Custom SBF with 154_5 bootloader - Motorola Photon 4G

It wouldn't let me post in the dev forum, but I've been doing quite a bit of work with getting 4g working on a Motorola Photon with an unlocked bootloader. This bootloader isn't unlocked, however the 154_5 bootloader does not check the recovery or WebTop partitions for changes, so it is still useful. This SBF will work with 198_7 installed, all this SBF does is updates the bootloader on the Motorola Photon. This bootloader was pulled from 1FF-sunfire-user-2.3.4-4.5.1A-1_SUN-154_5-CM-release-keys-signed-Sprint-US.sbf.
EDIT:
I received a private message about which codegroups this SBF updates, so here is the list of codegroups changed from this SBF:
00: RDL03 0x00000000-0x002FFFFF D0F0 AP
01: CG02 0x00000010-0x0000580F D439 AP
02: CG39 0x00000020-0x0030001F 4C9F AP
03: CG42 0x00000050-0x0030004F E834 AP
04: CG47 0x00000070-0x0008006F 87A4 AP

---

Here is a screenshot I took showing the baseband version being that of 154_5 with 198_7 running:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

scottgl9 said:
It wouldn't let me post in the dev forum, but I've been doing quite a bit of work with getting 4g working on a Motorola Photon with an unlocked bootloader. This bootloader isn't unlocked, however the 154_5 bootloader does not check the recovery or WebTop partitions for changes, so it is still useful. This SBF will work with 198_7 installed, all this SBF does is updates the bootloader on the Motorola Photon. This bootloader was pulled from 1FF-sunfire-user-2.3.4-4.5.1A-1_SUN-154_5-CM-release-keys-signed-Sprint-US.sbf.
Click to expand...
Click to collapse
Good work man
Sent from my MB855 using xda premium

---

Can you for the love of everything holey make this work for the Electrify? You would be a hero and probably get a reward...
Sent from my Motorola Electrify using Xparent Blue Tapatalk

---

I'll take a look, right now I'm playing around with the engineering build. I was able to flash the bootloader from 1FF-sunfire-eng-2.3.5-4.5.1A-1_SUN-254_4-CM-test-keys-Sprint-US.sbf. I've actually been working on this for a while, but I decided I might as well start doing releases for people who are running into similar issues. From what I've gathered, CG42 seems to be the culprit for why 4G support is disabled with the photon unlock, as CG42 is most likely missing the wimax driver. I'll keep everyone updated so someone else won't have to reinvent the wheel so to say. If anyone is interested, I'll probably post an SBF with the 254_4 bootloader, rooted/deodexed system, and ubuntop installed in webtop to make things a bit easier.
phince1 said:
Can you for the love of everything holey make this work for the Electrify? You would be a hero and probably get a reward...
Sent from my Motorola Electrify using Xparent Blue Tapatalk
Click to expand...
Click to collapse

---

Nice. Appreciate your work.

---

PM'd scottgl9 with a couple specific questions and seeing I'm one of the few with a spare mopho I may risk the bricking to test. If this works this may be a very acceptable workaround for 4G retention for obvious reasons. Wish me luck.

---

Dirty flashing (custom recovery/kernel/ROM/webtop) results in "failed to boot 2" error. Able to recover via sbf back to stock. I will attempt clean flashing and report back.
Update before getting some sleep-
154_5 bootloader/locked/unrooted- fastboot flash of CWM5 failed
next step will be to unlock/root, flash CWM then reapply 154_5 bootloader

---

I've found that a custom recovery still isn't bootable, but the plus side is the 154_5 bootloader doesn't check the recovery partition on boot, so it shouldn't result in an error. For the webtop, I haven't actually tried to reflash it, but I have ubuntop installed in my /osh partition without any need for webtop2sd, and the bootloader doesn't complain like it does with 198_7 giving a "failed to boot 4". By the way I recommend the twrp-sunfire-2.0.0RC0 recovery as it backs up the actual files versus creating a backup image of webtop, so I've had success with that (booting a custom recovery still requires the unlocked bootloader). To get everything tweaked the way you want, you may need to flash a full SBF, make the customizations to kernel/ROM/webtop, then flash the 154_5 bootloader.
Lokifish Marz said:
Dirty flashing (custom recovery/kernel/ROM/webtop) results in "failed to boot 2" error. Able to recover via sbf back to stock. I will attempt clean flashing and report back.
Update before getting some sleep-
154_5 bootloader/locked/unrooted- fastboot flash of CWM5 failed
next step will be to unlock/root, flash CWM then reapply 154_5 bootloader
Click to expand...
Click to collapse

---

phince1 said:
Can you for the love of everything holey make this work for the Electrify? You would be a hero and probably get a reward...
Sent from my Motorola Electrify using Xparent Blue Tapatalk
Click to expand...
Click to collapse
Unless I'm missing something, this is to get 4G working on an unlocked/unlockable Photon 4G. The Electrify does not have 4G, nor would this do anything to unlock a 2.3.5 bootloader.

---

Yes it is about 4g working on an unlocked photon. And my question of "can u make this work for the electrify" is not accurate, sorry.
BUT if he can figure out how to flash the bootloader back to a previous version with success, we may be able to do that on electrify... Right?
Sent from my Motorola Electrify using Xparent Blue Tapatalk

---

Update
Steps taken and results:
SBF to stock (fine)
root/unlock (fine)
install CWM (fine)
flash Imperium (fine)
flash stock_recovery and verify (fine)
flash 154_5 bootloader (fine)
reboot (fail to boot error 2)
Start over...
Steps 1-5 (fine)
flash stock kernel (fine)
flash 154_5 bootloader (fine)
success
No custom recovery and no custom kernels.
I'll keep playing with it in my spare time.

---

phince1 said:
BUT if he can figure out how to flash the bootloader back to a previous version with success, we may be able to do that on electrify... Right?
Click to expand...
Click to collapse
Flashing the bootloader back to a previous locked or unlocked version will only be possible if we can either a) unlock the bootloader first or b) figure out how to create the SBF such that the current bootloader accepts it. The problem with 2.3.5+ phones is that they do not accept the leaked bootloader-unlocking SBF, any other non-2.3.5+ SBFs, nor edited 2.3.5+ SBFs. Only Motorola knows how to make SBFs that it accepts right now. And only already unlocked bootloaders (that don't care about the contents/signatures of flashed items) would accept anything that scottgl9 creates.
I hate to let down a fellow USCC dude, but does this make clear exactly what the problem 2.3.5 Electrify users are having? And to people more familiar with the problem (my understanding isn't perfect), does what I said make sense?

---

scottgl9 said:
I'll take a look, right now I'm playing around with the engineering build. I was able to flash the bootloader from 1FF-sunfire-eng-2.3.5-4.5.1A-1_SUN-254_4-CM-test-keys-Sprint-US.sbf. I've actually been working on this for a while, but I decided I might as well start doing releases for people who are running into similar issues. From what I've gathered, CG42 seems to be the culprit for why 4G support is disabled with the photon unlock, as CG42 is most likely missing the wimax driver. I'll keep everyone updated so someone else won't have to reinvent the wheel so to say. If anyone is interested, I'll probably post an SBF with the 254_4 bootloader, rooted/deodexed system, and ubuntop installed in webtop to make things a bit easier.
Click to expand...
Click to collapse
I think it is more complicated than missing a driver. Flashing the unlocked bootloader does not by itself actually break 4G, unlocking it however does. I have tested this myself on photons that have never run the fastboot unlock process and 4G does in fact still work. In addition I will add that on a photon 4G engineering phone 4G still does not work with those leaked sbf's.

---

Awesome
Looks like somebody might have the keys to getting 4g on unlocked bootloaders!
You guys are the best.
I have a warm feeling in my chest, it could be heartburn, but it could also be a deep rooted love of XDA and our Photon devs.

---

I dont think 2.3.5 can be broken. I was just hoping there was a way to go back to 2.3.4 which can be unlocked.
Sent from my Motorola Electrify using Xparent Blue Tapatalk

---

epark1281 said:
Looks like somebody might have the keys to getting 4g on unlocked bootloaders!
You guys are the best.
I have a warm feeling in my chest, it could be heartburn, but it could also be a deep rooted love of XDA and our Photon devs.
Click to expand...
Click to collapse
From what I see here I wouldn't get your hopes up. I think that breaking 4g is intentional on Motorola's part. We really need an expert on the moto bootloaders to take a look and figure out exactly why 4g gets broken.
phince1 said:
I dont think 2.3.5 can be broken. I was just hoping there was a way to go back to 2.3.4 which can be unlocked.
Click to expand...
Click to collapse
I have done some research into this and I don't think downgrading will be possible since a value is changed in the non-reversible fuse. Getting the bootloader unlock back is likely going to depend on Motorola.

---

Very close to having 4g in unlocked bootloader
So I know I havent posted recently and I managed to break my 4g connection even though I flashed back to stop. Well this turned out being good because I learned quite a bit about wimax, and after I deleted the followingfiles, they were regenerated and 4g worked again. The files actually reside in the data partition:
/data/misc/dhcp/dhcpcd-wimax0.pid
/data/misc/dhcp/dhcpcd-wimax0.lease
/data/data/com.motorola.blur.home.wimaxscan
/data/data/com.motorola.android.dm.remoteplugin.wimax
/data/property/persist.sys.wimax.tx
/data/property/persist.sys.wimax.rx
/data/tmp/.wsb_icons/wimax
/data/tmp/wimax_log_logfile
/data/system/wimax_oma_dm.db
/data/system/wimax_scan.db
I also had some interesting output from the log:
ERROR: Test Number: 0 Errors so far: 1 Error: /system/xbin/sqlite3 does not exist
WARNING: Test Number: 0 Warnings so far: 1. Warning: /system/xbin/sqlite3 not executable
ERROR: Test Number: 0 Errors so far: 2 Error: Unable to make executable
ERROR: Test Number: 0 Errors so far: 3 Error: /system/bin/busybox does not exist
WARNING: Test Number: 0 Warnings so far: 2. Warning: /system/bin/busybox is not executable
ERROR: Test Number: 0 Errors so far: 4 Error: Unable to make executable
ERROR: Test Number: 0 Errors so far: 1 Error: /system/xbin/sqlite3 does not exist
WARNING: Test Number: 0 Warnings so far: 1. Warning: /system/xbin/sqlite3 not executable
ERROR: Test Number: 0 Errors so far: 2 Error: Unable to make executable
wimax support is actually present in the pudding unlocked bootloader, so I think I'm very close to figuring this thing out.

---

That's awesome PM joker he messed with it a while back I bet he would be able to help you
Sent from my MB855 using xda premium

---

I've also discovered that /etc/wimax/wimaxd.conf is generated at runtime, and invalid credentials could be causing the problem.