How To: Set Your HTC One to S-OFF Using Firewater on Any Computer

Set Your HTC One to S-OFF Using Firewater on Any Computer

You've unlocked your bootloader and rooted your HTC One running KitKat, but there's still one lingering aspect of security you've yet to rid yourself of—S-On—the extra security measure HTC implemented into Sense.

S-Off stands for Security Off and allows you to update your One's firmware, change your CID (carrier ID), install RUUs (ROM updates), and install those custom ROMs that have extra features that require S-Off privileges.

There are many tools to do this, like Moonshine, but the most reliable to use with a HTC One running Android 4.4 KitKat and Hboot 1.56 is Firewater by XDA Recognized Developer beaups.

Step 1: Get Your Computer & Device Ready

To achieve S-Off, you are first going to need to install a Sense-based ROM with an unsecured kernel. For this guide, I will be using ARHD, which seems to give the least amount of errors when using Firewater.

In addition, make sure that you set up ADB on your computer and DO NOT have HTC Sync Manager on your computer. You do need to download Sync to install the HTC drivers, but you should delete the program afterward (see Step 4 below for more info). Your device must also be rooted with an unlocked bootloader and custom recovery and have USB debugging enabled.

After all of that, make sure to turn off any lock screen security you may have set by going to Settings -> Security and setting Screen security to None.

You'll also need to disable Fastboot from Settings -> Battery Manager and un-check Fastboot.

For the safest, most consistent process, use a USB 2.0 port (3.0 can cause issues), the stock Sense launcher, and as always, back up your data because this will wipe everything but your internal storage. Making a nandroid backup in recovery will be critical if you do not plan on keeping the ROM that we install in the next step.

Step 2: Install ARHD onto Your HTC One (Optional)

This step is to ensure that you are using a Sense-based ROM with an unsecured kernel. If you know that you already meet these conditions, go ahead and scroll down to the next step.

Start by downloading the latest ARHD directly onto your device, then reboot your phone into recovery mode. If you aren't sure how to do this, hold the Power and Volume Down buttons together until you get to the bootloader, then use Volume Down to select "Recovery" and the Power key to confirm.

Now select Wipe then Advanced Wipe, and ensure that you have Dalvik Cache, Cache, Data, and System selected, then Swipe to Wipe.

Now go back to the main menu, select Install, navigate to your "Download" folder and select the ARHD .zip file you previously downloaded, then Swipe to Confirm Flash.

After swiping, go through the AROMA Installer prompts and install any of the tweaks you like, but only if you are planning on keeping the ARHD ROM after finishing, otherwise this will be unnecessary. After the install finishes, select the Reboot option.

Step 3: Set Up ROM & Re-Enable USB Debugging

After rebooting (which may take a few minutes, so don't worry), you will need to go through the set up process for the ROM, as if it were a new device. If you plan on restoring a nandroid backup, you can skip the sign-in sections.

Make sure you re-enable USB Debugging and disable Fastboot, then continue on to the next step.

Step 4: Prepare Your Device & Download Firewater

Plug your HTC One to your computer and open up cmd/terminal window on your computer, then download Firewater and place it on your Desktop.

Again, make sure you have ADB setup to run on your computer with the proper drivers from HTC. If you aren't sure whether you have the proper drivers installed, download and install HTC Sync Manager, but make sure to uninstall the program afterward—we only want the drivers from it, which remain after removal of Sync.

Step 5: Run Terminal Commands Using ADB

In cmd/terminal, reboot your phone using ADB:

  • adb reboot

Once rebooted, you can push Firewater to your device using the following command:

  • adb push Desktop/firewater /data/local/tmp

Change "Desktop/firewater" to the location of Firewater if you did not place it on your Desktop.

Now change the permissions of Firewater to allow it to run on your device:

  • adb shell
  • su
  • chmod 755 /data/local/tmp/firewater

Keep an eye on your device, as it may prompt you to grant superuser permission to ADB. If it does, allow it.

Now run Firewater with the following command, then do not touch your device:

  • /data/local/tmp/firewater

Now just agree to the terms and conditions you are prompted with and allow the exploit to do its thing.

That's it folks, you are now in the possession of a HTC One with S-Off.

Now you can now flash custom firmware, hboots, and re-lock your bootloader whenever you like. Also, it comes in handy when returning your One to factory settings. Hope this helped, and if you have any questions, be sure to leave me a comment.

Just updated your iPhone? You'll find new features for Podcasts, News, Books, and TV, as well as important security improvements and fresh wallpapers. Find out what's new and changed on your iPhone with the iOS 17.5 update.


thats my problem can u help me !

It looks like the install script didn't finish properly. The easiest way to fix this is to unzip the again and copy the contents of the Mac folder to your /usr/bin/ folder.

To get to that folder open a finder window and hit the Shift, Command, and G keys at the same time and type /usr/bin/ and copy the adb and fastboot files there. You will have to enter your password to complete the copy.

I'm stuck on pushing the Firewater portion. I'm not even getting SUperUser permission from the phone. And now I'm stuck in a boot loop. Please help.

What Android version are you on? Do you have SuperSU or SuperUser installed?

Hey Andrew,

I was finally able to get it working. I overlooked the final command "/data/local/tmp/firewater". I have it working now, and was able to recovery the phone through trial and error (the phone is a HTC One M7 Sprint). Another reason the phone was in a boot loop was due to the ARHD rom I flashed. Seems like the Rom that's best compatible on Sprint phones is the 31.6 version. The other two (60 and 53) caused a hell of a headache on my end.

Thanks again for the awesome and fairly simple guides.

Glad you were able to get it working! I'll be sure to keep that sprint compatibility in mind for future gudies. Thanks!

Hi Andrew,

My phone don't turn on after installing ARHD 62.0...

When I try to power it up, Home and Back buttons blink...

what can I do?

...wait... now it's on :)

now it shows a white screen with htc one logo on it... its taking quite a long time to boot though... lets see...

Ok, so far so good :) configuring it... nice!

Hi Mario... how long it took to boot?... mine is more than 30 minutes in the same condition... :(

Hey.. how long it took to boot? . It's about 30 mins now in the HTC logo screen with a boot loop.

Let me know exactly what you have done up until the bootloop and I'll help you out.

hi andrew ido my all the steps here but icant understand why still not working can u help me please ! thanks

u think maybe from the hboot 1.55

Sometimes it doesn't work on the first time, so try the process again. Also, what ROM is your One running?

thanks andrew for the reply . my ROM is insertcoin

I would make sure you are running the latest version of Insertcoin with their stock kernel and try the process again. Be sure to give ADB superuser permission when prompted and don't touch your phone at all once firewater starts running.

I have gotten this method to work on the SixthSense version of Insertcoin so be patient and it will work:)

Hey, I get to the "The first bottle is open, chugging........ " stage and then the adb shell exits and the phone is turned off and the terminal is kicked back. Tried a few times and the same result. When I reboot, S-ON.

I just flashed ARHD 62 onto it and cleaned all the caches. This htc one is a M7-ul, hboot 1.55, os-3.17.502.3.

Did you give adb su permission?
If you can, send me a screenshot of your terminal commands and I'll see if anything looks wrong.

which arhd version do i need 62 or 53 im running telus hboot 1.56, version-main: 4.19.6, and i assume this method will work on windows as well?

Any ARHD version will work, and yes the same commands will work on Windows.

The link up top in the tutorial is the latest version and is the one designed to work with 1.56.

whelp, this sucks, firewater can not work on yo
no amount of reflashing, retrying, or ruuing wi
if we are able to fix this issue, it will be a
bye bye.....sorry it didn't work out.

Thats the message that I get any help will be appreciated running arhd 53

Can you send me a screenshot of your terminal commands.
Also what is your CID/MID. To find out you can type
fastboot getvar all while you are in fastboot mode.

C:\htc>adb shell
root@m7:/ # su
root@m7:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
root@m7:/ # /data/local/tmp/firewater
error that Im getting is:

Do you understand the implications of these warnings?


***** whelp, this sucks, firewater can not work on your device *****
***** no amount of reflashing, retrying, or ruuing will fix... *****
***** if we are able to fix this issue, it will be announced *****
***** bye bye.....sorry it didn't work out. *****

cidnum: TELUS001

It looks comething is worng with version number of firewater we need to have 0.3.1

At this point you may want to try and do a clean install of the latest ARHD and retry the process.

Do I Ned to wipe cache prior? And can I use Download Android Revolution HD 6.1 Google Edition instead?

I would recommend that, before flashing, you go into your custom recovery and wipe Cache, Dalvik Cache, System, and Data Partitions. Since you will wipe all those be sure to back-up all your data.

Also, I would stick to regular Sense ARHD.

I just flashed arhd 63 and custom kernel still get the error: ** whelp, this sucks, firewater can not work on your device **

** no amount of reflashing, retrying, or ruuing will fix... **
** if we are able to fix this issue, it will be announced **
** bye bye.....sorry it didn't work out. **

After I write adb push my computer says
failed to copy read only system.
Any idea?
Thank you!

i got i to work just moved the file to my HTC One and then moved it around from my phone.
Thanks for all the other help! :D

I have the same Problem " "The first bottle is open, chugging........ " stage and then the adb shell exits".

How did you solve it?

I am not sure what Rodney did to fix it but I'll be happy to help you out. First, could you let me know you MID and the version of Android/ROM you are running.

Also, did you give adb su permission?

I was under the assumption that you could not flash a custom rom unless you had S-OFF. After reading the above can I assume that you can safely flash ARHD if your phone is still in S-ON?

Some ROMs do require S-Off, but it is not needed for ARHD. Usually the developer will list S-Off under their requirements section if it is needed.

There are three versions of ARHD on the official XDA developers OP – ARHD 31.6, ARHD 53.0, and ARHD 62.0. Which of the three would be the best bet to get Firewater to work? Does it matter?


Can anyone help please....?

I have been rooting phones for the past few years however my M7 is the only one that's caused me problems... I have teamwin recovery on my device and I got rid of sense and installed Jellybean however I cannot install stock kit kat... because I have s-on still...

I have read guides on many different methods of getting s-off, however my computer only has usb 3.0 ports and every time I try getting doesn't work.

Is there any method for gaining it on a computer with superspeed usb please?


If your M7 has hboot 1.44 then you can run revone from a terminal emulator directly on your phone.

I have tried repeatedly to get s-off on my htc one using firewater. The phone stops and reboots after the first bottle is opened. I have googled around, several people are are getting the exact same result. Following one guide I used ARHD 31.6 as it has the least secure kernel. My phone has HBOOT–1.56.0000 and OS– I will give it another try from the stock-rooted sense rom.

No luck on stock rooted. I installed ARHD 31.6 again and ran rumrunner this time. I ran it three times. Each time it got to the 8th bottle and told me to wait 30 seconds, power on the devices, pray, and run rumrunner again. After the third try I called it quits for the night. But I am determined crack this open. If anybody has any tips please let me know.

When I had my M7 replaced it came with stock Sense 5.5 and hboot 1.56. The first thing I did was unlock it through HTC dev then installed TWRP and supersu. After that I ran firewater and everything worked out. Does this sound similar to what you did.

Also, did you give adb superuser permission when it prompted you?

It does indeed sound familiar Andrew. I do give adb su permission. Funny thing is, when I go into adb it is already as superuser as indicated by the # at the prompt. Because of that I never get the prompt. I have tried the su app from chainfire as well as from koush, both have the same effect. I have tried runner firewater from the mac, a pc with windows 7, and from a linux pc. In each case the result is the same.

Hmmm, thats strange. Besides flashing ROMs have you modded anything else, like the firmware, radio, MID/CID, hboot?

For most of that I need s-off. I am coming from nexus and samsung devices, which are comparatively easier to work on. This s-off business is new to me.

Hi Andrew, I really could do with your help. I've followed all the above steps but firewater still fails. The one thing I've never been asked is to allow superuser access.

I've ran the getvar all command from fastboot so I assume adb is correctly set up. By the by the same thing happens when I run revone, all goes well but no superuser request so it fails.

Thanks in advance


You should check your superuser app. Let me know which one you are using and I could let you know what settings to check.

Hi Jon. Sounds like you and I are having the same situation. When I go into the adb shell I am already at root so I never get the prompt. I don't know if that has any influence on me not being able to achieve s-off.

Hi Andrew. I'm using supersu to manage my root access. I've tried to S-OFF with at least 2 different versions of ARHD to no avail.

It definitely seems as though you and I are in the same boat Pablo.

As always any and all help is appreciated.


You have the same M7 as I. You are running bootloader 1.55 I am on 1.56.

The only thing I can think of is to make sure you are running the latest version of ADB, and double check that HTC Sync is uninstalled. You may also want to try and flash different kernel before attempting S-Off. Something like Elemental X should work. Just download the latest version for your version of Sense and retry it.

Also, you can try to flash cyanogenmod with teaMseven_v57 kernel since people have reported success with that combo, but I'd only try that if you have the patience for all that flashing.

Just checking the rumrunner / s-off thread on XDA developers. Apparently they say neither works with HBOOT–1.56.0000 / OS– Just my case. A lot of people are have similar results as the ones I am having. I should not have done that last update before unlocking the bootloader and rooting. Damn!

I'm having the same issue with both Pablo and Jon. Same OS and same Hboot 1.56 tried multiple roms to no avail. Hoping to find a solution soon.

I have exactly the same problem, the phone is from Orange FRA, HBOOT 1.55.0000, build number
CyanogenMod to be downloaded? Link? And which kernel to do? Thanks

Hey, I tried to use ur method to get s-off on my ATT HTC One(M7) - I did all the steps right till we go to flashing the ARHD ROM. I checked the link didn't see ARHD 52 saw ARHD 53 so i got that. Flashed it, than went to reboot...stuck on HTC Screen...waited a long time for it come out of it but it didnt. Tried to reboot to the recovery and wouldn't go to recovery would just reboot to the HTC Screen. I was able to flash the recovery again but now can't mount anything, can't side load, can't even flash RUU again after locking(Says Battery below 30%) but its fully charged.

can you help bro...please!

< waiting for device >
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.56.0000
(bootloader) version-baseband: 4T.24.3218.09
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 4.20.502.1
(bootloader) version-misc: PVT SHIP S-ON
(bootloader) serialno: HT359W9xxxxx
(bootloader) imei: 35443905xxxxxxx
(bootloader) meid: 00000000000000
(bootloader) product: m7ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0712000
(bootloader) cidnum: CWS_001
(bootloader) battery-status: good
(bootloader) battery-voltage: 4327mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-c6bbb6d4
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.094s

What error are you getting when you try to sideload? Does your computer recognize your device. Run the adb devices command to see if adb finds your One.

When i try to run side load it just says side load failed.

adb devices
adb server is out of date. killing....

  • daemon started successfully *
  • List of devices attached


When you connected your One did you see a dialog box pop up asking to accept a RSA key?

i dont recall it did or not. All i know is i can get into the recovery but no storage can be mounted, its just booting up. i'm reading online about fastboot oem rebootRUU (idk what thats actually doing?) Is there a way to get the storage to work so that i can put a different rom on there and flash again?

RUU mode is what is used to restore your phone back to stock factory settings. Have you tried the Format Data option in TWRP?

lol no i know that but the actual command itself i meant. I see alot of ppl throwing that out there...I tried to lock the phone and run a stock RUU but fails says my battery is less than 30% n i even powerd the phone off using twrp and let it charge all day too. Um..yeah i did try to format data option in TWRP

You may want to try and flash a HTC1Guru has a pretty extensive list and should have you covered.

nm...i fixed it...had it plugged into a usb 3 hub plugged it dir. into the computer and i was able to flash the RUU directly. back to stock. what's the best method the unlock and root and get s - off?

i have an error while booting. it says isn't responding..

Was this before or after you S-Off'd?

no its still son. the phone booted now but i still have the error isn't responding. i t happened after i flashed arhd.

Sounds like something went wrong with the flash process, wipe your device again and then re-flash.

i am still getting the same error after re flashing. while installing arhd i have a warning in the beginning.

You may want to redownload ARHD. There may have been an issue when you were downloading it.

i did that too but still getting the same error..

Which carrier is your One attached to?


After I downloaded the firewater I did everything
but the superuser doesnt show me any permissions and im stuck at this command

root@m7:/ # su
root@m7:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
root@m7:/ # /data/local/tmp/firewater
root@m7:/ #


it looks like it already changed the permissions. What happens when your run firewater?

Hey, i have HBOOT 1.56 and

  • Revolutionary S-OFF
  • Moonshine S-OFF
  • Rumrunner S-OFF gived me errors

but with Firewhter i finnaly got S-off , i flashed first ARHD 5.3. Thank you!

No problem, glad I could help you out

can you post the link for ARHD 5.3? or do you mean ARHD 53?

i am not able to run firewater..

You need to give ADB root permission through your superuser app. Make sure you have your phone at the homescreen, and then type su again. A popup should come up asking for superuser permission.


After I downloaded the firewater I did everything
but the superuser doesnt show me any permissions and im stuck at this command

root@m7:/ # su
root@m7:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
root@m7:/ # /data/local/tmp/firewater
root@m7:/ #

Same with me.. please help me

What error are you getting when you run firewater?

My problem is Superuser does not show prompt popup on my HTC One Sprint..

If you look at the terminal readout you posted it says that you already have root, so you're all set to run firewater.

HI All,

Im having an issue running firewater.

it actually doesn't run, it just deletes itself.

here is my output with a few ls commands to show file there before and after
C:\adb>adb reboot
C:\adb>adb wait-for-device push firewater /data/local/tmp
6640 KB/s (4519496 bytes in 0.664s)

C:\adb>adb shell
shell@htcm8:/ $ su
m8:/ # ls /data/local/tmp
ls /data/local/tmp
root@htcm8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
m8:/ # /data/local/tmp/firewater
root@htcm8:/ # ls /data/local/tmp
ls /data/local/tmp
m8:/ #

I have tried it a whole bunch of times and every time nothing happens it just deletes the file.

any help is apprecaited

That usually happens if the firewater file gets corrupted. Re-download and try again.

Jim, I had this same issue and I fixed it by re-downloading the firewater file -- perhaps it was corrupt.

Trying to get S-OFF, using sense 5.5 and hboot 1.54. is 1.54 compatible with firewater? when i try to push Firewater i get: cannot stat 'Desktop/firewater': No such file or directory

adb reboot <–important!!!!
adb wait-for-device push firewater /data/local/tmp
adb shell
chmod 755 /data/local/tmp/firewater

I did all these steps but nothing happens firewater won't begin the procedure. Would really appreciate the help. Thanks :)

So after the last command nothing happens?

im doing all the codes and at the end i recieve whelp this sucks and blah blah blah
what am i doing wrong?
htc one m8 rooted unlocked with htc dev!!

There have been reports of different variants not working with this method, so its a hit or miss situation as of right now. I'll put up an update when there is a more reliable method.

Hey guys! I have a problem with getting S-OFF for HTC M8. Could u help me?!

Which model/firmware/carrier do you have?

Andrew, thanks for the article. I am experiencing the same exact issue as Annette above.... ARHD 71.1

The first bottle is open chugging......

than back to shell prompt and no s-off.

Tmobile M7 UL
HBOOT 1.56.0000
OS -4.19.531.10

C:\androidbackup\mini-sdk>fastboot.exe getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 1.56.0000
(bootloader) version-baseband: 4A.24.3263.09
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 4.19.531.10
(bootloader) version-misc: PVT SHIP S-ON
(bootloader) serialno: HT359W912166
(bootloader) imei:
(bootloader) meid: 00000000000000
(bootloader) product: m7ul
(bootloader) platform: HBOOT-8064
(bootloader) modelid: PN0713000
(bootloader) cidnum: T-MOB010
(bootloader) battery-status: good
(bootloader) battery-voltage: 4240mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: dirty-4dab9d12
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!



Just to make sure you did the following things right?

  • Gave su permission to adb
  • Have your One attached to a USB 2.0 port
  • Disabled lockscreen security

I am also sharing this issue with my HTC One M8. I'm using the stock Sense launcher and have successfully rooted the phone. However, after the first bottle, it just goes back to the prompt without S-Off.

I've tried USB 2.0 ports and am using the default lockscreen (no security). It's very strange because everything appears normal until firewater runs.

hey buddy andrew i am new to this..could you tell me is it necessary to install any custom rom(like arhd as u said) get s off? coz i dont want to install a custom rom, i have a rooted htc one with clockwork/twrp recovery and elementa

lx custom kernel......i am running sense 5.5,stock rom,4.4 kitkat...with hboot 1.56....can it work without installing custom rom...and following ur next steps?...also is there any way to install ota update of sense 6(system update available now for my phone) without needing to soff? i want to continue using stock rom thanks..

If you want to keep using stock you can. ARHD hosts a stock Sense 6 ROM that you can flash in recovery.

And as long as you have the ElementalX kernel you should be fine to S-Off.

just one more thing man to install that stock rom from arhd.... do i needsoff?...also which stock rom i need to download? stock odexed, stock deodexed or stock recovery?.... the thing is m fine with sON as long as i can install ota updates from htc.... plz help....

Nope, not all ROMs require S-Off. The only ones that do are usually GPE based ROMs. If you still wanted to use an ARHD stock ROM use the one labeled stock odexed since that is pretty much a completely stock ROM, minus the carrier bloatware.

You can still receive OTAs being S-Off or S-On, you just need to have a stock recovery.

dear andrew, i really appreciate ur help man... ive downloaded the stock odexed rom from arhd but i have custom kernel and custom recovery installed,so after flashing the rom,will i keep them both or they will replaced by stock too,and will i keep my root? thanks in advance

If you flash the ROM you will keep your recovery, but not the kernel. You can always re-flash Elemental X after doing one full boot with the stock ROM. Also, your root access will be untouched as long as you download SuperSu from the Play Store and install the binaries via TWRP (that option should be included in the app).

Follow this guide to learn how to backup your data using adb. Let me know if you need any clarification, I'm here to help.

after installing new rom,how do i only get my data back?i do have the nandroid backup with there any way to just copy the entire data only and not the rom from nand backup...

i downloaded the rom but when flashing it says :- semetadatarecursive: some changes failed
E:Error in /data/media/0/
(status 7)
installation aborted....
whats wrong please revert asap

You may need to update TWRP. Which version are you using?

m using clockworkmod recovery it possible to flash this rom properly...m dying to install sense 6 based stock rom...but until now no luck....

is mounting causing the error? it says before giving this error system is already mounted

Hey Andrew, great writeups, I actually just went through your "KnockOn" for the M7 tutorial, unlocking the bootloader and flashing the bulletproof kernel on stock sense 6. Just curious, is the bulletproof kernel considered an unsecure kernel? or do I need to get the ARHD rom, get s-off, then redo the KnockOn mod with the bulletproof kernel again? Thanks :)

I've S-Off'd devices with both insertcoin and ARHD running bulletproof so that shouldn't be an issue.

For what it's worth, I spent four hours finding out finally that I had two separate copies of adb (one 2011 and one in 2012 along with four "precache" files of adb). I wiped all out but the 2012 version and my One asked me --for the first time since I unlocked it two days ago--to confirm allowing my computer access.

After that my "device not active" responses went away.

Next, I also got the "whelp, that sucks" message.

However, one oddity that I have is that, if you look at the circle area in the lower left, I ALWAYS seem to get two (and once three) instances of the One device.

I'm wondering if that is what's causing my failure to f-off my One.

No, answers, but I'm hoping that this may help.


Have you tried using a different USB port?

Andrew, i chug several bottles (it varies with the number on my three attempts so far, then i get back to the command line without error. But then reboot the phone and it is still S-ON.

I'm using Sense 5.5, Android 4.4.2 and the ARHD 53.0

phone either freezes, or shuts off entirely and then no S-OFF on next reboot.

it finally worked after a few attempts. I kept trying to turn the phone on after the screen would turn off and i think this was interrupting it.

Thank you for your guide Andrew

No problem, glad it worked for you!

It just simply not work. I have followed exactly your guide step by step and it still does not work. I also tried rumrunner and says "Wait 30 seconds, pray and power on your phone. Press enter to exit" Also, attached it what Firewater shows me.

Any help is appreciated. Thanks!

The problem is in the error code. Your kernel it patched so it cannot be exploited. You need to flash ARHD.

I have a htc one m7 and i cant get s off follow everything to a t
My product is m7u
hboot is 1.56
cid HTC_621
model id PN071100

its says opening bottle then say chugging then it say it cant help me
have arhd 31 on my phone i dont see the rsa key thing pop up dont see the su grant anything on my phone nothing

When you enter the adb shell do you see root@htcm8 or something like that when you enter the su command?

hi once i reach the part where i have to input the command "su" this message appears. Can anyone help me with this problem? I recently bought this htc m8 sprint phone from someone on ebay and im trying to unlock it to use for international carrier

It looks like you exited the adb shell. All the commands must be entered while still in the adb shell.

hey andrew help me brother please,i have installed stock recovery downloaded the ota but when m installing it i get the error in verifying system components as: system/app/7digital has invalid contents...and it stops there it because of the bloatware i removed previously while on custom recovery..if yes then tell me what should i do now to install the ota properly???

Yeah, that would cause it to abort the install. You would need to restore from an RUU to get the official OTA to install properly.

Hi there,

I want to S Off my HTC One M7, AT&T, Hboot 1.56 and running ARHD 71. I have tried multiple times but I end with this error.. (my getVar also attached). Is there any solution to it?


How long have you had your device? It seems like the newer batches are showing this error.

Since Nov, 2013

Yeah, you may have gotten one of the unexploitable models.

but I did get S off this phone before. I had to go back S-on as I needed to send it to HTC for repair, got the same phone back, can't S-off now..

Have you tried restoring from an RUU and retrying the process?

A quick search revealed that my phone was manufactured in November 2013. The first 6 digits will reveal when and where it was manufactured. Seems I have an unexploitable model :(

I have an AT&T variant with hboot 1.56. I tried both rum runner and firewater with many different roms and kernels and have had no luck yet, hopefully someone will find the exploit for the non exploitables (fingers crossed)

As a last ditch effort try flashing a RUU to restore everything on your phone and then retry the entire process.

Currently I'm on kit Kat 4.4.2 can I RUU back to jelly bean without any problems. Also, if I can revert back will thehboot change as well or is it a firmware issue?

As long as you grab the newest RUU you should be good to go. The hboot will probably remain the same version. It just depends on what RUU you use.

I have exactly the same problem, the phone is from Orange FRA, HBOOT 1.55.0000, build number
CyanogenMod to be downloaded? Link? And which kernel to do? Thanks

It won't work if you are running cyanogenmod since their kernel is incompatible. Your best bet is to use ARHD and have an insecure kernel like BulletProof of ElementalX.

I also tried ARHD in combination with ElementhalX and still end those reports, already know what and how to continue. I managed to fix it to someone who has had such problems?

whelp, this sucks, firewater can not work on your device
no amount of reflashing, retrying, or ruuing will fix...
if we are able to fix this issue, it will be announced
bye bye.....sorry it didn't work out.

Yeah, that usually means you have a One that can't be S-Off'd. They are trying to find a way to make a tool that will S-Off any One, but it has not been finished yet.

I am almost at the verge of completing an year in august with this HTC one which I can S-off to install the RUU of my stock version. I am on Hboot 1.56 and I am facing the same problems as many others above are facing. No $ sign comes up when we type adb shell and thus the phone never asks for the superuser permission. And resulting in failure of the firewater process. I have tried it like 10 times with different ROMs ending up with same results.

Hoping for a solution for HTC one owners like us from the developers very soon. :(

Can you send me a screenshot of the error you are getting

Hi Andrew! I've found your posts to be very helpful! I just followed your post: "How to Unlock Bootloader & Root Your HTC One Running Android4.4.2 Kitkat" and it worked like a charm. I've been following this post today, exactly as the video and the instructions described, with the exception of using Android Revolution 71.1 (as that was the only link under HTC One that would work for me). Everything was going well until I received the message in my mac terminal:

The first bottle is open
ERROR: kernel contains HTC anti-firewater patch!
*** Try again with a different kernel ***

What can I do from here? Thanks!

I am on hboot 1.57, and all I get is the whelp message. I repeated the process N times and still no result. I heard you talk about a tool that will work on any HTC one, do you know when this will be available ?

Yeah, 1.57 can't be S-Off'd with firewater, but you can use sunshine. It does cost $25 though.

Thanks, I just did and I am running arhd7.1 rom and sunshine says that it's an incompatible rom and that I need to flash a sense based rom. I am using a sense based rom, not sure why it says that. What rom do you suggest that I try it with and if you give me the link too please ?

Still no go , I get the same error message, any other suggestions ?

Have you changed your kernel, firmware, radio, etc before doing this?

Nope, I all did was root my device, I have a custom recovery, and flashed back on a stock Rom now, nothing else.

You gave it root permission right? Can you post a screenshot of the error you got

It never asks for root permission, thought it says it would in the previous screen.

It turns out the m7 isnt fully supported on sunshine yet. I got that from the IRC support channel for sunshine.

I got the solution to s-off hboot 1.57.0000 by using the tutorial above and flashing ElementalX 14.11 then after do last part of the tutorial step5

Tried the kernel you suggested, still getting the "whelp" message. Did you try it on the stock ROM, I am on the Revolution HD, will that make difference ?

Hi Andrew. I tried flashing ElementalX to my HTC One but when I finished it said "No OS installed !" then became stuck on the HTC screen after it was rebooted.

Sounds like you wiped your data/system partitions when wiping. So now you are going to need to ADB sideload a ROM to get an OS back.

Wahoo! I got it to work with the ARHD 31.6 version! Thanks :)

Hey where did u downloaded the ROM, can you provide the link. Thanks I would really appreciated and also were you on 1.56?

Which version of hboot do you have? I have 1.57 and it's not working with ElementalX, ARHD, InsertCoin, any other ROM or kernel.

Your phone may be one of the models that is incompatible with firewater. You should check out sunshine.

Hi, I've been trying to S-Off for some time now. I'm on hboot 1.56. I've tried using rumrunner and firewater. It absolutely refuses to work. I'm having the same issues as many people above me have had. Anyway I was going to go back to stock and try again (even though it probably won't work) but when I went to get my OS number I got this. I'm no expert or anything but I'm pretty sure it isn't supposed to be blank. I'm running ARHD 71.1 (I've tried many versions of ARHD to attempt to S-Off) I believe this phone was manufactured in Jan meaning it probably can't S-Off. I can use it as it with 71.1 and Elemental X kernal, but I've never seen a blank version-main before. Advice?

Run getvar all and see if you still have a missing version number.

This is what I got. All I wanna do is S-Off and turn my phone into a Google Edition. All I need is to S-Off, I can do the rest.

What error are you getting when your run firewater?

The well this sucks firewater won'twork for your device no amount of flashing, RUUing will work error.

If you are getting that error it means that you have an unexploitable model.

The guide says "Step 2: Install ARHD onto Your HTC One (Optional)

This step is to ensure that you are using a Sense-based ROM with an unsecured kernel." but I get the following error when I try to S-OFF:

ERROR: kernel contains HTC anti-firewater patch!

I thought ARHD would avoid this? Or does the latest version of ARHD not work?

thank you very much. worked but not without any problems (hboot 1.56)

first i couldn't push firewater through fastboot on the device but transfered it manually on my phone with usb otg and root explorer app

second this commands worked but no popout from super su came out
adb shell
chmod 755 /data/local/tmp/firewater

i just tried the next command and it worked.

my bootloader os - was no one. i don't know why but after os- ... there was nothing written in my bootloader but that's ok as long as it worked.

thank you again for this guide. now it was possible for me to flash sinless rom and other gpe based roms ;)


I wiped wiping Dalvik Cache, Cache, Data as mentioned in Step 2 but I rebooted my phone before installing the ARHD .zip by mistake. Now my phone gets stuck on HTC quietly brilliant screen. I tried to hold the power and vol up button to get to the boot mode however the phone restart and stuck again on the HTC screen. Please help. Thanks!

You are running hboot 1.57, which is a hit or miss with firewater because it is the newest version. Some users on XDA have had success using the Cyanogenmod ROM, so you may want to flash that and retry.

This is a very well organized walk through. Thanks for this. For me, I'm on hboot 1.57.0000 and ARHD doesn't work me. Based on the comment and link above, CyanogenMod (Snapshot M5 - 2014-04-05) finally worked on my One after 3 attempts on this version. A newer CM nightly version didn't do. I'll say be patient and try a few more times with different roms maybe

So Snapshot M5 didn't work with firewater?

my m7 stopped coming on after successfully running firewater. it has been like that for over a week now. it only makes noise when plugged to a computer. i have been unable to use it since then. Please help..

Try holding power and volume down while holding it under a light. Sometimes the phone will not power on without activation of the light sensor which is located on the top of the phone by the front facing camera.

Did you flash any other mod before running firewater? What version of Android/Sense are you running?

Android 4.4.2, sense 5.5. I didnt flash any mod. I just followed the instruction above to gain s off using firewater and restarted my phone. The phone went off and refused to come on. It has been blank for weeks. It only makes a sound when plugged to a PC

Leave it plugged into a wall outlet for about an hour and then while it still plugged in hold down power and volume up. If that doesn't work try using an LED flashlight to activate the light sensor and then press volume up and power.

That's really strange. There have been some reports of display connectors going bad, so that may be your case. I would try to contact HTC and see what they say.

thanks so much!! or in spanish MUCHAS GRACIAS!! im from Mexico and works for mi HTC ONE M7 SPRINT HBOOT 1.57

i tried installing the kardon mod with S-on but i had no luck, i had settings but no sound. I then tried to S-off my htc but without flashing that AHRD rom or the insertcoin rom, still no luck firewater could not be installed so i was stuck with no sound. Luckily i found a file that uninstals the kardon sound mod so now ive got sound again but i really want to try out that kardon thingy so i was wondering once i instal on of these roms and succeed in s-offing my device can i then revert back to stock rom without losing the S-off? or do you recommend another cool rom for the htc one m8. I just bought it like a month agoo and i broke my previous phone cus i wasnt carefull enough so im a bit scared now of doing these things with my expinsive htc... i did unlock the bootloader flash twrp and rooted it and installed xposed on it already. please let me know your oppinion on this and on the rom question :) Thanks!!

S-Off is never lost no matter what you do, unless you run a fastboot command to return to S-On. Right now I am using ARHD on my M8. I tried to go the AOSP route, but I missed the HTC camera too much to let it go.

hi Andrew... I am getting:
C:\adb>adb shell
shell@m7:/ $ su
root@m7:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
root@m7:/ # /data/local/tmp/firewater

after that, nothing happens... :(

I have a HTC One M7 AT&T Unlocked,
unlook bootloader and rooted

any idea????

never mind... I did return to the step " here in your guide and did install ARHD, now my phone is bricked... :( it does not power on, nor in fastboot or android... if I hold power button, lights blink, then appears de green HTC logo and after that, the cell goes off... :(

how can I recover my cell phone?

I meant I did the step 2 of this tutorial.

Is there any indication when S-OFF will become available for devices that get the "whelp, this sucks" message?

Firewater development has pretty much stopped. Your best bet now would be to use Sunshine.

I have flashed twrp to root my phone.and relocked bootloader after root.
but now in bootloader,when i choose recovery,my bootloader reboots and recovery doesnt load.
Whats should i do??
And should i open bootloader to gain s off??

If you flashed TWRP you should not relock your bootloader. Unlock it again and flash TWRP again

I need help, I bought an unlocked ATT HTC One M7 and am using it on TMobile. I want to change it completely to TMobile and have done everything right so far up until the ARHD. It says everythings successful and it let me begin firewater and it even says the chugging bottles thing but then it fails and says ERROR kernel contains HTC anti-firewater patch! and to try with another kernel. What kernel? I downloaded the ARHD that said something about sense 6.0 and i dont understand what i did wrong. Please help

If that doesn't work that means your firmware version is too new and cannot be S-Off'd.

firewater is not working any more !! check the fiewater website

Andrew - Long time listener, first time caller...

I went through the steps, but once I hit the command the execute firewater, I saw this:

Do you understand the implications of these warnings?


!!If firewater hangs for more than 2 minutes or device enters qhusb mode, hold power for 60 seconds !!

!!If firewater hangs for more than 2 minutes or device enters qhusb mode, hold power for 60 seconds !!

!!If firewater hangs for more than 2 minutes or device enters qhusb mode, hold power for 60 seconds !!

No matter how long I wait, firewater just draws dots. Any thoughts?

By the way, my HBoot is 1.57, developer mode is enabled, and I have ARHD 83.1 installed (Android 4.4.3, Sense 6.0)

Okay - I get it. Firewater no longer works, and the fact that firewater reaches out to a server is why I am getting the dashes.... it's been disabled by the server - right?

Okay. So what is the answer, Sunshine?

So i did all of that, was worried that the ARHD didn't work because of the boot time, but for some reason i can't get Fire water to work, help?

Pic Link:

Firewater will no longer work. Sunshine is the only option to S-Off.

Hi! I have HTC One X and trying to get S-Off. Firewater doesn't work anymore, sunshine is not supporting device! Any suggestions?

Does this guide work for HBOOT 1.57 ? Mine is HTC One Unlocked (Dev Edition), Unlocked by and Rooted. Which version of ARHD should I try ? Which S-OFF software will be helpful to get S-OFF.

Andrew - After all of the efforts to get S-Off and install the GPE 5.01 edition, I now need to return the HTC to stock. I am S-Off. I have found about 10 different guides on how to revert back to stock, but most of them are a year old and seem dated. I've spent an hour trying to find the corrrect RUU files, only to see posts that say that the RUU won't work if the bootloader is unlocked and the phone is S-Off. Is there a clear and concise method to return the phone to stock? Ultimately, I will also need to remove S-Off as well.Thoughts?

How do you know where to find the right Rom? If I want to go back to stock Sense + 4.4.4 on AT&T (Cingular). I spent a hour looking and do not know where to find it.

Okay, I have a T-mobile HTC One rooted. Stock sense 6, 4.4.2. I want to upgrade to lollipop. I'm S-on. What are my options?

S-off not work help me
"only position independent executables (PIE) are supported." i got these error while flashing firewater
help me

You have to use Sunshine to S-Off now. is where you can download it.

C:\adb>adb reboot

C:\adb>adb wait-for-device push firewater /data/local/tmp
465 KB/s (4519496 bytes in 9.485s)

C:\adb>adb shell
root@htcm8:/ # su
m8:/ # chmod 755 /data/local/tmp/firewater
chmod 755 /data/local/tmp/firewater
root@htcm8:/ # /data/local/tmp/firewater
error: only position independent executables (PIE) are supported.
m8:/ # /data/local/tmp/firewater
error: only position independent executables (PIE) are supported.
1|root@htcm8:/ #

This method is not longer working. You will have to use Sunshine:

Share Your Thoughts

  • Hot
  • Latest