HTC Desire Z bought for parts: S-OFF, SuperCID and 4202 mV

· 4 min read
Contents

It arrived as a parts phone: an HTC Desire Z, the 2010 Android slider with a four-row hardware keyboard, bought as a donor for whatever still worked. I expected a cracked digitizer and a battery swollen into a pillow. Then I plugged it in, and every question I asked it over USB came back with better news than the last. When a phone from 2010 starts doing that, I stop enjoying it and start keeping notes.

The notes turned into an inventory: what the phone is, what someone had already done to it, and why that turns a parts donor into a pocket mesh-networking node. The first entry was the battery.

4202 millivolts. Full charge. A lithium-ion cell from 2010, reporting full-charge voltage like it just rolled off the line. The battery was fine. The battery was better than fine, which on hardware this old is the kind of fine I file under "pending".

What was in the box: HTC Vision, CyanogenMod 7#

The Desire Z shipped in October 2010. Qualcomm MSM7230 at 800MHz, 512MB of RAM, and a four-row hardware QWERTY that slides out at a jaunty angle. HTC's internal codename: Vision. The keyboard alone makes it a collector's item now — virtually no phones in production with physical keys.

I plugged it in expecting a locked bootloader and a stock ROM full of HTC Sense widgets. Instead:

$ adb shell getprop ro.build.display.id
GWK74
$ adb shell getprop ro.modversion
7.2.0-vision

CyanogenMod 7.2.0, the community Android build of its day. Android 2.3.7. Kernel 2.6.35.14-cyanogenmod. Someone had been here before me.

S-OFF, SuperCID, ENG: the escalation#

Each query came back better than the last.

$ fastboot getvar all
(bootloader) version: 0.84.2000
(bootloader) cidnum: 11111111
(bootloader) security: off
(bootloader) build-mode: ENG

Read that bottom-to-top. ENG build — hardware engineering mode. Security off — S-OFF, the holy grail of HTC modding circa 2011. CID 11111111 — SuperCID, accepts any firmware image from any carrier region on earth.

On HTC devices of this era, S-ON means NAND write-protection enforced by a hardware security flag. Only HTC-signed images can touch the radio, boot, recovery, or system partitions. S-OFF removes the restriction entirely. Write anything, anywhere, anytime. Flash a custom radio. Replace HBOOT, the bootloader. The device is yours in a way no modern phone permits.

Getting S-OFF in 2011 required either an engineering cable or a software exploit. Those tools are abandonware now. Finding a phone already S-OFF is finding one that already did its time in the mod community — and came out clean.

You were sold to me as spare parts, Desire Z. Spare parts do not arrive with SuperCID and an engineering bootloader. This is the phone equivalent of a barn-find car with the engine rebuilt, cage welded in, and a logbook signed off for competition.

Battery check and a clean install#

$ adb shell cat /sys/class/power_supply/battery/batt_vol
4202

A clean CM7 install with almost nothing on it. No email configured. No contacts. The WiFi settings show networks connected exactly once. Someone flashed this, verified it worked, and put it in a drawer. That is the most responsible thing I have heard of anyone doing with an S-OFF phone, and I intend to undo all of it.

Why an S-OFF phone matters: mesh networking#

Nostalgia would be reason enough for some people. Mine is mesh networking.

A device with:

  • Full root access (S-OFF + ENG + SuperCID)
  • A working WiFi chipset (bcm4329, ad-hoc capable)
  • A physical keyboard (field input without a touchscreen)
  • A battery that holds charge (4202mV, apparently immortal)
  • 512MB RAM (more than enough for a mesh daemon)
  • A CPU that sips power at 800MHz

...is a field-deployable mesh node that fits in a pocket and cost less than a coffee.

Modern phones are actively hostile to this use case. Locked bootloaders, restricted ad-hoc WiFi, no root without tripping Knox or SafetyNet. The Desire Z, cracked wide open by someone years ago and preserved in amber, is more capable as a networking device than a phone ten times its price.

I'm aware this is the point in the story where everything has gone suspiciously well.

Present and accounted for#

  • bcm4329 — WiFi and Bluetooth, firmware blobs intact
  • Adreno 205 — display works, not that it matters for a mesh node
  • CWM (ClockworkMod) recovery — boots clean
  • Keyboard — all keys responsive, slider mechanism smooth
  • A lithium cell from 2010 at 4202 millivolts

Some barn finds just need fuel. This one also needed an owner who hadn't yet learned what CyanogenMod 7 does when you take away an 8KB dictionary provider. That owner lasted exactly one more post.

Filed under: hardware, android, htc-desire-z

Sources#

No external sources. All data from direct device interrogation via ADB and fastboot.