↑ Return to Guides

How to Get S-Off


How to Gain S-Off

This guide will go over some of the methods you can use to gain S-Off on your HTC One Phone. This guide mostly applies to AT&T, T-Mobile and International variants of the device types M7 UL and M7 U.  It does not cover Verizon or Sprint which use a different method.  You will have to search the XDA threads to find the methods for those versions.

You need to know your hboot version in order to pick the correct method. You can see your hboot version by holding te power button and volume down button at the same time until your bootloader screen appears.  It should list your hboot version such as 1.44, 1.54, 1.55 etc.

If you are lucky enough to have an older/original hboot that has version 1.44 then the easiest method would be to use the revone tool. The simple noob method for using the revone tool to gain S-off is by using this toolkit:



For most of the advanced modifications you will need working ADB/Fastboot.  This thread has all the info you need on that:


If you are on a MAC/Linux or just want the manual instructions for S-off using revone, they are outlined in the first section of this thread:



Now most of the new HTC One phone models sold now already come with hboot 1.54 which can not gain S-Off with revone, so you will have to take a look at the newly release tool rumrunner which can gain S-Off on hboot 1.54.  The guide for gaining S-Off with rumrunner can be found here:



If you have questions about performing these actions you should use the threads listed above to post questions.

If you are going S-Off you phone, you should also REALLY know what it means.  This is important because S-Off basically disables the built in security checking and gives you direct read/write access to all the partitions on your phone and you can seriously damage or even render your phone useless if you are not careful.  This is a great article on what S-off means and why most modder’s want it:




S-Off is also important for being able to return to phone to complete stock without any trace of modifications.  It is needed to run most RUU files and also need to remove the Tampered flag from your bootloader and to be able to reset your bootloader status to the original LOCKED, instead of just RELOCKED which is what is shows if done with S-On.


Skip to comment form

  1. Jared Guthrie

    I’m trying to get S-Off with hboot 1.55. Is this possible? I would assume so because it is listed here as an option. However, when I run RumRunner it fails. I have gone through the check list mentioned on the RumRunner guide on XDA. I forget exactly where it failed. I tells me to “Press Enter” at one point and the CMD prompt just quits.

    1. Roan

      I managed to get S-OFF with hboot 1.55 using rumrunner. My HTC One M7 is running ViperOne 7.0.1. I didn’t have any problems..

  2. Eddy

    I’m trying to get S-Off. I’m on HBOOT 1.44.0000 with software number 1.36.600.1.

    Anyway after reading a LOT of threads on XDA and other sites, I haven’t been able to achieve S-Off, not with revone, neither Firewater (rummrunner only works on 1.54 and up). I read somewhere that there are two versions of HBOOT 1.44 one that works with revone and an older one (june 2013) that doesn’t.

    I guess I’m stuck since I can’t change my HBOOT because I’m not S-off. They only reason I need S-Off now is to Flash a Google Edition ROM for my HTC One and try if Miracast works with that beacuse with both ARHD 31.1 and 50.0 it doesn’t work (tried two diferent TVs). I also think this might be fixed upgrading my firmware but I need S-off for that as well. So if anyone has a solution to make mircast work on ARHD sense ROMs I’ll use that and stop trying to S-off.

    Any help would be appreciated.

  3. 2banee

    I’m running into the same problem. Unfortunately I installed Google Edition ROM on my HTC1 prematurely without S-Off and got stuck in a boot loop condition. So the question still exists, with HBOOT -1.55.0000 how do I achieve S-Off to flash my ROM so it will work.

    1. synth505

      Man I am in the same boat. I unlocked my phone, attempted to install twrp recovery and it failed to open. So I reflashed stock recovery. I did the OTA 4.4.2 update and I got the dreaded red “!”. The phone shutoff and rebooted but got stuck in a bootloop. Shutoff phone went back into bootloader and using fastboot I cannot push the official RUU onto my phone to get it completely back to factory on android 4.3. I get a failed message “FAILED (remote: 12 signature verify fail)”. I can lock and relock my bootloader but I cannot find any way to s-off from within the bootloader. My HBOOT is also 1.55.

  4. synth505

    I might have a solution for you. Depending on what your firmware was prior to flash you can run the official RUU.exe and set your phone back to stock jellybean 4.3, s-off, then reflash google edition. I was under the impression that you couldn’t flash a ruu without being s-off but apparently you can if it is an encrypted .exe file. Don’t try to push the decrypted.zip because it will not push with s-on signature verification. I hope this helps. If you were not on 4.3 prior to the botched flash, just google your firmware and look for the .exe package. Heres the link: (this is for Sprint btw) http://forum.xda-developers.com/showthread.php?t=2576995

  5. haseef

    i got the same prob i can s off my htc one hboot 1.55 some one help

  6. Miguel

    Hola yo igual no consigo s-off en mi htc one m7 hboot 1.55 de vodafone españa, si alguien puede ayudarme con un tutorial especifico lo agradecería, ya intentado con rumrunner pero se queda en el segundo reinicio y enseguda me sale ENTER EXIT… y no consigo s-off :-(

    1. Roan

      Yo lo pude conseguir usando rumrunner en mi HTC One M7 hboot 1.55 con la ROM ViperOne 7.0.1. No tuve ningún problema y funcionó a la primera.

  7. Thwarting

    Hi, I have htc one running 4.2.2 rooted, but I would like to update to kit kart. I have tried to s off my phone in order to install official run. However when I was running rum runner, it showed that the phone is not rooted or lacks unsecured kernel. What should I do, pls help me.

  8. Hensh73

    My M7 has recently had an update and my Hboot is 1.57.0000, what should I use to S-Off my phone?

    1. crushalot

      Try searching XDA for Firewater. I know that can S-Off hboot 1.56 but I am not sure about 1.57.

  9. Ryanking17

    Will making my phone s off wipe it?

  10. crt7981

    guys my htc desire 601 shows hboot-
    please help me !

  11. none

    Nice guide, if ONLY it showed how to do this!!!

  12. Shalim

    How to off htc one m7 S-Off hboot 1.56 ?

    1. Manish

      Did you get any replies.. I am in same situation. Rumrunner and revone is not working.

  13. jose

    se puede hacer s-off a hboot 1.57?

  14. Manish


    I have same problem, I have Hboot 1.56 with Android Revolution HD custom stock ROM for my M7, I want to revert everything to factory firmware. Anyone please help.

  15. Rudy Priego

    How to get S-OFF HBOOT from 1.57? or How to change HBOOT 1.57? (Downgrade)

  16. Serban

    CID T-MOB101 / HBOOT 1.55.000
    S-OFF NOT working, although I tried with both firewater and rumrunner.
    Anyone with the same situation, but successfully S-OFF? :)

    1. Daaaf

      I have T-mob101 Hboot 1.55 too.

      Did you have any luck yet?

  17. rudy vargas

    tengo la misma situacion HBOOT 1.56 y quiero vovler a la rom de fabrica. Alguien ha podido hacer s-off??

  18. Android

    How to s-off HTC one 802d with hboot 2.49 tried firewater but says HTC anti firewater patch is installed please try different kernel .
    Flashed a different kernel but did not help.
    What should I do now??
    Please help me??

  19. Darren Calistro

    Heybrother, look as though your hands are full. I have a Tmobile Htc One. ModelIDNUm Pj4011000, Cidnum T-Mob010, VLE, PVT,SHIP,
    S-ON, RL.HBOOT-2.15.0000, RADIO-, OpenDSP-ver31., eMMC-boot, Dec 14 2012,17:10:57:-1. It might as well be theMotorola brickphones of the lat 80’s, cuz with out gettin the s-off, none of the roms I load stick. Any help will be awesome. Your friend from Hawaii, Darren.

  20. sweetpeefume

    htc desire 601
    imie null null

  21. Roan

    I used rumrunner on my HTC One M7 running ViperOne 7.0.1 and it worked perfect for me. Now I’m S-OFF!!!!!!

    1. John

      what hboot version are you on?

  22. Origin

    Is there a solution for Hboot 1.57 on M7? I have tried a few ROM and kernel combos and no s-off. Goes through all bottles with firewater.

  23. Sam

    Hi I have HTC M7CDWG will I be able ti install this ROM. and bring my device back to stock. the CID says HTC__038

  24. TF85

    I can’t get the S-OFF for my M7.
    I tried many couples Custom ROMs/kernels.
    Perhaps for the M7 having :
    – hboot 1.57
    – OS starting with 6
    the Firewater and Rumrunner can’t do it now ?
    best regards

  25. Rudy Priego

    Nunca he podido lograr S-Off en el HTC One (M7_UL), con HBoot 1.57. He intentado con “Firewater” pero no funciona. Ojala puedan ayudarme, mi dispositivo es el siguiente:

    HTC One (M7_UL)
    Carrier ID: BS_US001.
    Modelo: PN07130000.
    HBoot 1.57.0000.
    Radio: 4A.20.3263.16.

    Quiero dejarlo S-Off para convertirlo en una versión libre.

  26. Rudy Priego

    I’ve never been able S-Off in the HTC One (M7_UL) with HBoot 1.57. I tried with “Firewater” does not work. Hopefully you can help me, my device is as follows:

    HTC One (M7_UL)
    Carrier ID: BS_US001.
    Model: PN07130000.
    HBoot 1.57.0000.
    Radio: 4A.20.3263.16.

    I want to leave S-Off to turn it into a free version and install an official RUU.

    1. JJlove

      This should help you achieve S-off

      You can only achieve S-off with rumrunner for free nowadays. Rumrunner only supports up to hboot 1.55 so they say. I have made this work a few times, If you have an HTC one m7 with android version 4.4.2 and hboot 1.57 “Not 4.4.3” you should be able to s-off.

      So if you have android 4.4.3 on your one m7 you have to dev unlock your phone at HTC dev then flash a custom recovery, boot from a custom recovery, flash “Setmainversionlow.zip then relock your bootloader and flash the 4.4.2 ruu for your M7 type with hboot1.57. After you flash it to 4.4.2 reunlock your bootloader flash the custom recovery again use a custom rom call AndroidrevolutionHD 7.1 boot into that rom then run Rumrunner and follow the instructions and it should S-off hboot 1.57.

      1. SHAAN

        are you sure about androidrevolutionHD 7.1 ??i’m asking because this particular custom rom is for desire HD phone not for one m7..for one m7 there is androidrevolutionhd 82.0(4.4.3) and 6.1 (4.4.2)…

        1. JJlove

          I could swear it was but it doesnt really matter as long as the “Kernel” is insecure. Also everyone who reads this should remember that “whelp” errors can happen even with hboot 1.55. Basicaly to break it down, when you run rumrunner, it only supports 12 one m7 motherboard types. There are more then 12 types and if your phone came with 4.4.3 out of box, there is a greater chance of getting an unsupported motherboard type. I am basically saying that my steps above aren’t for everybody but should work for most in the situation where they aren’t on 5.0 yet but dont want to pay for sunshine.

    2. JJlove

      To clarify my above reply. With the firmware that contains 4.4.2 and hboot 1.57. the kernel is the only thing standing in the way of you achieving s-off. The hboot 1.57 is also patched with the 4.4.3 ota “basically there are 2 different 1.57 hboots”. The beauty of satmainversionlow.zip is that you can trick HTC into downgrading to an older main version and since 4.4.2 and 4.4.3 have 1.57 hboot, you can trick HTC into flashing the less secure 1.57 that came with the 1st sense 6 RUU. So at the end of the day, they are both 1.57 HTC wont care about flashing that older 1.57 hboot because it thinks you have a lower main version. Try that and you should have s-off for free.

  27. Rahul

    Firewater has been discontinued.

    So is there any alternative to Firewater for HBOOT 1.57 ???

    Please !!!!! anyone ??

  28. matias

    This may be a stupid question but can you do this with a Mac? I have hboot 1.54 and rumrunner doesn’t seem to have a mac version.

  29. mykoden

    hi i have hboot 2.19.0000 what method should i use ? :(((( please help

  30. mykoden

    i forgot to specify i have htc one mini m4

  31. Buds

    Hi everyone!

    I’m trying to s-off htc one dual sim 802d on hboot 2.49. can anyone please help me out where to start from. i’ve been searching for ages for a way to s-off my device. Thanks.

    1. Buds

      I forgot to add that i’m already rooted and have unlocked bootloader.

  32. Rob

    SunShine was the only thing I could find that actually worked to gain S-off, but it cost $25.00.

  33. sina

    hey there,
    when i try to do something with the htc one toolkit,it say :adb push revone /data/local/tmp/
    error: device not found
    what should i do?

    1. sina

      i forgot to say that im using HTC one m7 U

  34. towhidabid

    Hello. I have HTC One m7 with hboot 1.56 anyone can help me gaining s-off ?

  35. sleeve.Elo.me

    Hey there, You’ve done a ggreat job. I will definitely digg it and personally recommend to my friends.
    I am sure they will be benefited from this website.

  36. Orestes Sto. Tomas

    Details of my phone:

    Model – M7_UL
    Build — 7.19.771.1
    CID – H3G_001
    Hboot – 1.61.0000
    MID – PN0710000

    Has anybody worked with this Hboot before? I need to get S-Off

    Pls. . . . . .

  37. The one

    I have tried to get s-off on hboot 1.57 but have not succeed, have tried many combinations of kernels, roms and s-off tools but none have worked? any help please?

    1. JJlove

      As I stated above. Make sure you have the 4.4.2 ruu installed with 1.57 hboot if your on 4.4.3 you have to downgrade using setmainversionlow.zip and then try insecure kernels and so forth. Also some of the rare HTC one m7s generate WHELP and in that case, your screwed.

  38. Esterlin

    Hi there!, I have a htc one m7 and I want to make it be S-OFF and then upgrade it to kk4.4 but i have hboot 1.61.000, I am unable to make it with ruu because of I’m unable to downgrade the hboot.

    I hope you to help me, if you need some information contact me by here


    1. Esterlin

      Before I tried to install one OS, but i got a brick and then i took one rom from here but it is JB 4.1.2

  39. Hidig

    i have an htc one with HBOOT 1.61.0000 and running on lollipop 5.1 any idea how i can S-off

    1. JJlove

      Sunshine S-off $25 dollars at the door but your phone will be s-off

  40. Michael

    Wonderful post! Ԝе wikl bе linking to this ǥreat content
    on oսr site. Keep up the ցreat writing.

  41. ALLEN

    (bootloader) version: 0.5
    (bootloader) version-bootloader: 1.61.0000
    (bootloader) version-baseband: 4T.35.3218.16
    (bootloader) version-cpld: None
    (bootloader) version-microp: None
    (bootloader) version-main:
    (bootloader) version-misc: PVT SHIP S-ON
    (bootloader) serialno: FA35NW924593
    (bootloader) imei: 354436058227156
    (bootloader) meid: 00000000000000
    (bootloader) product: m7_ul
    (bootloader) platform: HBOOT-8064
    (bootloader) modelid: PN0710000
    (bootloader) cidnum: ORANG001
    (bootloader) battery-status: good
    (bootloader) battery-voltage: 4159mV
    (bootloader) partition-layout: Generic
    (bootloader) security: on
    (bootloader) build-mode: SHIP
    (bootloader) boot-mode: FASTBOOT
    (bootloader) commitno-bootloader: dirty-0e2a13e5
    (bootloader) hbootpreupdate: 11
    (bootloader) gencheckpt: 0
    all: Done!
    finished. total time: 0.117s

    PLS HELP ME……. I want to gain S-OFF and ROOT my phone.
    tellme what to do.

    1. Sansiro

      Use Sunshine

    2. alomgir

      my htc one m7 sim network

  42. Sansiro

    ALLEN you need to use sunshine to get soff on 1.61 $25

  43. alomgir

    htc one tm

  44. alomgir

    my htc one m7 sim network are not working

  45. alomgir

    my htc one m7 sim network is not working

  46. alomgir

    my htc one m7 sim network posas

  47. Rob Williams

    Ok. Here is what I have. A HTC phone that shows htc screen goes to boost mobile logo then backstop htc screen where it stays.
    eMHC-boot 1024MB
    AUG 18 2015,131:32:53.0



  48. mark mendiola

    hi, i have a HTC one mini stuck on bootloader loop “locked” and s-on i cant get fix, phone was bought in taiwan, what are the proper steps to fix this. what tools do i need to make it work here in the philippines.. no one can fix it here.. help pls, guys.. thank you

Leave a Reply

Your email address will not be published. Required fields are marked *