MEM_UL with demo firmware, phone is S-OFF, help needed topic

I got a MEM_UL with S-OFF and cid 11111111 , sim is working but problem is its loaded with demo apk, phone automatically resets after a certain time. details here

(bootloader) version: 0.5
(bootloader) version-bootloader: 3.18.0.0000
(bootloader) version-baseband: 1.101.1102.16.21_2
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 2.18.401.3
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: SH46HWR02188
(bootloader) imei: 35xxx
(bootloader) imei2: Not Support
(bootloader) meid: 00000000000000
(bootloader) product: mem_ul
(bootloader) platform: hTCBmsm8226
(bootloader) modelid: 0P8B20000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: d06a629a
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0

as the phone is S-OFF and CID 11111111 I've tried flashing these roms

0P8BIMG_M8_MINI_UL_K44_SENSE60_HTC_Europe_2.18.401 .3_Radio_1.101.1102.19.1017_10.26.4149.00L_release _402779_combined_signed_2_4
0P8BIMG_M8_MINI_UL_K44_SENSE60_H3G_AT_1.01.776.1_R adio_1.101.1102.19.0708_10.24.4149.00L_release_391 650_combined_signed_2_4
0P8BIMG_M8_MINI_UL_K44_SENSE60_O2_UK_1.16.206.2_Ra dio_1.101.1102.16.21_2_10.19.4149.00_1_release_372 226_signed_2_4
flashing done and demo apk comes within 2min after power on. Don't tell me to factory reset/Hard reset bla bla, I've done all those. Its somewhere in secure partitions, I don't know.

Anyone can help?