[How-To] From S-OFF to 100% Stock S-ON [Facepalm/JTAG/RevOne/Moonshine/Rumrunner] - HTC Droid DNA

ONLY FOLLOW THIS GUIDE FOR WARRANTY REPLACEMENTS OR IF YOU NEED TO BE STOCK FOR A SALE. THERE IS NO OTHER REASON TO FOLLOW THIS GUIDE.
ALSO MAKE SURE YOU FOLLOW THE GUIDE PROPERLY. FAR TOO MANY ERRORS ARE BEING MADE BY NOT READING OR FOLLOWING STEPS IN ORDER.
This guide will help you get your phone back to stock after using any of the 5 S-Off methods that either have been or are currently available to us.
Credit to Scotty1223. I edited his One S guide for the DNA.
First post is for Facepalm and JTAG S-off only. RevOne instructions are in the second post. Moonshine and Rumrunner is in post 3.
***IF YOU HAVE A CUSTOM SPLASH SCREEN INSTALLED, THE STOCK SPLASH SCREEN MUST BE FLASHED BEFORE DOING ANYTHING! SEE FOURTH POST FOR LINKS AND INSTRUCTIONS FOR FLASHING THE STOCK SPLASH SCREEN***
***DO NOT ISSUE ANY OF THE WRITESECUREFLAG COMMANDS ON AN ENG HBOOT AS IT WILL BRICK THE DEVICE. JUST FOLLOW THE GUIDE.***
For those who want to return to stock and have used the JTAG method for achieving S-Off, this guide will also work for you. It all depends on what you did AFTER you got your JTAG phone back. If you wrote a new CID using fastboot and HTCDev unlocked, follow the guide as it is written out.
If you didn't write a new CID and use HTCDev unlock and just merely flashed a modified/ENG HBOOT, then the process would be: Fastboot flash stock hboot, RUU to stock, fastboot oem writesecureflag 3, then allow phone to update using the OTA process. You can find the commands/files/steps for these 3 simple steps below as well.
Files needed:
Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU
Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.
IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4
3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)
adb reboot bootloader
fastboot devices (your device should be listed)
fastboot oem writecid VZW__001 (2 underscores)
fastboot reboot-bootloader
fastboot getvar cid (verify your stock CID)
fastboot oem writesecureflag 3
fastboot reboot-bootloader
*verify you are locked s-on
fastboot reboot
Should now be 100% stock, S-ON, with CID 100% stock as well.

---

Returning to stock from RevOne
It is pretty much the same process, but with a slight deviation.
AGAIN, IF YOU HAVE A MODIFIED/ENG HBOOT, DO NOT ISSUE ANY WRITESECURE FLAG COMMANDS. JUST FOLLOW THE GUIDE.
First, download these two files:
Files needed:
Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU
Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED** If not, re-flash the zip. If still not locked, try downloading the file again and re-flashing.
IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4
3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)
adb reboot bootloader
fastboot devices (your device should be listed)
fastboot oem writesecureflag 3
fastboot reboot-bootloader
*verify you are locked s-on
fastboot reboot
You are now out of box stock.

---

Return to stock on Moonshine, Rumrunner and Firewater S-Off
Files needed:
Lock bootloader zip: lock bootloader MD5: f335f78f9f46469c823da0c671026de5
3.06 RUU: 3.06 RUU
Steps:
1.Copy the "lock bootloader zip" onto root of internal storage and flash in recovery of your choice. Once it is flashed Reboot your phone.
2.Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
You are locked. The s-off process removes the flag from displaying, but it is now locked.
IF YOU ARE RUNNING ANY HBOOT THAT IS NOT THE 3.06 HBOOT (1.54 in bootloader), YOU MUST FLASH 3.06 HBOOT BEFORE CONTINUING - SEE POST 4
3. run the RUU as admin (right click, run as administrator)
4. After RUU completes and phone reboots, make sure usb debugging is on and in charge only mode and open cmd prompt
5. Run the following:
Code:
adb devices (your device should be listed)
adb reboot bootloader
fastboot devices (your device should be listed)
fastboot oem writesecureflag 3
fastboot reboot-bootloader
*verify you are locked s-on
fastboot reboot
You are now out of box stock.

---

FLASHING THE STOCK HBOOT:
*Credit to .torrented*
1. download 3.06 HBOOT: 3.06 HBOOT
2. Rename stock hboot file to : PL83IMG.zip and place in the folder that contains your fastboot.exe file (On your computer)
3. Flash hboot
Code:
Step 1) adb reboot bootloader
Step 2) fastboot oem rebootRUU
Step 3) CD to directory containing hboot zip (i.e. cd C:\sdk\)
Step 4) fastboot flash zip PL83IMG.zip
*** When it says it is done in the terminal/cmdprompt execute the following ***
[The green bar only fills up about 75% of the way]
Step 5) fastboot reboot-bootloader
Flashing the Stock Splash Image
*All credit goes to E.T.Heil
1. Download the stock splash image here.
2. Rename file to splash1.img
3. Place the file in the same folder you have adb.exe and fastboot.exe located.
4. Plug in your phone to a USB port, turn on USB debugging and open a command prompt. cd to the directory your adb/fastboot is located
5. Run the following:
Code:
adb devices (your device ID should be displayed)
adb reboot bootloader
Once in the bootloader, run:
Code:
fastboot flash splash1 splash1.img
Once complete, reboot the phone using the menu or
Code:
fastboot reboot

---

updated with RevOne and Moonshine...
If anyone sees anything I missed let me know. Otherwise guide is complete.

---

Thank you so much for making this post. This is exactly what I needed. I am not quite sure which method I uses but it was the first one that required changing the CID, unlocking via htc dev and all that stuff. Would that be facepalm? Sorry if this is a dumb question, it was so long ago that I don't quite remember.

---

Imacellist said:
Thank you so much for making this post. This is exactly what I needed. I am not quite sure which method I uses but it was the first one that required changing the CID, unlocking via htc dev and all that stuff. Would that be facepalm? Sorry if this is a dumb question, it was so long ago that I don't quite remember.
Click to expand...
Click to collapse
Yes that was the Facepalm method. So follow the OP guide for that.

---

I love you! (no homo).

---

when i run RUU i get error 155 so i tried to flash the 1.15 hboot and i get this error in cmd
D:\Documents and Settings\Jonathan\My Documents\HTC\adt-bundle-windows-x86-20130
219\sdk\platform-tools>fastboot flash zip PL83IMG.zip
sending 'zip' (2047 KB)...
OKAY [ 0.375s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) shift signature_size for header checking...
FAILED (remote: 32 header error)
finished. total time: 0.562s
am i doing something wrong? i want to get my phone back to complete stock because i flashed a rom after moonshining without making a backup first. so i really want to get to stock so i can do the whole process over again (moonshine again if needed)

---

Prodiigy said:
when i run RUU i get error 155 so i tried to flash the 1.15 hboot and i get this error in cmd
D:\Documents and Settings\Jonathan\My Documents\HTC\adt-bundle-windows-x86-20130
219\sdk\platform-tools>fastboot flash zip PL83IMG.zip
sending 'zip' (2047 KB)...
OKAY [ 0.375s]
writing 'zip'...
(bootloader) zip header checking...
(bootloader) shift signature_size for header checking...
FAILED (remote: 32 header error)
finished. total time: 0.562s
am i doing something wrong? i want to get my phone back to complete stock because i flashed a rom after moonshining without making a backup first. so i really want to get to stock so i can do the whole process over again (moonshine again if needed)
Click to expand...
Click to collapse
Possibly a bad download, Download the HBOOT again and give it another go.
Also, with that error you are getting during the RUU process, did you lock the bootloader back up before running the RUU? That error sometimes shows up from not doing that.

---

I don't know if this will help anyone or not, or if this was known and I was just being stupid, but I was getting the ERROR [155] as well when running the RUU and I knew my hboot was correct as well as locked so that wasn't the problem, so I attempted to run the RUU again and saw that it was saying my current version was 1.28.xxxxxx which made me realize that that was the Sense 5 roms version number and not the actual version number of my phone causing it to fail. What I then did was i downloaded an AOSP based rom (but I would surmise that a sense 4 DNA rom would work as well) and flashed that then tried again. After doing that it showed the correct version number in the RUU and processed correctly!!
For a little more in site I was on the following setup:
Moonshine S-OFF
Joelz Stock Sense 5 <-- What caused the Error 155
Carbon ROM (Built by Pio) <--- What fixed the error (Would work with any AOSP or Sense 4 Rom ***Needs tested***)
**Edit**
Also incase anyone was wondering I was doing this to fix my phones radio, for some reason when flashing certain roms it gets stuck in Roaming no matter what you do. To fix it I just take my phone completely back to stock S-ON etc, then go into the bootloader and hit factory reset with the stock recovery and it seems to fix it, then S-Off and unlock again and go about my business. I couldn't actually find an answer besides "RMA the thing" to fix the radio roaming issue, so i figured i'd add that incase anyone else was/is in the same boat.

---

Hmm... I'll do a bit of testing on that with random Sense 5 vs AOSP/Sense 4 ROMs. If that is the case, I'll edit the guide.

---

I successfully restored my droid dna to untouched stock with this method. I had to exchange my DNA for a new one due to problems I was having and I am trying to do everything I can to make sure that there is no evidence of my tampering. One thing someone mentioned was to take the OTA's to get the device up to current 2.06 since I have been rooted and such since the first day it was available and am on 1.15. I have tried manually checking for software updates and it doesn't seem to find anything. It hasn't prompted me yet and I am wondering if because I am so far behind if they update system isn't checking or something else it wrong. Any thoughts? Any ways to manually update to 2.06 like flashing a new RUU (if that exists)? Thanks.

---

Just leave the phone on... I did it a few weeks back. It will eventually update.

---

Phaded said:
Just leave the phone on... I did it a few weeks back. It will eventually update.
Click to expand...
Click to collapse
Thanks. Verizon is only giving me 5 days to ship it back haha. So I just wanted to figure it out as quickly as possible.

---

Confirmed that on Sense 5 ROMs it randomly errors out. Editing guide.

---

I flashed the hboot zip and the hboot version is1.33 The phone is s-off and locked on viper rom. The RUU will reboot the phone into the black screen with the silver HTC logo, then the RUU stops working and asks to close the program. I downloaded three times and checked the md5 each time and its good. I am stuck. Any suggestions?

---

gris1016 said:
I flashed the hboot zip and the hboot version is1.33 The phone is s-off and locked on viper rom. The RUU will reboot the phone into the black screen with the silver HTC logo, then the RUU stops working and asks to close the program. I downloaded three times and checked the md5 each time and its good. I am stuck. Any suggestions?
Click to expand...
Click to collapse
The RUU itself crashes on the computer or the phone crashes and reboots?
Also the hboot I have linked should give you version 1.31 I do believe.

---

Thanks for this, worked perfectly!

---

Phaded said:
Return to stock on Moonshine S-Off
First, download the stock RUU
Stock RUU: 1.15 RUU: Mirror #1 or Mirror #2
Plug your phone into a USB port, turn on USB debugging and open a command prompt. cd to the directory that has adb/fastboot.
**NOTE** I noticed on the XDA mobile app that it breaks the echo command line up and makes it look like 2 separate commands. Do not separate it. The command starts at echo and ends at 33796.
Run:
Code:
adb devices (verify device ID is listed)
adb shell
su
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
exit
Your bootloader is now locked. Lets verify...
Reboot into bootloader either using 4 in 1 power menu (if your ROM supports it). Or plug your phone into a USB port, turn on USB debugging and open a command prompt and type:
Code:
adb devices (Your device ID should be listed)
adb reboot bootloader
Verify you are **LOCKED**
Click to expand...
Click to collapse
I am having issues not getting the phone to return to "Locked" status. I have and am running the stock ROM. Just reset back to factory. I am following the commands to the T. Below is what my CMD prompt shows that I typed in, or copied and pasted for the echo command. I was trying to follow the note about the echo command but I could see nothing wrong with it... also in the end I had to type exit command twice for it exit and go back to the prompt for the next folder.
C:\android-adb>adb devices
List of devices attached
FA2C2S510423 device
C:\android-adb>adb shell
[email protected]:/ # su
su
[email protected]:/ # echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 s
eek=33796
d of=/dev/block/mmcblk0p3 bs=1 seek=33796 <
4+0 records in
4+0 records out
4 bytes transferred in 0.007 secs (571 bytes/sec)
[email protected]:/ # exit
exit
[email protected]:/ # exit
exit
C:\android-adb>
Click to expand...
Click to collapse