[How-To] Unlock ATT/T-Mobile on 2.3.5 OTA - Motorola Photon 4G

IMPORTANT: This guide is for users with a Motorola Photon 4G (MB855) running the 2.3.5 OTA update only. For the lucky ones still running 2.3.4, you want this thread. For those of you who don’t know what version of Android you are running, DO NOT try this. Please read these forums carefully and learn everything you can before attempting this.
This guide is based on the work of halfevildruid and his thread for unlocking GSM for Photon users on 2.3.4 with unlocked bootloaders. All users should take the time to carefully read through that thread here and keep in mind that it was written for 2.3.4/unlocked bootloader users. Some files and steps in that thread will not work on Photons that have had the 2.3.5 OTA applied.
Unlocking US GSM Carriers on 2.3.5 OTA​
Before You Start:
Doing this will remove the domestic GSM carrier lock on the Sprint Photon running 2.3.5 OTA. This process will most likely break your ability to return to Sprint service, so please DO NOT DO THIS if you want to keep your Photon running on Sprint. There are ways to fix this, but none have been tested on 2.3.5 OTA devices. As far as I know, this method has been confirmed to work on three phones (including mine), so consider this experimental and high risk. I am not responsible for bricked phones, warranty issues, cats chasing dogs or hot snow falling up if you try this.
Things You Need:
1.Windows PC (tested on Win 8) with the following software installed:
-Motorola USB Drivers [Download]​-RSD Lite [Download]​-ADB Tools/Android SDK [Download] (Not really necessary, but helpful if you have USB issues.)​2. Micro USB cable and wall charger (needed for bootstrap recovery)
3. Standard (full size) SIM card for US GSM network. (ATT/T-Mobile/Straight Talk)
4. Micro SD card (not necessary, but good just in case)
5. Motorola Photon running 2.3.5 OTA ONLY
Files You Need:
1.Full US Cellular Electrify SBF [Download]
-1FF-sunfire-user-2.3.5-4.5.1A_SUN_USC_19.0-19-release-keys-signed-USC-US.sbf​2. Unbrick SBF [Download]
- 2.3.5_45.4.13ota_unbrick.sbf​3. Electrify/Photon (almost) One Click Root [Download]
-su.zip​4. Bootstrap Recovery [Download]
-MOTODX2_Bootstrap_signed.apk​5. Peetr’s Hybrid Locked 2.3.5 ROM [Dev Thread/Download]
-HybridGBv20locked.zip​6. KDDI Radio [Download]
- KDDI_Radio_udate.zip​
If any links do not work, most can be found at www.motosunfire.com.
Steps
1. Backup Your Stuff!
2. Shutdown phone and remove SIM/SD card (if applicable)
-Tip: Leave your battery cover off. There’s going to be a lot of battery pulls…​3. Open RSD Lite on your computer.
4. Start phone in RSD mode:
-With phone unplugged hold volume-down and power
-It should say fastboot in the top left corner, press volume-down until RSD appears
-Connect phone to computer
-Press volume-up to enter RSD mode​5. Select the full US Celluar SBF in RSD lite and press start.
-This process takes a few minutes and will end in an error, this is normal.
-The phone may hang on the dual core screen, if so pull the battery.
-The phone will either do two things:
-Bootloop with the US cellular logo
-Boot normally to home screen​-In either case, pull the battery and follow the steps to enter RSD mode again.​6. Once you are in RSD mode again, flash the Unbrick SBF
-This should not end in an error, but RSD may say you need to manually reboot your phone, this is normal.
-Once your phone reboots you may experience bootlooping, if so do a factory reset (See below)
-With the phone off pess vol-down + power
-Press vol-down until Android Recovery is shown, press vol-up to enter.
-Press both vol-up + vol-down to see menu.
-In the recovery screen, use the volume buttons to scroll and select factory restore.
-Press power to wipe the phone.
-When complete, reboot phone and you should successfully boot to home.​7. Once you have flashed the two SBFs, you should be able to get to the stock US Celluar rom.
8. After everything has loaded, you need to obtain root access. (See below)
-Make sure all USB drivers are installed on your computer.
-Enable USB debugging mode on phone (System>Applications>Development)
-Unzip the su.zip on your computer and open root.bat, the program will take you through the rest.​9. Once rooted, place the KDDI zip and Peetr’s ROM on either the internal or external storage.
-This is also a good time to install your SIM card.​10. Install the Bootstrap recovery and follow the instructions to boot into recovery.
-Remember: You need to be on AC power to get into Bootstrap recovery.​11. In recovery, flash the KDDI zip and then Peetr’s ROM
12. After installing the ROM, flash KDDI again.
-Flash KDDI as many times as you want, it will give an error but will still work.​13. Reboot phone and enjoy the GSM radio.:highfive:
-If you bootloop again, just do another factory reset. Peetr’s ROM will still be there.
-You may have to root and install Bootstrap again.
-It never hurts to flash KDDI one more time just to be sure.​
See next post for Q&A

---

Q&A
When You’re Done:
Q: How can I go back to Sprint?
A: The only way that worked for me was by flashing 2.3.5. Photon 4.5.1A-1_SUN-254_13 from this thread. This will take the phone back to mostly stock, but there may be residual radio issues.
Q: What carriers can I use now?
A: Any GSM carrier that uses a standard SIM card. These include:
-ATT (3G)
-T-Mobile (2G/EDGE unless you live in a re-farmed area.)
-Straight Talk (3G w/ATT SIM, 2G w/T-Mobile SIM)​
Q: Can I unlock my bootloader now?
A: Nope. This only unlocks the GSM radio.
Q: Can I install a different ROM than Peetr’s hybrid?
A: SIM unlocking has only been confirmed to work on Peetr’s locked hybrid rom.
Q: I’m pissed at Motorola for canceling the ICS upgrade. How can I sleep at night?
A: As of right now (and probably forever) there is no way to install any version of Android higher than 2.3.5 on any Photon with the 2.3.5 OTA. However, Peetr’s ROM can be modified to make it look and function like ICS. Planters76 has made an excellent theme for the hybrid ROM that can be flashed in Bootstrap. It can be found here.
Once you flash that theme there are several applications on the Play Store that replicate the ICS/JB experience. Developer Moblynx offers replacements for the clock, camera and gallery. Mobint Software makes home and lockscreen replacements as well. I’m not affiliated with these developers, but their work is solid. This is as close as were going to get to ICS on 2.3.5.
Q: Which developers contributed to this?
A: halfevildruid, mof9336, peetr_, Noncs, Lightsword1942, Planters76, and many others. If anyone else would like to be mentioned, let me know and I’ll add you in. Without these developers we’d be left out in the cold, so give them some thanks.
Q: Who are you and what are you doing here?
A: I am not a developer myself, so just think of me as the person gathering all of the information and trying to simplify it. I can’t stand planned obsolescence, so the Photon is a sore point for me. I’ve stayed in the shadows before now because I haven’t had a reason to speak up, but the locked down OTA and cancelled ICS update bugged the hell out of me. I was in the first soak test for the 2.3.5 OTA, so I had no warning that Motorola was about to screw me and many others. If I can help anyone else that was locked down eek any more life from their phones, then I’ve done my job.
Q: I’m lost! Can you help?
A: Just reply with your questions and I’ll try my best. Keep in mind that I am not a developer, so there are some questions I may not have an answer to.
Finally, if anyone finds any incorrect information in my post or some other error, please let me know so I can fix it. I’d like to prevent any unnecessary phone damage if possible.

---

Works great. thanks.
now 3G shows 4 bars instead of 1 earlier.
I had to use libmoto_198_7
peetr's ROM is cool. and I like the keyboard!
great work.

---

Works, but WIFI shows error
I followed the steps and I have my Sprint Photon working in AT&T. But the issues is, the Wifi shows error and doesnt start at all. is there something that can be fixed. Also, How can I get my Google Play up and running. The market icon in the stock Peeters ROM doesnt seem to work and time and again just goes to a browser Window.
Thanks a lot for compiling the steps here...

---

The combination of a WiFi and apk error makes me think that the ROM needs to be flashed again. Also try downloading a new copy of the zip in case the first one was corrupted. If that doesn't fix it, there was another zip floating around the dev forums that fixed WiFi and MMS issues on the USC ROMs. The file is USCMMSWIFI.zip, I just don't know exactly where it is. As for Play store issues, look around for a recent copy of vending.apk or a flashable zip version and install it manually.
Sent from my MB855 using xda app-developers app

---

flashing 2.3.5_45.4.13ota_unbrick.sbf at the end fixes wifi issues.

---

Thanks portman and makakalo. I will do the same. I found the USCMMSWIFI.zip, but it is not in a SBF fashion. Any steps that I could follow to include this fix would help me. Thanks again and Merry Christmas!!

---

Reflashing Peetr's ROM didnt help with Wifi
I reflashed Peetr's ROM, but still stuck with WiFi Error...Installed USCMMSWIFI.zip using Bootstrap Receovery Mode and the installation completed. Yet, Wifi Error is persistent and cant use Wifi

---

If you haven't already done so, do what portman suggested and flash the unbrick sbf again. If that still doesn't fix it the only other thing I can think of is going back to stock and redoing the entire process. You may need the 254_12 radio sbf and libmoto zip as well as the 254_13 modules zip to completely reset. Those files are in the 2.3.5 sv2 unbrick thread in the dev forum.
Sent from my MB855 using xda app-developers app

---

Dear all
Thanks..Got it working. Realized that there was some issue in the Peetr's zip file downloaded. Went through the process meticulously after redownloading and got my phone working in an amazing manner!! Thanks a lot to all.
regards
Ram

---

Thanks for putting this together, I am still waiting on my SIM, should be in the mail today.
Just one question on the root method..does it really mater which root method I use?
The last time I rooted this phone I used torpedo direct v1.1

---

I seem to be stuck in the unbrick sbf??
Manually powered up my phone a couple of times.
Never mind stuck in bootloop...DOH!

---

Wipe data/cache
Sent from my MB855 using xda app-developers app

---

Something strange
I was stuck in a bootloop after flashing the Hybrid ROM/kddi and I could not even get to bootstrap soo, I went back to the beginning and after the first SBF step the phone starts normally and my baseband is N_02.29.04P.
Now I have a US cellular phone with a GSM radio:silly:
The phone is not rooted at this time nor did I run the unbrick sbf.
I am tempted to use it like this to see if I can activate it on my carrier...heh why not.
Update:So what does the unbrick do? Do I need to run it?
wifi works now and it did not work before the phone seems fine, still want to root and load bootstrap though.
My carrier cannot activate me until after the holiday, but the phone shows me on the Tmo network.

---

After flashing the unbrick sbf, my phone is probably bricked as it is now stuck on : Failed to boot 4, starting RSD mode
Any idea how to recover ?
Thanks !

---

portman said:
Wipe data/cache
Sent from my MB855 using xda app-developers app
Click to expand...
Click to collapse
As many times as I have done this you would think I would remember that, but no.
After wipe data/cache I got the hybrid rom to load and ran fine except I could not get the radio to work??
Tried rebooting several times, reinstalling kddi several times, but no go.
Fortunately I made a backup, so went back to USCell ROM and the radio was back

---

khatta said:
After flashing the unbrick sbf, my phone is probably bricked as it is now stuck on : Failed to boot 4, starting RSD mode
Any idea how to recover ?
Thanks !
Click to expand...
Click to collapse
The failed to boot 4 means there's a problem with that partition meaning, whether its corrupt or not there, it just won't boot and will relay that if to you.
To recover, I'd imagine that you need to try the steps over after wiping your data/cache but to make sure that the phone boots after flashing a full sbf.
http://forum.xda-developers.com/showthread.php?t=1759997 (This has lots of info on the sbfing you are doing)
Sent from my sunfire using xda premium

---

you need to flash anyone of the following using bootstrap recovery
198_7 radio sbf ----- 198_7 libmoto_ril.so
254_12 radio sbf ----- 254_12 libmoto_ril.so
(thanks to Peetr_)
in my case 198_7 radio sbf ----- 198_7 libmoto_ril.so did the trick even when my phone had a locked bootloader.
after this flash KDDI radio
DXM31 said:
As many times as I have done this you would think I would remember that, but no.
After wipe data/cache I got the hybrid rom to load and ran fine except I could not get the radio to work??
Tried rebooting several times, reinstalling kddi several times, but no go.
Fortunately I made a backup, so went back to USCell ROM and the radio was back
Click to expand...
Click to collapse

---

portman said:
you need to flash anyone of the following using bootstrap recovery
198_7 radio sbf ----- 198_7 libmoto_ril.so
254_12 radio sbf ----- 254_12 libmoto_ril.so
(thanks to Peetr_)
in my case 198_7 radio sbf ----- 198_7 libmoto_ril.so did the trick even when my phone had a locked bootloader.
after this flash KDDI radio
Click to expand...
Click to collapse
I flashed the 254 before and it was a no go for the radio.
I just did a backup and just to be clear on what I need to do:
wipe data/cache/dalvik
flash hybrid ROM
flash 198_7
flash 254_12
flash radio
and I should be golden, correct?
thanks
as a side note:
the phone is currently working great with the usc rom except the network shows T-Mobil the 'e' gets loped off and I have not actually activated the phone yet because my carrier was closed yesterday(wonder why) they said after Wednesday I should get an email.

---

DXM31 said:
As a side note:
the phone is currently working great with the usc rom except the network shows T-Mobil the 'e' gets loped off and I have not actually activated the phone yet because my carrier was closed yesterday(wonder why) they said after Wednesday I should get an email.
Click to expand...
Click to collapse
Thank God, I thought I was the only one with the T-mobil issue. It happens on every ROM. I noticed if I dial *#*#4636#*#* and go to phone info, it sticks the e on the end for a little while but other than that, I randomly have it.