[HOW-TO] RSD Lite SBF Flashing Experience - Motorola Photon 4G

I´ll start with writing, what happend to me, about some weeks ago.
Warning:
Never do this !!!
I wanted to flash the radio from the Photon 2.3.5 leak and I could not find the CWM recovery method (found later after this, thanks Olegfusion), so I took the bp.img and tear it apart with hexeditor to:
amss_sec.mbn
dbl_sec.mbn
osbl_sec.mbn
partition.mnb
RDL1.smg
Depacked full sbf with Motoandroiddepacker (from Skrilax_CZ), extracted headers and just changed mbns and cdt.bin (CG3.smg), later unlocked bootloader (CG42.smg) and tried to repack. Problem was, any try to include CG3.smg (even the default) failed when repacking, so I decided to not include this one.
After several tries I "succesfully" flashed my repacked sbf with radio, but everytime ended at 90% of flashing CG5.smg. I tried more variations, but nothing.
And ended up with Failed to boot 1 (when trying to start as locked) and after unlocking modem did not power up.
So my state now was, switched fuse with broken radio part. Cool
My fuse now - cat /sys/firmware/fuse/ReservedOdm - 10000000000030001000100004000
Then I found the cwm method of flashing radio, thanks to Olegfusion, but this did not helped me. Always, modem did not power up. Only way, how to start Android was through fastboot option Boot Android (No BP).
So I had to find a way, how to fully flash the radio with RSD Lite.
Everytime I tried to flash full 198_7 sbf, it ended right before flashing the radio. Because it flashed the locked bootloader first and while restarting right before CG5.smg (radio) flashing, it writes Failed to boot 1.
I tried to make my own full sbf with unlocked bootloader, but MotoAndroidDepacker, does not accept CG3.smg
So I started thinking(lol):
When RSD Lite creates the image at the beggining, where it is stored?
I found it at C:\Users\--your user dir--\AppData\Local\Motosftemp (win7).
It was a surprise for me, when I found, it was just the depacked sbf with all smgs and firmware.hmg right after the creating image part was done.
This gave me the light of hope.
So I tried to flash my sbf, took those smgs, then full sbf, changed smgs I needed and started with 2nd reflashing. But another problem, RSD Lite recognizes, when those files are changed and when not. If there are unchanged files, and you start 2nd reflashing without exiting RSD, it skips the creating image files. But when you change any, it´s starting over, and all those smgs are created again.
So I started to think about speed hacking it.
I have depacked derpunlock.sbf, my.sbf and full.sbf in RSD temp dir and I thought, I need the leaked cdt.bin and radio.img, because of fuse switched (that was not the right combination). So I started with very slow full sbf flashing speed hacks. Many times.
The super clever speed hack method (lol):
Right after creating image files part, the phone restarts.
This is the time, you need to quickly change (overwrite) those needed smgs.
The right combination that helped me to flash full sbf with radio was CG3.smg (cdt.bin - not sure if it is needed, I took the one from the leaked 2.3.5 zip) and CG42.smg (unlocked bootloader).
That lets the flashing process continue when changing to CG5.smg (radio) flashing. No failed to boot 1.
So, the fuse is switched forever, but I have my radio working again.
As I don´t need 4G, I don´t mind being unlocked.
Most of you don´t need all this, but someone could find it helpful.
Sorry for my English.

---

but anyway failed to boot 1 is there with locked bootloader.

---

Yes, that method keeps you unlocked. Because of that, no failed to boot 1.

---

I still don't understand how my fuse got switched. I flashed the 2.3.5 that did not include the bootloader
Sent from my MB855 using Tapatalk 2

---

Neither I flashed the new bootloader, there would be no way to unlocking then.
But the radio did it on my side.

---

for truth, I really worry flashing sbfs really hope once we'll get new unlock

---

peetr_ said:
The super clever speed hack method (lol):
Right after creating image files part, the phone restarts.
This is the time, you need to quickly change (overwrite) those needed smgs.
The right combination that helped me to flash full sbf with radio was CG3.smg (cdt.bin - not sure if it is needed, I took the one from the leaked 2.3.5 zip) and CG42.smg (unlocked bootloader).
That lets the flashing process continue when changing to CG5.smg (radio) flashing. No failed to boot 1.
Click to expand...
Click to collapse
im looking at the folder(motosftemp) and hit start (to begin flashing) but i dont see it creating the extracted temp files.

---

So is it possible to flash the new radio? If so is there a link?
Sent from my MB855 using Tapatalk 2

---

js11222 said:
So is it possible to flash the new radio? If so is there a link?
Sent from my MB855 using Tapatalk 2
Click to expand...
Click to collapse
Seems like it but also might switch a fuse and leave you locked down to a certain bootloader.
Sent from my MB855 using Tapatalk 2

---

For those who has death of phone on reboot or power off and who needs to pull out the battery for some time after the phone dead, this method will fix this trouble for you.
Replace codegroups 3 and 42 from unlocked sbf and flash original sbf with that. you'll fix reboot/power off death.
I fixed it in my photon.
---------- Post added at 03:34 PM ---------- Previous post was at 03:31 PM ----------
regarding radio flash, I think I wouldn't recommend to do it until you understand fully next thing:
when you flash radio bp.img from ota, you have no troubles with fuse.
but if you'll flash boot.img original, you'll switch your fuse on first kernel boot if you'll have radio flashed. So, I do not recommend to flash any native original kernels if you're unlocked. The result may go that you'll not able to lock back and receive failed to boot 1. You'll have only way to flash 2.3.5 bootloader or stay unlocked.
boot.img + bp.img from 2.3.5 = cat /sys/firmware/fuse/ReservedOdm - 10000000000030001000100004000 after first boot.

---

Hi!
I'm stuck on locked ota (wife was using phone and clicked "install update" before I had a chance to to anything...).
Would there be a way to use the "RSD speed hack" to install stock SBF 2.3.5 and the Japanese radio that is being used to enable our phones to work on domestic USA GSM networks?

---

There is no Photon 2.3.5 sbf, but you could be probably able to flash the radio with bootstrap, because it looks like Lightsword1942 got motoflash working on bootstrap.
But if you will want the default radio back, you have to flash sbf, that we do not have. But there is a possibility of reflashing 198_7 by hacking rsd flash with 2.3.5 bootloader.
But again, it's risky and noone tried it yet.

---

peetr_ said:
There is no Photon 2.3.5 sbf, but you could be probably able to flash the radio with bootstrap, because it looks like Lightsword1942 got motoflash working on bootstrap.
But if you will want the default radio back, you have to flash sbf, that we do not have. But there is a possibility of reflashing 198_7 by hacking rsd flash with 2.3.5 bootloader.
But again, it's risky and noone tried it yet.
Click to expand...
Click to collapse
Out of the code groups..which is the bootloader?
Sent from my MB855 using Tapatalk 2

---

CG42.smg

---

I did try to flash the radio zip on bootstrap. Didn't work. (btw - I have an electrify).
http://forum.xda-developers.com/showpost.php?p=26383711&postcount=75

---

Because you don't have the right zip for bootstrap. Ask Lightsword1942 for this.
If you have electrify, then you can probably reflash with 2.3.5 sbf normally, you don't need to hack RSD.