[GUIDE] Juopunutbear S-OFF (HBOOT 1.27.0000 with 3.32 ICS Firmware)

Official Thread - http://xdaforums.com/showthread.php?t=1611981 | Original Author - http://unlimited.io/juopunutbear.htm

Was advised by another member that a handy guide would be useful for other members, I am going to base this on what I did in my own experience

*** NOTE: There have been many updates with this method and all other troubleshooting steps can be found on the website - http://unlimited.io/jbtroubleshooting.htm ***

Juopunutbear Requirments:

* Be unlocked using the HTCdev bootloader unlock - http://htcdev.com/bootloader
* Be rooted (have superuser and/or an unsecured boot image installed)
* Have a spare microSD card, or to have backed up all contents of your SDcard, the card will be wiped
* Have fastboot and adb drivers installed and working (windows)
* Have usb debugging enabled
* Have a legth of insulated wire of sufficient length to join the contact points for your device (paperclip)

NOTE: This is based on an ICS Upgraded Sensation 4.0.3 with HBOOT 1.27.0000 and Firmware 3.32.

Make sure you have at least 50% battery life for this and some free time. I also recommend a paperclip extended out with some insulation tape over the whole thing except for the tips (leave about 1CM free each end) for the wire trick.

1 - Backup and Format your SD Card

Easiest thing to do as this is essential for the program to work and you wouldn't want to risk your content.

2 - Restore to Stock 3.32 Rooted ROM

I did this because I was getting an error message only 1 other user reported and I believe it was because I was using a custom ROM (LeeDroid) with a kernel based on 3.32 from a different ROM. I kept getting an Segmentation error:

======== ControlBear version 0.2 for JuopunutBear S-OFF ==========
Old beer detected...... Please wait......
Starting up......
Waiting device
Segmentation fault
Quit....
Press ENTER to exit.....

Click to expand...

Click to collapse

It is not 100% necessary to wipe and start fresh but I expect most other users to be changing ROM's after gaining S-OFF (because you can change your CID). As I said at the start, it's based on my own experience and I always prefer to start fresh with a new ROM unless upgrading. Just flash this in Recovery as you would any normal ROM. I also suggest downloading and running SuperWipe before hand.

Here's the download - http://files.virtuousrom.com/pyramid/misc/rmk-pyramid-stock_ics_3.32.401.3-v1.zip

ALTERNATIVELY - Root your current ROM (again) with the following flashable ZIP - http://downloads.androidsu.com/superuser/Superuser-3.0.7-efghi-signed.zip

3 - Flash boot.img from Stock 3.32 Rooted ROM in Fastboot

As you know, if you flash a ROM with a HTC Unlocked bootloader, it has to be based on the 3.32 firmware and some ROM's you flash won't boot because of this so extract it from the above ZIP and flash it in fastboot (ROM should still boot but pays to be safe).

adb reboot-bootloader
fastboot flash boot /path/to/boot.img
fastboot reboot

Click to expand...

Click to collapse

4 - Download Juopunutbear S-OFF

Here's the download - MOD-Edit: Link removed

5 - Connect phone over USB with debugging enabled

Should be on by default but if not, go to Settings > Develop Option > USB Debugging

6 - Run Juopunutbear S-OFF

Let this run through it's normal procedure, you will see some prompts on your phones screen about X application being granted superuser permissions, this is normal. After about 15-30 seconds your phone will reboot and boot to the Juopunutbear screen (I believe it's a recovery like loader). DO NOT UNPLUG YOUR USB CABLE!

7 - Use Wire-Trick to obtain S-OFF

This is the fun part, make's it really seem like hacking When requested by the application, use the suggested paperclip to join the SD Card casing to the connector as in the image:

Great guide here by XDA member @seb_labine - http://xdaforums.com/showthread.php?t=2133633



This initial confusion myself was that you had to hold it for an awfully accurate 1.75 seconds but that was my mistake. Here's how I got it to work.

NOTE: The below will repeatedly show on screen until you make contact, then it will say Waiting Device (as it reboots).

Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web

Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web

Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web
Waiting device....

Click to expand...

Click to collapse

Create contact for 0.5 Seconds > Release for 1.75 Seconds > Create contact for 0.5 Seconds > Release connection completely.



If done incorrectly (as in the timing is wrong) you will get this message.

Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web
Waiting device....
Found device... Please wait...
Getting into bar.....
Raising Glass
SUCCESS - Taking a sip.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Buddies and Beer
Checking alcohol level......
Let's take one more......
S-OFF Failed
Errorcode: 66732337
ErrorMsg: Still sober
Quit....
Press ENTER to exit.....

Click to expand...

Click to collapse

If so, please close Juopunutbear and reopen it and it will start again.


And a great video guide by kgs1992:


Once it's done successfully, you will see this message...

======== ControlBear version 0.2 for JuopunutBear S-OFF ==========
Starting up......
Making room for beer......
Loading sixpacks on sdcard......
Loaded......
Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web

Waiting device....
Rebooting device
Please wait....
Found device... Please wait...
Getting into bar.....
Raising Glass
SUCCESS - Taking a sip.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Buddies and Beer
Checking alcohol level......
Seems to be just right.....
Let's take one more......
Aaaah, nice sunny day!!
Rebooting.......
Waiting device....
Found device... Please wait...
Rebooting bootloader.......
Waiting device....
Fastboot detected
JuopunutBear S-OFF success
Do you want to install JuopunutBear modified hboot? (y/n)
Installing JuopunutBear hboot.....
Waiting.....
Flashing.......
Rebooting......
JuopunutBear hboot installed
Press ENTER to exit.....

Click to expand...

Click to collapse

Now, that's it and you are done. It will reboot into Bootloader and you will see this:



NOTE: It will say ***LOCKED*** at the top of Bootloader, this is fine because it's S-OFF what's important. The Locked / Unlocked status is for the HTC Dev method.

Congratulations! Now that your in Bootloader with S-OFF, how about a nice new Recovery and change of CID?

Normal - http://download2.clockworkmod.com/recoveries/recovery-clockwork-5.0.2.0-pyramid.img
Touch - http://download.clockworkmod.com/recoveries/recovery-clockwork-touch-5.8.0.9-pyramid.img

fastboot flash recovery /path/to/recovery.img

Click to expand...

Click to collapse

And for the CID (so you can flash any ROM or RUU for latest radios and debranding)?

fastboot oem writecid 11111111 (to change CID)
fastboot reboot-bootloader (bootloader will reboot)
fastboot getvar cid (it will confirm your CID as 11111111
fastboot reboot (to reboot back in your current ROM)

Click to expand...

Click to collapse

Thanks for stopping by and cheers!

Brilliant guide, well done.

Sent from my HTC Sensation Z710e using xda premium

KarlMarX said:

After 20 more times, still no luck.

I got this after the wire trick:

Code:

Do not remove sdcard from phone
Do wire-trick now!! Look instructions at web
Waiting device....
Fastboot detected
Rebooting device
Please wait....
Found device... Please wait...
Getting into bar.....
Raising Glass
SUCCESS - Taking a sip.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Beer is tasty.
SUCCESS - Buddies and Beer
Checking alcohol level......
Let's take one more......
S-OFF Failed
Errorcode: 66732337
ErrorMsg: Still sober
Quit....
Press ENTER to exit.....

That "rebooting device" I don't see in the guide above... Also the phone vibrates like a real new boot up...

Click to expand...

Click to collapse

I've corrected that for you.

Your almost there, now it's just a matter of getting the timing right with the Wire-Trick. Keep at it, I assure you it will work.

BTW, can I ask what you are using to make contact? Are you making quick contact and releasing for about 1.75 seconds and quick contact again? I find it to be better to be on the early side of 1.75 seconds rather than later (in my testing).

Leonardo Monteiro said:

I can enter hboot, but s-on

Click to expand...

Click to collapse

If you can boot into Hboot ypou are not bricked. Boot to Hboot and select fastboot and then use either fast boot commands to flash the boot.img and system.img again.

Edit:Also I have noticed that serveral people in this thread do not understand the difference between HTC Dev unlock and S-off. HTC Dev unlock just unlocks the boot, recovery, and system portitions. The below is quoted from the HTC Dev site.

Why is my security still on (S-On) after I have unlocked my bootloader?

Your device is shipped with Security on (S-ON) to protect your system software configuration (such as the bootloader, radio, boot, recovery, system and others). After you have unlocked the bootloader, however, you will have lifted the restrictions on boot, recovery and system. This means you can customize boot, recovery and system images on your phone as you desire. You can easily see that you have successfully unlocked the bootloader by looking at the top of the screen when entering the bootloader screen. Security is left on to protect things like the radio, and SIM lock.

Click to expand...

Click to collapse

But the catch is that you can not flash a recovery by naming it PG58IMG.zip, placing it on the root of the SD card, and then booting into Hboot so it will flash, you have to flash it via fastboot commands. You can not flash custom kernels through Recovery, you have to flash them via fastboot commands. You can only flash system.img via recovery. You can not flash Radios, Hboot versions, or change your CID when you use the HTC Dev unlock.

With S-0ff you have full read write privileges to the NAND. This includes the boot portitions, system portitions, recovery portitions, radio portitions, and bootloader of the device.

KarlMarX said:

I used several things, like paperclips, wire from a little old computer fan, but the best thing so far seems to be insulated wire used to wrap cables what comes with new electric stuff... And then take some platic of both ends...

I've tried 100 times now.
The fact that I am this far means that there are now problems withs roms and roots etc, am I correct? (I used ARHD, not the stock rom)

Click to expand...

Click to collapse

If you have got to the point of the Wire-Trick, ROM's and Roots are irrelevant because you are well past that. It's just timing. I've done a little GIF for the best timing of the contact. Hope this helps you