THIS ONLY WORKS WITH S-OFF.
I have a HTC One that has S-OFF, however the bootloader is locked. If I want to flash TWRP or any other suitable recovery, there are two ways. I can unlock via HTCDev, which will take a short while and unlocks fastboot, or I can flash TWRP via RUU mode.
Since the phone has S-OFF, we can flash any file via RUU mode, we can flash a custom recovery and unlock the bootloader without needing to use HTCDev.
First, reboot into the bootloader and into RUU mode.
fastboot oem rebootRUU
Download M7-TWRP-RUU and flash it.
fastboot flash zip M7-TWRP-RUU.zip
# fastboot flash zip M7-TWRP-RUU.zip
target reported max download size of 1526722560 bytes
sending 'zip' (9392 KB)...
OKAY [ 1.252s]
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
(bootloader) start image[recovery] unzipping & flushing...
(bootloader) ...... Successful
OKAY [ 3.399s]
finished. total time: 4.651s
If the green bar does not fill, that’s okay. As long as the output reports success, we’re good.
Reboot the bootloader.
Select BOOTLOADER and then RECOVERY. You’ll get dropped into TWRP.
Brilliant, TWRP is installed. You may now want to unlock/lock the bootloader or reset your tampered flag. You can do this from TWRP.
Drop into an ADB shell in TWRP with “adb shell”.
Copy & Paste these commands exactly. If you make one mistake, you have a chance to brick the entire phone.
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
Reset Tampered Flag
echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988
Exit the shell and boot back into the bootloader and verify any changes.
You may now want to go ahead and install any recovery or ROM you wish.
Find the firmware file for your phone and flash it. It will contain the stock recovery. For me it was 3.62.401.1.zip.