Update 1: Before following this guide, you should try using the tool from http://firewater-soff.com to obtain S-OFF. If it does not work then proceed with the following guide.
I do NOT take any credit for this guide.
You can thank BD619 for walking me through all this and the updated command, Indirect for the original commands, benny3 for his awesome ROM, O.M.J for his 3.04.651.2 RUU and for his 3.05.651.6 Firmware, and RumRunner for their awesome S-Off tool!
Also, if anything goes wrong I can try to help you, but the only person responsible is yourself for not following the guide 100%. I have done this all myself and it worked like a charm.
After 3.04.651.2, attempting to achieve S-Off with rumrunner will fail every time after the pouring 8 stage. This guide will show you how to change your version number in order to install an older RUU. After installing the older RUU, then you can proceed to unlock the bootloader, download benny3's Stock ROM (Link Below), flash it after a full wipe, and finally run rumrunner again with success. From there you can optionally update your firmware (Link Below) and flash a ROM of your choice. Once official kitkat is released this guide will not work because the hboot will be different than the one found in the RUU
Changing the Mainver
Before doing all of this, you should backup all your applications and other data with Titanium Backup which can be found in the Play Store. Once your backup is complete, you must copy the titanium backup folder found on your internal storage to your computer because the RUU will wipe the entire storage. Copy any other things you may need including Photos, Music, and Downloads to your computer so you can restore them later. Also, make sure you are on hboot 1.55. I have not tested this with any other hboot but it is confirmed working on hboot 1.55.
1. Make sure the ADB drivers are set up properly in recovery. I used TWRP but other recoveries should be fine.
2. Boot into recovery and connect the phone to the computer.
3. Open the command prompt, and type in adb devices A string of letters and numbers should pop up. This is only to test the ADB drivers and make sure they are working properly.
4. Now type adb shell and press enter.
5. Now type this exactly as it is here echo "3.04.651.2" | dd of=/dev/block/mmcblk0p19 bs=1 seek=160 with the quotes around the version number. After entering the command, it will say failed in the window but just ingnore that.
^^^I recommend you copy and paste to avoid typos.
6. Now enter adb reboot bootloader into the prompt. Your phone will now reboot bootloader and you should see your version number changed to 3.04.651.2.
7. As most of you may know, in order to install a RUU you must relock the bootloader, so click on fastboot on the phone and make sure it says fastboot usb. From here type in fastboot oem lock. Now the bootloader is locked.
Essentially, all we did up to this point is change the version number in order to trick the RUU into installing, and lock the bootloader also for the RUU to work.
Installing the RUU
8. Now you have to download the 3.04.651.2 RUU from http://xdaforums.com/showthread.php?t=2508907. The zip or exe is fine. Do not use the decrypted version.
9. Once downloaded, put the phone into fastboot usb mode, and run the exe. If you downloaded the zip, follow the instruction in the link above to install it.
Flashing the custom ROM
10. Once the RUU is complete you will have to download benny3's ROM from http://xdaforums.com/showpost.php?p=47048176&postcount=2. Either odexed or deodexed is fine. I personally chose odexed but it does not matter. Once downloaded make sure the ROM is not corrupt by matching the MD5 codes, or simply opening the zip.
11. We cannot install yet however because the RUU restored the stock recovery and the bootloader is locked.
12. Unlock the bootloader by following the instructions at http://www.htcdev.com/bootloader
13. Once the bootloader is unlocked we can now flash a custom recovery. Download TWRP 2.6.3.0 from http://techerrata.com/browse/twrp2/m7wls Once it finished put phone into fastboot usb, copy the TWRP img you just downloaded into the fastboot command prompt folder, open fastboot command prompt, and type in fastboot flash recovery recovery.img Replace recovery.img in the command with the actual name of the file.
14. Once the custom recovery is installed boot into Android and copy the downloaded ROM into the internal storage, boot into recovery and do a full wipe (Dalvik Cache, Cache, Data, System). Do NOT wipe the internal storage!
15. Go back and tap install. Select the ROM you placed in the internal storage in step 11. Once it is flashed clear the dalvik cache and reboot the system.
Running RumRunner
16. Before you run RumRunner, confirm all drivers are working correctly by testing adb and fastboot commands in recovery, fastboot, and the OS. Enable USB Debugging in developer options. Set auto sleep to the maximum of ten minutes. Go to personalize, and choose the no lockscreen setting. Go to settings, power, and make sure fastboot is NOT checked. Disable firewall and anti virus programs on your computer. Run the SuperSu app and make sure all SU Binaries are updated.
17. Once you've done everything above, you can download RumRunner 0.5 from http://rumrunner.us/downloads-2/ Make sure phone is connected to PC in ADB mode, and run soju.exe as administrator. Follow the onscreen instructions.
18. Once RumRunner is complete your phone will reboot to bootloader and report S-Off.
Updating Firmware
19. Now that you are S-Off, we can move on and update the firmware. Download the Full unmodified Firmware (fastboot flashable) from http://xdaforums.com/showthread.php?t=2576995 Follow the instructions in the link for a guide on how to flash the firmware.
20. Once your firmware is updated if you reboot into the OS, your touchscreen may not respond. Do not worry about that it will be fixed soon.
Flashing A Custom ROM
21. Find a ROM of your choice in the android development section or the android original development section. The ROM you choose MUST be a Sprint ROM.
22. Copy the ROM to your internal storage, reboot to recovery. and do a full wipe (Dalvik Cache, Cache, Data, System). Again, do NOT wipe the internal storage!
23. Once the wipe is complete, flash the ROM you chose and clear the dalvik cache. Reboot system and you should be good to go. Remember, the first boot takes a bit longer than usual. Give it a good ten minutes before getting worried.
24. At this point you could copy your titanium backup folder back into the internal storage. Install titanium backup from the Play Store, open it, go to menu>preferences, scroll down to backup folder location, tap it and find the backup folder you just copied to your storage. Now you can restore all the apps and data you backed up. Also, you can copy all the other things you backed up to the computer.
I know this is a long guide, but the process above works 100%, and I tried to include as many details as possible. If you have any suggestions, please let me know. Also, if anyone runs into any problems, post it in the comments and maybe someone can help you.
I do NOT take any credit for this guide.
You can thank BD619 for walking me through all this and the updated command, Indirect for the original commands, benny3 for his awesome ROM, O.M.J for his 3.04.651.2 RUU and for his 3.05.651.6 Firmware, and RumRunner for their awesome S-Off tool!
Also, if anything goes wrong I can try to help you, but the only person responsible is yourself for not following the guide 100%. I have done this all myself and it worked like a charm.
After 3.04.651.2, attempting to achieve S-Off with rumrunner will fail every time after the pouring 8 stage. This guide will show you how to change your version number in order to install an older RUU. After installing the older RUU, then you can proceed to unlock the bootloader, download benny3's Stock ROM (Link Below), flash it after a full wipe, and finally run rumrunner again with success. From there you can optionally update your firmware (Link Below) and flash a ROM of your choice. Once official kitkat is released this guide will not work because the hboot will be different than the one found in the RUU
Changing the Mainver
Before doing all of this, you should backup all your applications and other data with Titanium Backup which can be found in the Play Store. Once your backup is complete, you must copy the titanium backup folder found on your internal storage to your computer because the RUU will wipe the entire storage. Copy any other things you may need including Photos, Music, and Downloads to your computer so you can restore them later. Also, make sure you are on hboot 1.55. I have not tested this with any other hboot but it is confirmed working on hboot 1.55.
1. Make sure the ADB drivers are set up properly in recovery. I used TWRP but other recoveries should be fine.
2. Boot into recovery and connect the phone to the computer.
3. Open the command prompt, and type in adb devices A string of letters and numbers should pop up. This is only to test the ADB drivers and make sure they are working properly.
4. Now type adb shell and press enter.
5. Now type this exactly as it is here echo "3.04.651.2" | dd of=/dev/block/mmcblk0p19 bs=1 seek=160 with the quotes around the version number. After entering the command, it will say failed in the window but just ingnore that.
^^^I recommend you copy and paste to avoid typos.
6. Now enter adb reboot bootloader into the prompt. Your phone will now reboot bootloader and you should see your version number changed to 3.04.651.2.
7. As most of you may know, in order to install a RUU you must relock the bootloader, so click on fastboot on the phone and make sure it says fastboot usb. From here type in fastboot oem lock. Now the bootloader is locked.
Essentially, all we did up to this point is change the version number in order to trick the RUU into installing, and lock the bootloader also for the RUU to work.
Installing the RUU
8. Now you have to download the 3.04.651.2 RUU from http://xdaforums.com/showthread.php?t=2508907. The zip or exe is fine. Do not use the decrypted version.
9. Once downloaded, put the phone into fastboot usb mode, and run the exe. If you downloaded the zip, follow the instruction in the link above to install it.
Flashing the custom ROM
10. Once the RUU is complete you will have to download benny3's ROM from http://xdaforums.com/showpost.php?p=47048176&postcount=2. Either odexed or deodexed is fine. I personally chose odexed but it does not matter. Once downloaded make sure the ROM is not corrupt by matching the MD5 codes, or simply opening the zip.
11. We cannot install yet however because the RUU restored the stock recovery and the bootloader is locked.
12. Unlock the bootloader by following the instructions at http://www.htcdev.com/bootloader
13. Once the bootloader is unlocked we can now flash a custom recovery. Download TWRP 2.6.3.0 from http://techerrata.com/browse/twrp2/m7wls Once it finished put phone into fastboot usb, copy the TWRP img you just downloaded into the fastboot command prompt folder, open fastboot command prompt, and type in fastboot flash recovery recovery.img Replace recovery.img in the command with the actual name of the file.
14. Once the custom recovery is installed boot into Android and copy the downloaded ROM into the internal storage, boot into recovery and do a full wipe (Dalvik Cache, Cache, Data, System). Do NOT wipe the internal storage!
15. Go back and tap install. Select the ROM you placed in the internal storage in step 11. Once it is flashed clear the dalvik cache and reboot the system.
Running RumRunner
16. Before you run RumRunner, confirm all drivers are working correctly by testing adb and fastboot commands in recovery, fastboot, and the OS. Enable USB Debugging in developer options. Set auto sleep to the maximum of ten minutes. Go to personalize, and choose the no lockscreen setting. Go to settings, power, and make sure fastboot is NOT checked. Disable firewall and anti virus programs on your computer. Run the SuperSu app and make sure all SU Binaries are updated.
17. Once you've done everything above, you can download RumRunner 0.5 from http://rumrunner.us/downloads-2/ Make sure phone is connected to PC in ADB mode, and run soju.exe as administrator. Follow the onscreen instructions.
18. Once RumRunner is complete your phone will reboot to bootloader and report S-Off.
Updating Firmware
19. Now that you are S-Off, we can move on and update the firmware. Download the Full unmodified Firmware (fastboot flashable) from http://xdaforums.com/showthread.php?t=2576995 Follow the instructions in the link for a guide on how to flash the firmware.
20. Once your firmware is updated if you reboot into the OS, your touchscreen may not respond. Do not worry about that it will be fixed soon.
Flashing A Custom ROM
21. Find a ROM of your choice in the android development section or the android original development section. The ROM you choose MUST be a Sprint ROM.
22. Copy the ROM to your internal storage, reboot to recovery. and do a full wipe (Dalvik Cache, Cache, Data, System). Again, do NOT wipe the internal storage!
23. Once the wipe is complete, flash the ROM you chose and clear the dalvik cache. Reboot system and you should be good to go. Remember, the first boot takes a bit longer than usual. Give it a good ten minutes before getting worried.
24. At this point you could copy your titanium backup folder back into the internal storage. Install titanium backup from the Play Store, open it, go to menu>preferences, scroll down to backup folder location, tap it and find the backup folder you just copied to your storage. Now you can restore all the apps and data you backed up. Also, you can copy all the other things you backed up to the computer.
I know this is a long guide, but the process above works 100%, and I tried to include as many details as possible. If you have any suggestions, please let me know. Also, if anyone runs into any problems, post it in the comments and maybe someone can help you.
Last edited: