, just a shot glass for this one....
pouring (3).................
Waiting for ADB (24/120)
must ferment longer...

what's that in the bottle still? rum foul, sloppy, real sloppy...
heh, just a shot glass for this one....
wait for it.........
yep, done. Hope you enjoyed the rum!
Don't forget to send us all your money - rumrunnerdevs@gmail.com
Press ENTER to exit

Attention : USING S-OFF METHOD YOU WILL GET VIBRATIONS ON BOOT !
HTC Desire V (as well as HTC Desire X) has a known bug where it will vibrate multiple times (7) on EVERY boot after using rumrunner. This is NOT reversible. You’ve been warned!!!


New possibilities with S-OFF
 
Last edited:

mr.wasssup

Member
Jul 4, 2013
43
18
New possibilities with S-OFF
Means, you already know how to use adb commands, you have installed necessary drivers and S-OFF / unlock bootloader

1. Get SuperCID 11111111 via adb (this will remove the region lock on your phone)
Code:
CD C:\Android
C:\Android>adb reboot bootloader
C:\Android>fastboot oem writecid 11111111
2. Firmware upgrade to the latest available for optimal performance (Firmware.zip, Hboot, radio)
HTC_Europe_Hboot_1.30.0008_Radio_1.10.34D.17_20.26.30.27U_Stock_Boot&Recovery
HTC_Asia_WWE_Hboot_1.14.0001_Radio_1.10.34D.17_20.26.30.27U_Stock_Boot&Recovery
3. Remove red warning text in your bootloader.
Stock Hboot 1.30.0008 signed
6.jpg
Hboot 1.30.0008 Removed red warning text
7.jpg
Code:
adb reboot bootloader
fastboot oem rebootRUU
fastboot flash zip hboot.zip
fastboot reboot
4. Adb shell commands to change the status of the Bootloader Locked/Unlocked/Relocked (information provided by Softor, confirmed by ckpv5 here & here)
4a. So, for Locked status, connect you (S-OFF) Desire V (turned on normal mode) to BB via 2.0 USB and type in the open DOS Command Prompt window following command:
Code:
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
exit
exit
adb reboot bootloader
or
Code:
adb wait-for-device shell su -c "echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
4b. To change the Bootloader status to Unlocked (without htcdev.com service)
Code:
adb shell
su
echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
exit
exit
adb reboot bootloader
or
Code:
adb wait-for-device shell su -c "echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
4c. And for Relocked status:
Code:
adb shell
su
echo -ne '\x15\x08\x85\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
exit
exit
adb reboot bootloader
or
Code:
adb wait-for-device shell su -c "echo -ne '\x15\x08\x85\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
Here is my complete log from successful upgrade Hboot with removed red warning text & getting SuperCID:
CD C:\Android
C:\Android>adb reboot bootloader
C:\Android>fastboot getvar version-bootloader
version-bootloader: 1.14.0001
finished. total time: 0.003s

C:\Android>fastboot oem rebootRUU
...
OKAY [ 0.171s]
finished. total time: 0.172s

C:\Android>fastboot flash zip hboot.zip
sending 'zip' (363 KB)...
OKAY [ 0.224s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) start image[hboot] unzipping & flushing...
(bootloader) [RUU]UZ,hboot,0
(bootloader) [RUU]UZ,hboot,100
(bootloader) [RUU]WP,hboot,0
(bootloader) [RUU]WP,hboot,100
OKAY [ 3.917s]
finished. total time: 4.144s

C:\Android>fastboot reboot-bootloader
rebooting into bootloader...
OKAY [ 0.167s]
finished. total time: 0.167s

C:\Android>fastboot getvar version-bootloader
version-bootloader: 1.30.0008
finished. total time: 0.003s


C:\Android>fastboot oem writecid 11111111
...
(bootloader) →╜tjHTCE
(bootloader) Done!
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) sdc_ns_reg value=0xFF9E0B58
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) sdc_ns_reg value=0xFF9E0B58
(bootloader) sdcc_init_memory_device done
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) sdc_ns_reg value=0xFE2B0B5A
(bootloader) Wait for AMSS ready
(bootloader) AMSS is ready
(bootloader) buf_addr:1FC300,buf_size:200,start_sector:1739D
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) sdcc_init_memory_device done
(bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
(bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
(bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
(bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
(bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
(bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
(bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
(bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
(bootloader) Finish write sector address 1739D ...
(bootloader) writecid: successfully
OKAY [ 22.104s]
finished. total time: 22.105s
My complete log from Locked Bootloader command and results photo:
C:\Users\User>CD C:\Android

C:\Android>adb shell
adb server is out of date. killing...
* daemon started successfully *
shell@android:/ $ su
su
shell@android:/ # echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
dd of=/dev/block/mmcblk0p7 bs=1 seek=32256 <
4+0 records in
4+0 records out
4 bytes transferred in 0.009 secs (444 bytes/sec)
shell@android:/ # exit
exit
shell@android:/ $ exit
exit

C:\Android>adb reboot bootloader

C:\Android>
1.jpg
My complete log from Unlocked Bootloader command and results photo:
C:\Users\User>CD C:\Android

C:\Android>adb shell
shell@android:/ $ su
su
shell@android:/ # echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
dd of=/dev/block/mmcblk0p7 bs=1 seek=32256 <
4+0 records in
4+0 records out
4 bytes transferred in 0.008 secs (500 bytes/sec)
shell@android:/ # exit
exit
shell@android:/ $ exit
exit

C:\Android>adb reboot bootloader

C:\Android>
2014311200718.jpg
 
Last edited:

almozaffar

Senior Member
Jun 27, 2006
153
4
A tried all ways but in vein
this is my log
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>CD C:|Android
'Android' is not recognized as an internal or external command,
operable program or batch file.

C:\Windows\system32>CD C:\Android

C:\Android>fastboot oem rebootRUU
...
OKAY [ 0.190s]
finished. total time: 0.190s

C:\Android>fastboot flash zip hboot_mod.zip
sending 'zip' (363 KB)...
OKAY [ 0.230s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
FAILED (remote: 99 unknown fail)
finished. total time: 1.820s

C:\Android>fastboot flash zip hboot.zip
sending 'zip' (363 KB)...
OKAY [ 0.220s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
FAILED (remote: 99 unknown fail)
finished. total time: 1.710s

C:\Android>
any solution?
 

mr.wasssup

Member
Jul 4, 2013
43
18
A tried all ways but in vein
this is my log

C:\Android>fastboot flash zip hboot_mod.zip
sending 'zip' (363 KB)...
OKAY [ 0.230s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
FAILED (remote: 99 unknown fail)
finished. total time: 1.820s

C:\Android>fastboot flash zip hboot.zip
sending 'zip' (363 KB)...
OKAY [ 0.220s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) zip info parsing...
FAILED (remote: 99 unknown fail)
finished. total time: 1.710s

C:\Android>
any solution?

What is your CID & mainver?
 
  • Like
Reactions: almozaffar

almozaffar

Senior Member
Jun 27, 2006
153
4
can't write CID
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\LGNB>CD C:\Android

C:\Android>fastboot oem writecid 11111111
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.000s]
finished. total time: 0.000s

C:\Android>fastboot oem writecid 11111111
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.000s]
finished. total time: 0.000s

C:\Android>fastboot oem writecid 1111111
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.000s]
finished. total time: 0.000s

C:\Android>adb reboot bootloader
adb server is out of date. killing...
* daemon started successfully *
error: device not found

C:\Android>fastboot oem writecid 11111111
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.016s]
finished. total time: 0.016s

C:\Android>fastboot oem writecid 11111111
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.000s]
finished. total time: 0.000s

C:\Android>
Main Version is Baidu 44
HBOOT 1.14.0001
RADIO 1.10.34D.17
eMMC-hboot
PRIMODS PVT SHIP S-ON RL
Apr 30 2012 2:15
 

almozaffar

Senior Member
Jun 27, 2006
153
4
Response by rummer


==================== rumrunner S-OFF 0.5.0 ==============================

rumrunner S-OFF comes with NO WARRANTY (express or implied)
and NO GUARANTEE OF FITNESS for any particular task.
We have made every effort we can to make this a safe process for users
however the authors disclaim any liability for damage to your phone
or other materials or devices used during this process.

The entire risk of running rumrunner S-OFF lies with you, the user.
By using this software you acknowledge and accept that the authors
are not liable for any loss, material or otherwise howsoever caused.

Do you understand the implications of this warning?
(Yes/No)
Yes

Dear User: We will expect that YOU:
(1) Know how to use ADB and FASTBOOT binaries
---- [Yes, use these tools to test USB connection BEFORE running rumrunner] ----

(2) Realize that rumrunner S-OFF cannot support every CUSTOM rom in this world
(3) Understand that irc support IS NOT A GENERAL HELPDESK
(4) Are able to identify and download the CORRECT package for YOUR device
(5) Know how to enable USB-debugging on YOUR device (Yes, do that now)
(6) Understand that you may NOT repack or redistribute rumrunner S-OFF

Ok?
(Yes/No)
Yes
!! Do NOT for any reason taunt, unplug, drop, eat or pet your device !!
Please wait....
..........
ERROR: run rumrunner again and READ (no adb connection to device. Debugging on?
Drivers?)
Press ENTER to exit
 

mr.wasssup

Member
Jul 4, 2013
43
18
..........
ERROR: run rumrunner again and READ (no adb connection to device. Debugging on?
Drivers?)
Press ENTER to exit

Don't you see anything abnormal in the log? ;)
Read manual carefully, check USB debugging, USB cable and USB ports on BB & device (don't use USB 3.0 ports or hubs). It's no correct Desire V's adb drivers for windows 8.1, so do it on older versions (better win 7).
 
Last edited:

almozaffar

Senior Member
Jun 27, 2006
153
4
Don't you see anything abnormal in the log? ;)
Read manual carefully, check USB debugging, USB cable and USB ports on BB & device (don't use USB 3.0 ports or hubs). It's no correct Desire V's adb drivers for windows 8.1, so do it on older versions (better win 7).

Thanks for your help, but
1-I am using Windows 7 Ultimate
2-debugging is on
3-my Laptop doesn't have USB 3, its USB
4- HTC drivers are up to date
5-ScreenLock is off
6-adb are from this post

I think the problem is in my gadget, it refuses to writecid or to flash, why?

---------- Post added at 01:38 AM ---------- Previous post was at 01:32 AM ----------

It's no solution to get supercid or flash hboot till you have S-ON.

Mine is still S-ON
 

almozaffar

Senior Member
Jun 27, 2006
153
4
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\LGNB>CD C:\Android

C:\Android>fastboot devices
HT2Axxxxxxxx fastboot

Fastboot can detect my Desire V
finally I got it working but failed to doenload


==================== rumrunner S-OFF 0.7.1 ==============================

rumrunner S-OFF comes with NO WARRANTY (express or implied)
and NO GUARANTEE OF FITNESS for any particular task.
We have made every effort we can to make this a safe process for users
however the authors disclaim any liability for damage to your phone
or other materials or devices used during this process.

The entire risk of running rumrunner S-OFF lies with you, the user.
By using this software you acknowledge and accept that the authors
are not liable for any loss, material or otherwise howsoever caused.

Do you understand the implications of this warning?
(Yes/No)
Yes

Dear User: We will expect that YOU:
(1) Know how to use ADB and FASTBOOT binaries
---- [Yes, use these tools to test USB connection BEFORE running rumrunner] ----

(2) Realize that rumrunner S-OFF cannot support every CUSTOM rom in this world
(3) Understand that irc support IS NOT A GENERAL HELPDESK
(4) Are able to identify and download the CORRECT package for YOUR device
(5) Know how to enable USB-debugging on YOUR device (Yes, do that now)
(6) Understand that you may NOT repack or redistribute rumrunner S-OFF

Ok?
(Yes/No)
Yes
!! Do NOT for any reason taunt, unplug, drop, eat or pet your device !!
Please wait....
..........
Checking for updates......
Test 1: Rebooting into bootloader
Waiting for fastboot (12/120)
Waiting
Test 2: Booting device
Waiting for ADB (21/120)
must ferment longer...

must sanitize, skunky rum is nasty
hold please.............................................................
[------------------------------------------------------------]
Rebooting into bootloader (again)
Waiting for fastboot (12/120)
FATAL: Download updated package at www.rumrunner.us
Press ENTER to exit
 
Last edited:

almozaffar

Senior Member
Jun 27, 2006
153
4
I removed all kinna antivirus, stopped all services, windows defender and firewall, but no luck
Any advice?
 

mr.wasssup

Member
Jul 4, 2013
43
18
Hello! Just now add in New possibilities with S-OFF section "Commands to change the Bootloader status"


I removed all kinna antivirus, stopped all services, windows defender and firewall, but no luck
Any advice?

If you are sure about сorrectly installed drivers, qualitative of USB connection and all the other additional requirements are met, try rumrunner 0.7.1 with same other firmware version.
 

hellolalalam

Member
Aug 6, 2009
8
5
S-OFF completed and CID changed. :laugh: Here are my summary.

1. Running hTC_Asia_TW_1.59.709.3 System & Recovery on CID-HTCCN703

2. Unlocked Bootloader / flashed Custom Recovery 5.5.0.4 / rooted

3. Run rumrunner_proto_0.7.1 failed with message

hmm, cap is on tighter than I expected........
heh, just a shot glass for this one....
pouring (1)........................
unfortunately this isn't going to work out with your configuration. you have 2
options:
1.) flash an unsecure kernel that's compatible with your ROM and retry rumrunner
(preferred and most reliable method).
2.) flash a different rom.
NOTE: No amount of messing around with su binaries and apk's is going to fix thi
s issue for you!!!.
Better luck next time!!!!bye
Press ENTER to exit

4. Flash Baidu ROM v5.1 for HTC T328w

5. Run rumrunner_proto_0.7.1 again successfully

6. Change CID from HTCCN703 to 11111111

7. Copy official Desire V Taiwan ROM to MicroSD Card.
Rename "PL11IMG_PRIMO_DS_ICS_40A_hTC_Asia_TW_1.59.709.3_Radio_1.05.34D.29_20.21.30.23U_release_264969_signed.zip" to "PL11IMG.zip"

Reboot to HBOOT mode with VOL Down & Power Button
Follow instruction & flash the official rom

8. Relock bootloader successfully

9. Perform OTA update from 1.59.709.3 > 1.73.709.4 > 1.74.709.6
 

ManthanRB

Senior Member
Mar 23, 2012
913
101
London
Attention : USING S-OFF METHOD YOU WILL GET VIBRATIONS ON BOOT !
HTC Desire V (as well as HTC Desire X) has a known bug where it will vibrate multiple times (7) on EVERY boot after using rumrunner. This is NOT reversible. You’ve been warned!!!

what do you mean by this notice?
the phone may hard brick? wont boot? or its just that it vibrate but behave normally?
 

ManthanRB

Senior Member
Mar 23, 2012
913
101
London
S-OFF completed and CID changed. :laugh: Here are my summary.

1. Running hTC_Asia_TW_1.59.709.3 System & Recovery on CID-HTCCN703

2. Unlocked Bootloader / flashed Custom Recovery 5.5.0.4 / rooted

3. Run rumrunner_proto_0.7.1 failed with message

hmm, cap is on tighter than I expected........
heh, just a shot glass for this one....
pouring (1)........................
unfortunately this isn't going to work out with your configuration. you have 2
options:
1.) flash an unsecure kernel that's compatible with your ROM and retry rumrunner
(preferred and most reliable method).
2.) flash a different rom.
NOTE: No amount of messing around with su binaries and apk's is going to fix thi
s issue for you!!!.
Better luck next time!!!!bye
Press ENTER to exit

4. Flash Baidu ROM v5.1 for HTC T328w

5. Run rumrunner_proto_0.7.1 again successfully

6. Change CID from HTCCN703 to 11111111

7. Copy official Desire V Taiwan ROM to MicroSD Card.
Rename "PL11IMG_PRIMO_DS_ICS_40A_hTC_Asia_TW_1.59.709.3_Radio_1.05.34D.29_20.21.30.23U_release_264969_signed.zip" to "PL11IMG.zip"

Reboot to HBOOT mode with VOL Down & Power Button
Follow instruction & flash the official rom

8. Relock bootloader successfully

9. Perform OTA update from 1.59.709.3 > 1.73.709.4 > 1.74.709.6

last night i tried rumrunner 2 times on stock rom & it failed like yours both the time.
today morning i flashed stock rom,boot & recovery (Clean Install)
LOL WHEN I WENT TO BOOTLOADER TO FLASH RECOVERY I SAW S-OFF AND I DIDN'T TRIED RUMRUNNER STILL, HOW?:eek:

LONG STORY SHORT - I GOT S-OFF EVEN AFTER RUMRUNNER FAILED!!!:silly:

EDIT:

I forgot to root the phone & relocked BL now i want root on Stock ROM how can reunlock it & than lock it again?
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    This is an easy-to-follow and complete guide on how to achieve S-OFF on HTC Desire V (T328w, Wind) using the Rumrunner tool (primary for HTC One, adapted for us)

    Rumrunner copyright notice: As per the license terms on the official Rumrunner site: http://rumrunner.us/ mirror links of Rumrunner software are not allowed. Using Rumrunner packages hosted on other sites or from other members is risky/outdated and official support is not applicable if you cannot S-OFF or end up bricking your device. You should always download the latest Rumrunner version from the official site: http://rumrunner.us/downloads-2/

    Step-by-step procedure before attempting to S-OFF (with non-universal builds of Rumrunner):
    1. Your HTC Desire V must be unlocked & rooted.
    If it's not rooted, the bootloader must first be unlocked. Follow the instructions in the "Unlocking bootloader" section in this guide:http://xdaforums.com/showthread.php?t=2265618.
    2. Go to Settings > Developer options > check USB debugging. (If you cannot see Developer options, go to Settings > About > Software information > More > tap on Build number 7 times until you get a pop-up message saying: You are now a developer!)
    3. Go to Settings > Power > uncheck Fast boot.
    4. Uninstall HTC Sync if you have it, as well as all other phone software (Samsung Kies, PDANet, etc.)
    5. Disable all your internet security software (antivirus, antispyware such as Windows Defender, etc) and disable firewall (you need unrestricted internet access otherwise Rumrunner will fail).
    6. Disable Screen lock security on your HTC Desire V. (Go to Settings > Security > Screen lock > select None) (no passcode lock/no pattern lock/no face lock)
    7. A working internet connection on the device.
    8. Required a stock ROM but also been successfully tested on Baidu 5.1 & Baidu ROM43
    9. Install HTC drivers: here
    Hint: If you previously had HTC Sync installed, you should have the drivers already. You can uninstall HTC Sync separately, without removing the drivers.
    If you got an error during installing the driver in mode android 1.0, try alternative PDANet drivers
    10. You need adb and fastboot: here/mirror
    11. Use your HTC USB cable to connect the device to a USB 2.0 port on your PC. (Do not connect through USB hubs or USB 3.0 ports)
    12. Connect to FASTBOOT USB mode and test if your phone is accessible via adb fastboot. (Hold the power button down until the phone powers off. Press Volume Down and Power buttons to start the device into Bootloader mode. Use the Volume buttons to select up or down. Highlight Fastboot and press the Power button. Connect the device via the original HTC USB cable to a USB 2.0 port in your PC . Now, click on Start > Run > Type "CMD". This will open the DOS Command Prompt window. Navigate through DOS to your adb folder. Mine is located at C:/ Android so i type in the following order:
    Code:
    CD C:\Android 
    fastboot devices
    This will display your HTC Desire V 's serial number, indicating that you have successfully established USB connection. Here's my log from the Command Prompt window:
    Code:
    C:\Documents and Settings\Administrator> CD C:\Android 
    C:\>cd Android
    C:\ Android >fastboot devices
    HT273P******    fastboot
    If you see nothing after entering the fastboot devices command, then there is a problem with the USB connection - you may have a faulty USB cable and/or you need to install the correct HTC USB drivers depending on your OS).
    13. Charge your HTC Desire V to 100%. Some users have reported that if the battery level is below 50%, the S-OFF procedure will sometimes fail.
    14. Download the rumrunner_proto_0.7.1 version of Rumrunner according to your OS: http://rumrunner.us/downloads-2/.
    Hint: Yes, it`s for HTC Desire X, but method is the same.
    15.Connect your HTC Desire V using the HTC USB cable via a USB 2.0 port and boot up the phone. Leave it on its homescreen. Close any open Command Prompt windows. Unzip the Rumrunner file on your hard drive C:\. Make sure that you have administrator rights on the computer. Double-click on soju.exe to start the S-OFF operation (or right-click on soju.exe to run as Administrator).
    15.a) Agree to the terms and conditions you are prompted with in soju (Yes)
    15.b) Allow the exploit to do its work (Yes).
    Your device will reboot 4-6 times throughout the process.
    Do not touch device! Wait until the console appears "Press ENTER to exit". Disconnect your HTC Desire V
    15.c) Reboot device in the bootloader & check S-OFF
    6.jpg
    Here is my complete log from successful Rumrunner S-OFF execution:
    ==================== rumrunner S-OFF 0.7.1 ==============================

    rumrunner S-OFF comes with NO WARRANTY (express or implied)
    and NO GUARANTEE OF FITNESS for any particular task.
    We have made every effort we can to make this a safe process for users
    however the authors disclaim any liability for damage to your phone
    or other materials or devices used during this process.

    The entire risk of running rumrunner S-OFF lies with you, the user.
    By using this software you acknowledge and accept that the authors
    are not liable for any loss, material or otherwise howsoever caused.

    Do you understand the implications of this warning?
    (Yes/No)
    Yes

    Dear User: We will expect that YOU:
    (1) Know how to use ADB and FASTBOOT binaries
    ---- [Yes, use these tools to test USB connection BEFORE running rumrunner] ----

    (2) Realize that rumrunner S-OFF cannot support every CUSTOM rom in this world
    (3) Understand that irc support IS NOT A GENERAL HELPDESK
    (4) Are able to identify and download the CORRECT package for YOUR device
    (5) Know how to enable USB-debugging on YOUR device (Yes, do that now)
    (6) Understand that you may NOT repack or redistribute rumrunner S-OFF

    Ok?
    (Yes/No)
    Yes
    !! Do NOT for any reason taunt, unplug, drop, eat or pet your device !!
    Please wait....
    ..........
    Checking for updates......
    Test 1: Rebooting into bootloader
    Waiting for fastboot (14/120)
    Waiting
    Test 2: Booting device
    Waiting for ADB (21/120)
    must ferment longer...

    must sanitize, skunky rum is nasty
    hold please.............................................................
    [------------------------------------------------------------]
    Rebooting into bootloader (again)
    Waiting for fastboot (14/120)
    Waiting for ADB (20/120)
    must ferment longer...

    chilling..................
    it's a little stinky here, hmm....

    heh, just a shot glass for this one....
    bottles are packed, here we go, shhhhhh....

    hmm, cap is on tighter than I expected........
    heh, just a shot glass for this one....
    pouring (1).................................
    heh, just a shot glass for this one....
    pouring (2)........................
    heh, just a shot glass for this one....
    pouring (3).................
    Waiting for ADB (24/120)
    must ferment longer...

    what's that in the bottle still? rum foul, sloppy, real sloppy...
    heh, just a shot glass for this one....
    wait for it.........
    yep, done. Hope you enjoyed the rum!
    Don't forget to send us all your money - rumrunnerdevs@gmail.com
    Press ENTER to exit

    Attention : USING S-OFF METHOD YOU WILL GET VIBRATIONS ON BOOT !
    HTC Desire V (as well as HTC Desire X) has a known bug where it will vibrate multiple times (7) on EVERY boot after using rumrunner. This is NOT reversible. You’ve been warned!!!


    New possibilities with S-OFF
    3
    New possibilities with S-OFF
    Means, you already know how to use adb commands, you have installed necessary drivers and S-OFF / unlock bootloader

    1. Get SuperCID 11111111 via adb (this will remove the region lock on your phone)
    Code:
    CD C:\Android
    C:\Android>adb reboot bootloader
    C:\Android>fastboot oem writecid 11111111
    2. Firmware upgrade to the latest available for optimal performance (Firmware.zip, Hboot, radio)
    HTC_Europe_Hboot_1.30.0008_Radio_1.10.34D.17_20.26.30.27U_Stock_Boot&Recovery
    HTC_Asia_WWE_Hboot_1.14.0001_Radio_1.10.34D.17_20.26.30.27U_Stock_Boot&Recovery
    3. Remove red warning text in your bootloader.
    Stock Hboot 1.30.0008 signed
    6.jpg
    Hboot 1.30.0008 Removed red warning text
    7.jpg
    Code:
    adb reboot bootloader
    fastboot oem rebootRUU
    fastboot flash zip hboot.zip
    fastboot reboot
    4. Adb shell commands to change the status of the Bootloader Locked/Unlocked/Relocked (information provided by Softor, confirmed by ckpv5 here & here)
    4a. So, for Locked status, connect you (S-OFF) Desire V (turned on normal mode) to BB via 2.0 USB and type in the open DOS Command Prompt window following command:
    Code:
    adb shell
    su
    echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
    exit
    exit
    adb reboot bootloader
    or
    Code:
    adb wait-for-device shell su -c "echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
    4b. To change the Bootloader status to Unlocked (without htcdev.com service)
    Code:
    adb shell
    su
    echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
    exit
    exit
    adb reboot bootloader
    or
    Code:
    adb wait-for-device shell su -c "echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
    4c. And for Relocked status:
    Code:
    adb shell
    su
    echo -ne '\x15\x08\x85\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
    exit
    exit
    adb reboot bootloader
    or
    Code:
    adb wait-for-device shell su -c "echo -ne '\x15\x08\x85\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256"
    Here is my complete log from successful upgrade Hboot with removed red warning text & getting SuperCID:
    CD C:\Android
    C:\Android>adb reboot bootloader
    C:\Android>fastboot getvar version-bootloader
    version-bootloader: 1.14.0001
    finished. total time: 0.003s

    C:\Android>fastboot oem rebootRUU
    ...
    OKAY [ 0.171s]
    finished. total time: 0.172s

    C:\Android>fastboot flash zip hboot.zip
    sending 'zip' (363 KB)...
    OKAY [ 0.224s]
    writing 'zip'...
    (bootloader) zip header checking...
    (bootloader) zip info parsing...
    (bootloader) checking model ID...
    (bootloader) checking custom ID...
    (bootloader) start image[hboot] unzipping & flushing...
    (bootloader) [RUU]UZ,hboot,0
    (bootloader) [RUU]UZ,hboot,100
    (bootloader) [RUU]WP,hboot,0
    (bootloader) [RUU]WP,hboot,100
    OKAY [ 3.917s]
    finished. total time: 4.144s

    C:\Android>fastboot reboot-bootloader
    rebooting into bootloader...
    OKAY [ 0.167s]
    finished. total time: 0.167s

    C:\Android>fastboot getvar version-bootloader
    version-bootloader: 1.30.0008
    finished. total time: 0.003s


    C:\Android>fastboot oem writecid 11111111
    ...
    (bootloader) →╜tjHTCE
    (bootloader) Done!
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) sdc_ns_reg value=0xFF9E0B58
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) sdc_ns_reg value=0xFF9E0B58
    (bootloader) sdcc_init_memory_device done
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) sdc_ns_reg value=0xFE2B0B5A
    (bootloader) Wait for AMSS ready
    (bootloader) AMSS is ready
    (bootloader) buf_addr:1FC300,buf_size:200,start_sector:1739D
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) sdcc_init_memory_device done
    (bootloader) HWIO_SDC1_MD_REG_ADDR=0xA86000A0
    (bootloader) HWIO_SDC1_NS_REG_ADDR=0xA86000A4
    (bootloader) HWIO_SDC3_MD_REG_ADDR=0xA86000B0
    (bootloader) HWIO_SDC3_NS_REG_ADDR=0xA86000B4
    (bootloader) phys_to_virt(HWIO_SDC1_MD_REG_ADDR)=0xB32000A0
    (bootloader) phys_to_virt(HWIO_SDC1_NS_REG_ADDR)=0xB32000A4
    (bootloader) phys_to_virt(HWIO_SDC3_MD_REG_ADDR)=0xB32000B0
    (bootloader) phys_to_virt(HWIO_SDC3_NS_REG_ADDR)=0xB32000B4
    (bootloader) Finish write sector address 1739D ...
    (bootloader) writecid: successfully
    OKAY [ 22.104s]
    finished. total time: 22.105s
    My complete log from Locked Bootloader command and results photo:
    C:\Users\User>CD C:\Android

    C:\Android>adb shell
    adb server is out of date. killing...
    * daemon started successfully *
    shell@android:/ $ su
    su
    shell@android:/ # echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
    dd of=/dev/block/mmcblk0p7 bs=1 seek=32256 <
    4+0 records in
    4+0 records out
    4 bytes transferred in 0.009 secs (444 bytes/sec)
    shell@android:/ # exit
    exit
    shell@android:/ $ exit
    exit

    C:\Android>adb reboot bootloader

    C:\Android>
    1.jpg
    My complete log from Unlocked Bootloader command and results photo:
    C:\Users\User>CD C:\Android

    C:\Android>adb shell
    shell@android:/ $ su
    su
    shell@android:/ # echo -ne '\x15\x08\x84\x19' | dd of=/dev/block/mmcblk0p7 bs=1 seek=32256
    dd of=/dev/block/mmcblk0p7 bs=1 seek=32256 <
    4+0 records in
    4+0 records out
    4 bytes transferred in 0.008 secs (500 bytes/sec)
    shell@android:/ # exit
    exit
    shell@android:/ $ exit
    exit

    C:\Android>adb reboot bootloader

    C:\Android>
    2014311200718.jpg
    2
    S-OFF completed and CID changed. :laugh: Here are my summary.

    1. Running hTC_Asia_TW_1.59.709.3 System & Recovery on CID-HTCCN703

    2. Unlocked Bootloader / flashed Custom Recovery 5.5.0.4 / rooted

    3. Run rumrunner_proto_0.7.1 failed with message

    hmm, cap is on tighter than I expected........
    heh, just a shot glass for this one....
    pouring (1)........................
    unfortunately this isn't going to work out with your configuration. you have 2
    options:
    1.) flash an unsecure kernel that's compatible with your ROM and retry rumrunner
    (preferred and most reliable method).
    2.) flash a different rom.
    NOTE: No amount of messing around with su binaries and apk's is going to fix thi
    s issue for you!!!.
    Better luck next time!!!!bye
    Press ENTER to exit

    4. Flash Baidu ROM v5.1 for HTC T328w

    5. Run rumrunner_proto_0.7.1 again successfully

    6. Change CID from HTCCN703 to 11111111

    7. Copy official Desire V Taiwan ROM to MicroSD Card.
    Rename "PL11IMG_PRIMO_DS_ICS_40A_hTC_Asia_TW_1.59.709.3_Radio_1.05.34D.29_20.21.30.23U_release_264969_signed.zip" to "PL11IMG.zip"

    Reboot to HBOOT mode with VOL Down & Power Button
    Follow instruction & flash the official rom

    8. Relock bootloader successfully

    9. Perform OTA update from 1.59.709.3 > 1.73.709.4 > 1.74.709.6
    1
    A tried all ways but in vein
    this is my log

    C:\Android>fastboot flash zip hboot_mod.zip
    sending 'zip' (363 KB)...
    OKAY [ 0.230s]
    writing 'zip'...
    (bootloader) zip header checking...
    (bootloader) zip info parsing...
    FAILED (remote: 99 unknown fail)
    finished. total time: 1.820s

    C:\Android>fastboot flash zip hboot.zip
    sending 'zip' (363 KB)...
    OKAY [ 0.220s]
    writing 'zip'...
    (bootloader) zip header checking...
    (bootloader) zip info parsing...
    FAILED (remote: 99 unknown fail)
    finished. total time: 1.710s

    C:\Android>
    any solution?

    What is your CID & mainver?
    1
    FATAL: Download updated package at www.rumrunner.us
    Press ENTER to exit

    Steps 5 and 7 of manual.