S-OFF on Android: a complete guide for advanced users

If you are actively interested in customizing Android, you have probably come across the term S-OFF —a mysterious status that opens up previously unseen opportunities for modifying a smartphone. Unlike the usual bootloader unlocking (bootloader unlock), S-OFF affects much deeper levels of the system, allowing you to make changes to sections that are usually protected even from users with rights root.

But what exactly is hidden behind this abbreviation? Why are some enthusiasts willing to spend hours to get S-OFF, while most Android owners don't even know it exists? In this article we will analyze technical essence of S-OFF, its differences from S-ON, the real benefits for the user, as well as the risks that such manipulations with the firmware carry. You will also find out which devices support this function (spoiler: there are fewer and fewer of them) and what alternatives exist for modern smartphones.

We warn you right away: the topic of S-OFF is closely related to low-level programming of mobile devices. If you have never worked with, have not heard of, or are intimidated by the term “firmware via”, some of the information may seem complicated. However, we will try to explain everything as clearly as possible - without unnecessary techno-jargon, but also without simplifications that distort the essence. fastboothaven't heard of NAND backup or are you afraid of the term “firmware via EDL mode", some of the information may seem complicated. However, we will try to explain everything as clearly as possible - without unnecessary techno-jargon, but also without simplifications that distort the essence.

What is S-OFF: technical explanation

The abbreviation S-OFF stands for Security Off - "security off". This is a special mode of operation of the bootloader (bootloader) on some Android devices, mainly from HTC and several models of other brands (for example, early Motorola or Sony Ericsson). This mode disables hardware restrictions on writing to critical sections of the device’s memory, such as:

• 📱 Radio (modem firmware responsible for communication)
• 🔧 Boot (partition with bootloader)
• 🗃️ Recovery (recovery partition)
• 🔒 SPL/HBOOT (secondary software bootloader)

In the normal state (S-ON), these partitions are write-protected even with root-rights. For example, you will not be able to flash a custom one (for example, recovery (For example, TWRP) or change the version radioif you have S-ON. S-OFF removes these restrictions, allowing you to:

• 🔄 Flash unofficial versions radio (useful for improving communications or supporting new frequencies)
• 🛠️ Restore a bricked device even without official firmware
• 📦 Install firmware from other regions or operators without restrictions
• 🔓 Bypass some types of blocking (for example, FRP lock on old devices)

It is important to understand that S-OFF is not the same as an unlocked bootloader. Unlocking the bootloader (via fastboot oem unlock) allows you to flash custom images boot and recovery, but does not give access to protected partitions. S-OFF goes deeper: it disables signature verification of these partitions at the hardware level.

S-ON vs S-OFF: key differences

To better understand why S-OFF is needed, let’s compare it with the S-ON mode in the form of a table:

Parameter	S-ON (default)	S-OFF (modified)
Write to section radio	❌ Locked (official updates only)	✅ Allowed (any versions)
Custom installation recovery	⚠️ Possible, but with restrictions (can be reset when updating)	✅ Full support, no resets
Recovery after "brick"	❌ Requires official firmware or service center	✅ You can flash any compatible image
Changing CID/MID	❌ Impossible (binding to region/operator)	✅ Can be changed to any supported
Risk of device damage	⚠️ Low (protection against incorrect firmware)	⚠️⚠️⚠️ High (incompatible data can be recorded)

Critical difference: S-OFF allows you to flash incompatible versions of the radio or bootloader, which can lead to a complete loss of connection or a “bricked” device without the possibility of recovery through standard methods. This is why manufacturers limit access to this mode - it is intended for developers and experienced users who are ready to take responsibility for their actions.

In practice, S-OFF is most often used for:

1. Installing custom firmware on devices with a locked bootloader (for example, some models HTC from operators).
2. Restoring “bricks” caused by unsuccessful firmware.
3. Optimizing modem operation (for example, improving signal reception or supporting new LTE bands).

Which devices support S-OFF?

Unfortunately, the era of S-OFF is gradually becoming a thing of the past. If in 2010–2015 this mode was available on most flagships HTC (for example, HTC One M7/M8, Desire HD, Sensation), today its support is extremely limited. Here is a current list of brands and models where S-OFF can still be useful:

• 📱 HTC: most devices before 2017 (for example, HTC 10, HTC U11). On new models, S-OFF is locked at the hardware level.
• 📱 Motorola: some models of the line Droid (for example, Droid RAZR, Droid Bionic).
• 📱 Sony Ericsson: old devices on the platform MSM7x30 (for example, Xperia X10).
• 📱 LG: single models (for example LG G2 through exploits).

On devices Samsung, Google Pixel, OnePlus and other modern S-OFF brands unavailableother unlocking methods are used instead, such as:

• 🔓 Unlocking the bootloader via fastboot oem unlock (most devices).
• 🔧 Mode EDL (Emergency Download Mode) for flashing firmware through qualified tools (for example, QFil for Qualcomm).
• 🛠️ Exploits to bypass protection (for example, DirtyCOW for obtaining root on some devices).

⚠️ Attention: Starting with Android 8.0, many manufacturers have implemented hardware protection (Verified Boot), which makes S-OFF useless or impossible. For example, on HTC U12+ and newer S-OFF does not provide the same capabilities as on older models.

If your device is not included in the list above, most likely, you should not waste time searching for S-OFF. Instead, pay attention to alternative customization methods, such as:

• 🔄 Unlocking the bootloader + Magisk for root-rights.
• 📦 Installing custom firmware via TWRP or OrangeFox.
• 🔧 Using ADB i fastboot for deep system customization.

How to get S-OFF: step-by-step guide

Process obtaining S-OFF depends on the device model, but in general it comes down to the following steps. Consider the universal method for devices HTC (the most common case).

Make sure that the device model supports S-OFF|Download official drivers HTC Sync|Install Android SDK Platform Tools (for fastboot i adb)|Make a full backup of your data (including partition radio)|Charge the battery at least 70%-->

Step 1: Unlocking the bootloader

Before receiving S-OFF, you must unlock the bootloader through the official service HTCDev:

1. Go to the website HTCDev Bootloader Unlock.
2. Register and select your device model.
3. Follow the instructions to get unlock_code.bin.
4. Enter in fastboot command:

   fastboot flash unlocktoken unlock_code.bin

Step 2: Getting S-OFF through an exploit or tool

For older devices (HTC One M7/M8, Desire HD etc.) you can use tools like:

• SunShine (paid service, supports many models HTC).
• Firewater (free exploit for some devices).
• Rumrunner (for HTC One and the like).

Usage example Firewater:

1. Download Firewater and unpack the archive.
2. Connect the device in mode fastboot (adb reboot bootloader).
3. Run the script:

   firewater.exe soff

4. Wait for completion (the device will reboot from S-OFF).

Step 3: Checking the S-OFF status

After reboot, check the status in bootloader:

1. Turn off the device.
2. Press Power + Volume Downto enter HBOOT.
3. At the top part of the screen should be the inscription S-OFF (instead of S-ON).

⚠️ Attention: On some devices (for example, HTC 10) after receiving S-OFF, you may need to flash a patch for recovery, otherwise it will reset every time you reboot. Look for the latest instructions for your model on forums XDA Developers.

What to do if S-OFF does not work?

If tools like Firewater or SunShine do not work, try:

1. Check the version HBOOT (some exploits only work on specific versions).

2. Use alternative methods, such as flashing the firmware via RUU (official image from HTC) followed by downgrade.

3. forums (for example, XDA), where there may be current exploits for your model.

4. Please note that on new devices (after 2018) S-OFF may be blocked at the hardware level, and it is impossible to bypass this.

Risks and consequences of S-OFF

Despite all the advantages, S-OFF carries serious risks that you need to know in advance:

• 💥 Loss of warranty: The manufacturer will void the warranty if S-OFF is detected, even if the problem is not related to the modification.
• 📡 Communication problems: Incorrect firmware radio can lead to network loss, unstable signal or inability to make calls.
• 🔥 The “brick” of the device: An error when flashing critical sections (for example hboot) can make the phone unusable without specialized hardware.
• 🔒 Security vulnerabilities: S-OFF disables some hardware checks, which can facilitate attacks through vulnerabilities in the bootloader.

In addition, on some devices, S-OFF can lead to unexpected consequences:

• 🔋 Rapid battery drain due to unoptimized firmware radio.
• 📵 Problems with SIM card detection or LTE/5G operation.
• 🔄 Spontaneous reboots when updating the system.

To minimize risks, follow the rules:

1. Always make a backup of the partition radio before experiments.
2. Use only proven firmware and tools from XDA Developers or official sources.
3. Do not flash radio or hboot from other models or regions.
4. Before selling the device, return S-ON (if possible) to avoid problems for the new owner.

S-OFF alternatives for modern devices

If your device does not support S-OFF or you do not want to take risks, consider alternative customization methods:

Purpose	Alternative to S-OFF	Examples of tools
Installing custom firmware	Unlocking the bootloader + TWRP	Magisk, LineageOS, Pixel Experience
Obtaining rootrights	Magisk or SuperSU (via patch boot.img)	Magisk Manager, TWRP
Restoring after a “brick”	Mode EDL or Download Mode	QFil (for Qualcomm), Odin (for Samsung)
Changing the firmware region	Firmware via fastboot or Odin	Frija (for Samsung), Xiaomi Flash Tool

For example, for devices Samsung instead of S-OFF the combination is used:

1. Unlocking the bootloader via OEM Unlock in the developer settings.
2. Custom firmware recovery (TWRP) via Odin.
3. Installation Magisk to obtain rootrights.

For devices on processors Qualcomm (for example, OnePlus, Xiaomi), you can use the mode EDL (Emergency Download Mode), which allows you to flash images directly through the port USB, bypassing the bootloader. However, this often requires authorized accounts (for example, Qualcomm HS-USB QDLoader 9008).

If your goal is simply get root or install custom firmware, in 90% of cases unlocking the bootloader and Magiskis enough. S-OFF is needed only for specific tasks, such as:

• 🔧 Restoring damaged devices NAND.
• 📡 Experiments with modem firmware (radio).
• 🔓 Bypassing hardware locks (for example, FRP on old devices).

Frequently asked questions (FAQ)

❓ Is it possible to get S-OFF on Samsung Galaxy or Google Pixel?

No, on devices Samsung, Google Pixel, OnePlus and most modern smartphones S-OFF not available. These manufacturers use other protection mechanisms, such as Verified Boot and a locked bootloader at the hardware level. Instead of S-OFF, these devices use bootloader unlocking. via fastboot oem unlock.

❓ Does S-OFF affect the performance of the device?

S-OFF itself does not speed up however, it allows you to flash optimized versions. radio (modem firmware), which may improve connection stability or Internet speed. In some cases, incorrect firmware radio on the contrary, worsens performance, so you should experiment only if you have a backup.

❓ Is it possible to return S-ON after receiving S-OFF?

Technically yes, but the process depends on the model. For example, on HTC you can flash the official RUU (ROM Update Utility), which will return S-ON. However:

• On some devices, returning S-ON blocks the ability to receive S-OFF again.
• After returning S-ON, problems with custom firmware may occur (for example, refusal to boot).

It is recommended to save S-OFF if you are actively modifying device.

❓ Do banking applications and Google Pay work with S-OFF?

No, if you also have Magisk or SuperSU (that is, you have root-rights). and Google Pay check the integrity of the system via SafetyNet. To get around this, you will need to:

1. Hide root using Magisk Hide or module Universal SafetyNet Fix.
2. Flash a patch for boot.img, which masks the status of the bootloader.

S-OFF itself does not block SafetyNet, but it is often used together with root, which causes problems.

❓ How to check if it supports is my device S-OFF?

Check methods:

1. Go to bootloader (usually Power + Volume Down) and look at the line that says S-ON or S-OFF.
2. Check the device model on the forums XDA Developers or in the database XDA.
3. Use utilities like HTC Bootloader Info (for HTC) or Fastboot-command:

   fastboot getvar all

   Look for lines security: on or security: off.

If your device was released after 2018, most likely S-OFF is not supported.