Apr 15, 2011


What is S-OFF?

After doing your phone S-OFF, you do set follow functions on factory settings

- sim lock
- hboot lock ( this is the bootloader lock, you will be able flash cooked rom after this)
- cid lock (region lock so you can't flash it with other roms, unbrand it, or downgrade it)
- user lock (will be set to factory default)
- pattern lock (will be set to factory default)
- phone usage counter (helps you refurbish the phone)

Temproot and Permaroot
- What's the difference?
First, let me explain root access. Root access, superuser or su (all the same thing) is basically an admin account for Linux. It gives us permission to to access commands that normally couldn't be accessed, and to write information to partitions that normally couldn't be written to. On older devices (such as the Hero), once we had root we could write to the /system and /recovery partitions, and flash custom ROMs. In the case of the IS (and every HTC device since the desire), this isn't true. Getting root access is quite trivial and no where near as useful, because the internal flash memory (NAND or eMMC) is locked down and it means we everything we 'write' to the system (or any other protected partition) is lost on reboot because it is a non permanent change. In short, this stops us from flashing custom ROMs and recovery. This is a problem for any devices that are shipped with the Security flag on (S-ON). To get Permaroot, and the ability to flash custom ROMs, we need S-OFF.

So what's this S-OFF then?
Making the phone S-OFF with XTC clip, means also that you reset the simlock, userlock and CID to factory state !!! Mean, your phone is 100% UNLOCKED
Since the Desire, HTC have been securing their phones better than before by locking the internal flash memory (NAND or eMMC) to stop it being written to, unless the file being flashed is signed by a private key only known to HTC. This is controlled by a flag (@secuflag) and is identified as the device being S-ON. Telling the HBoot the device is Security Off (S-OFF) stops this check for the key, and allows us to write anything to any partition, which is what we are aiming for.

There are actually two levels of S-OFF. The Bootloader (HBoot) and the Radio. Getting S-Off on the HBoot gives us everything we need, but doesn't actually turn off the @secuflag which is set in the radio. What it is possible to do is to flash a HBoot that believes the Radio is set to S-OFF, as the HBoot is responsible for setting that flag. Once the HBoot on the phone is S-OFF, we can write to all the partitions and basically do whatever we want, but it is possible to go one step further. Flashing a radio that is S-OFF and actually setting the @secuflag off gives 100% total access to every part of the phone and it's software, as it becomes network unlocked allowing to you to use any SIM and also allows you to flash a ROM from any carrier (known as Super CID). It also makes it nigh on impossible to permanently loose root no matter what you flash. Once you have radio S-OFF, it makes it much easier to flash new HBoots and ROMs even if you flash something that is locked down tight.

Setting the Radio to S-Off is not necessary, and gaining S-OFF on the HBoot is more than most people will ever need. Radio S-Off is just the last step of the puzzle, but it is worth noting the only points you can permanently brick your phone is flashing a radio or a HBoot, if either of these go wrong you will end up with a shiny expensive paper weight so there is risk involved.

What about this XTC Clip, can that help?
The XTC clip is a hardware device that can unlock S-OFF HTC phones, regardless of the software.

S-OFF created by XTC Clip is temporary or permanent?
You can flash your phone as many times you want, your HTC will remain S-OFF forever, it is a permanent S-OFF !!!

What about people who are getting devices shipped with S-OFF?
There are reports that a lot of devices coming out of China and India are shipping with the @secuflag set off. These are lucky people, and have the ability to write to the flash memory, but it can't help those of us who are S-ON. It is also worth noting that because most devices are S-ON, no one has written any ROMs or kernels for the device so they will probably have to wait until we get a way of turning our devices to S-OFF until anyone creates any software for it.


Bootloader a.k.a HBoot
- This is the piece of software that runs before anything else on the phone. It basically packages it all up, tells what to run in what order e.t.c Every computer device has a bootloader in some form or another, be it an Android Phone, iPhone, Windows PC, iMac e.t.c. The HBoot is accessible by switching your phone off, then holding down volume down as you turn it back on. The first line of the HBoot will tell you if you are S-OFF or S-ON.

- The recovery is the piece of software that allows us to write files to partitions while they aren't being used. It is the portal to allow us to flash custom ROM's and kernels. There are custom recoveries with more options than the stock such as ClockworkMod.

Superuser a.k.a su or Root
- This is a user that is present on all linux distros that allows higher permissions than standard users have access to. Certain apps need superuser permissions to function, such as Titanium Backup.

parts of this FAQ are "taken" from l0st.prophet @ , 10x