Hi all,
I had my S9+ unlocked, but then I flashed stock back (just boot/system/vendor, probably not the same version as the rest), and since then, I can no longer OEM unlock.
I can select the option, and initiate the unlock, this will even actually factory reset the device.
But then, if I go to bootloader, it says FRP unlocked, OEM locked.
I've tried flashing a full firmware, but the result remains the system.
FWIW, I flash usng heimdall not Odin. I'll probably try with Odin, but I expect to get the same result.
I think I've found in the logs the reason for that behaviour:
I have ro.frp.pst = /dev/block/dummy
While it should be /dev/block/persist
I've checked in all partition in the firmware I've flashed if there was any reason some part of the firmware set this to dummy, and I didn't find anything.
I couldn't even find any reference to /dev/block/dummy at all!
So, does someone have some clue about my issue?
Thanks!
Ok, so some updates from my part, I've found the culprit of ro.frp.pst = /dev/block/dummy
That's @jesec's OEM lock protection patch:
https://forum.xda-developers.com/showpost.php?p=75893923&postcount=3
Part of the patch is to set ro.frp.pst=/dev/block/dummy
I guess that the stock ROM I flashed somehow reseted FRP anyway.
If I had an EFS backup, the fix would be easy, but guess what... I don't...
So now I'm currently looking for ways to backup EFS, without root obviously. (or a way to root with closed bootloader)
phhusson said:
Ok, so some updates from my part, I've found the culprit of ro.frp.pst = /dev/block/dummy
That's @jesec's OEM lock protection patch:
https://forum.xda-developers.com/showpost.php?p=75893923&postcount=3
Part of the patch is to set ro.frp.pst=/dev/block/dummy
I guess that the stock ROM I flashed somehow reseted FRP anyway.
If I had an EFS backup, the fix would be easy, but guess what... I don't...
So now I'm currently looking for ways to backup EFS, without root obviously. (or a way to root with closed bootloader)
Click to expand...
Click to collapse
This just happened to me too. My factory.prop change came from a rmm bypass zip floating around that everyone was using to stop going to custom rom jail. The big difference here is I didn't try to (or want to) relock my bootloader, instead some GSI rom I was trying out did it for me without even a prompt, I don't know when. I just eventually rebooted and suddenly couldn't boot. My only guess on that front is I did once I think accidentally disable the developer settings area, which the rom may have decided it was a good idea to turn everything off in there.
Anyway, did you figure this out? I have multiple efs backups, but I can't find a way to actually restore one without root. Even the z3x can't do it without root and it doesn't have temp root shell ability for the 9650. On the s8 you could always flash efs via odin using a efs.img.ext4 file in a normal tar, but I made one like I've done on the s8 and I get secure check fail in download mode.
My only last recourse is to try and completely erase efs, imei and all and then hope that you can still toggle oem unlock without an imei. If so then I should be set as I can just root and restore my backup. But if not, I'm now even more boned.
Similar issue
Hello to everyone! :laugh:
I think that I have a similar issue with my Galaxy S9
I recently installed an android 9.0 GSI image.
After disabling developer options in settings and rebooting the phone it never completed the boot process.
It was showing "Custom binary blocked by FRP lock" error.
I successfully restored stock firmware through odin, but the phone is OEM and FRP locked.
I tried many times to toggle on OEM unlock through developer settings with no result, even though the phone goes through a factory reset.
Do you guys find out if there is any possible way at this stage to OEM unlock this device ?
phhusson said:
Ok, so some updates from my part, I've found the culprit of ro.frp.pst = /dev/block/dummy
That's @jesec's OEM lock protection patch:
https://forum.xda-developers.com/showpost.php?p=75893923&postcount=3
Part of the patch is to set ro.frp.pst=/dev/block/dummy
I guess that the stock ROM I flashed somehow reseted FRP anyway.
If I had an EFS backup, the fix would be easy, but guess what... I don't...
So now I'm currently looking for ways to backup EFS, without root obviously. (or a way to root with closed bootloader)
Click to expand...
Click to collapse
Did you ever fix this issue?
Interceptor777 said:
Did you ever fix this issue?
Click to expand...
Click to collapse
I managed to fix this. It resulted in another 7d jail session but I did manage to figure out a way to fool the device into resetting efs, and in a way that did not erase the important stuff (I think thanks to backup, but maybe not).
If you find yourself stuck like this, let me know and I'll help
partcyborg said:
I managed to fix this. It resulted in another 7d jail session but I did manage to figure out a way to fool the device into resetting efs, and in a way that did not erase the important stuff (I think thanks to backup, but maybe not).
If you find yourself stuck like this, let me know and I'll help
Click to expand...
Click to collapse
Hey! Thanks!
Could you tell me how you wiped EFS with a locked bootloader? I'm planning on flashing combo firmware to test some modem settings which are locked even with root on stock and I want to be able to go back to stock just in case and not wait 7 days.
Thanks for your help!
Interceptor777 said:
Hey! Thanks!
Could you tell me how you wiped EFS with a locked bootloader? I'm planning on flashing combo firmware to test some modem settings which are locked even with root on stock and I want to be able to go back to stock just in case and not wait 7 days.
Thanks for your help!
Click to expand...
Click to collapse
Wiping efs will not erase the RMM lock. The only thing it fixed was the very specific issue where your bootloader is relocked by non-samsung rom which doesn't look at the frp partition and when you try to unlock again from a Samsung rom, it does try to look at the frp partition which it can't find because the RMM bypass zip sets ro.frp.pst to /dev/block/dummy in /efs/factory.prop. when this happens you're basically screwed because you can't unlock without that prop being set right, and nothing erases that prop file and without root your can't even see it much less change it.
Luckily I found a nice loophole that let me overwrite the entire efs filesystem thus erasing the prop (but not the special data at the end fortunately) and allowing me to unlock again, but the act of doing this resulted in another 7d RMM jail which was annoying but given I was perm locked before it seemed like an ok trade ?.
What settings are you trying to adjust? I'm not aware of anything that combo has open that you can't get to with rooted stock provided you twiddle all the knobs in efs correctly. Did you set factory ON & keystr OFF an HiddenMenu ON?
partcyborg said:
Wiping efs will not erase the RMM lock. The only thing it fixed was the very specific issue where your bootloader is relocked by non-samsung rom which doesn't look at the frp partition and when you try to unlock again from a Samsung rom, it does try to look at the frp partition which it can't find because the RMM bypass zip sets ro.frp.pst to /dev/block/dummy in /efs/factory.prop. when this happens you're basically screwed because you can't unlock without that prop being set right, and nothing erases that prop file and without root your can't even see it much less change it.
Luckily I found a nice loophole that let me overwrite the entire efs filesystem thus erasing the prop (but not the special data at the end fortunately) and allowing me to unlock again, but the act of doing this resulted in another 7d RMM jail which was annoying but given I was perm locked before it seemed like an ok trade .
What settings are you trying to adjust? I'm not aware of anything that combo has open that you can't get to with rooted stock provided you twiddle all the knobs in efs correctly. Did you set factory ON & keystr OFF an HiddenMenu ON?
Click to expand...
Click to collapse
Hey, I'm trying to adjust LTE Cat Control settings and LTE Carrier Aggregation settings. These seetings are all available through the RIL Service Mode Main Activity, however Main Activity has been completely gimped and disabled in stock. Not only is it impossible to launch, I'm pretty sure at this point the package is just empty since it just force closes upon launch.
I said **** it and flashed combo firmware yesterday, and just like I thought, the menu was there and you don't even need root to access it. You just need to dial the code in the IME dialer. On stock, the only way to get to this menu was either by launching the activity (doesn't work anymore), using a su shell and broadcasting the code (also doesn't work anymore) or just broadcasting the code without su (never worked).
Luckily Samsung doesn't relock bootloader anymore by flashing stock so RMM Prenormal won't be an issue for me.
Also to cllarify, this is the main service menu that contains every other LTE service menu.
Also what do you mean by factory ON and those other things?
Interceptor777 said:
Hey, I'm trying to adjust LTE Cat Control settings and LTE Carrier Aggregation settings. These seetings are all available through the RIL Service Mode Main Activity, however Main Activity has been completely gimped and disabled in stock. Not only is it impossible to launch, I'm pretty sure at this point the package is just empty since it just force closes upon launch.
I said **** it and flashed combo firmware yesterday, and just like I thought, the menu was there and you don't even need root to access it. You just need to dial the code in the IME dialer. On stock, the only way to get to this menu was either by launching the activity (doesn't work anymore), using a su shell and broadcasting the code (also doesn't work anymore) or just broadcasting the code without su (never worked).
Luckily Samsung doesn't relock bootloader anymore by flashing stock so RMM Prenormal won't be an issue for me.
Also to cllarify, this is the main service menu that contains every other LTE service menu.
Also what do you mean by factory ON and those other things?
Click to expand...
Click to collapse
Exactly as I suspected ?
You don't need combo to get into ril service menu, you just need the settings I spoke of set correctly. I know this first hand as I got into mine this way, no combo necessary.
To turn all the hidden stuff on, you need a combination of the following 3 flags set as given below, and to be on a csc that does not block secret codes/service menus
The flags are all files in efs that need specific values in them. For ease of use I just wrote them all as commands you can copy/paste into a terminal with root or in TWRP recovery after mounting /efs
OBLIGATORY WARNING: USE AT YOUR OWN RISK! modifying efs can be dangerous in that if you mess it up badly you can lose your imei and render your phone radioless. To anyone else reading this, don't do this unless you know what you are doing with it and why.
/efs/FactoryApp/factorymode ON
Code:
echo -n ON > /efs/FactoryApp/factorymode
/efs/FactoryApp/keystr OFF
Code:
echo -n OFF > /efs/FactoryApp/keystr
/efs/carrier/HiddenMenu ON
Code:
mkdir -p /efs/carrier; echo -n ON > /efs/carrier/HiddenMenu
*NOTE: this one is slightly different because at least on one of my devices the carrier directory did not exist at first as there are no other files in it, so this command is modified to create it if it's not there already.
Run those 3 commands after running su if you do this from adb or a term emulator while booted, or as I said you can do it from TWRP just be sure /efs is mounted first as it's not by default. Then reboot and you should be able to either use shortcut master to get to RIL servicemode (and a few more other goodies too), or you can always just open up either DRParser app or stock Samsung phone and enter *#27663368378# and it should pop right up.
If for some reason it doesn't let me know, there are more things to try including changing CSC, and there is a global hidden menu prop that wasn't necessary for me as the 9650s don't have the actual HiddenMenu app installed at all, but the above was all I had to do to get things working
As for the CSC thing idk if any of the cscs in whatever region you were running do this, or if even any cscs in the 9650 do it at all even but on Samsung "XXXXU" devices sold in the USA certain carriers block all hidden menu type access no matter what, so if this doesn't work take a backup and change your CSC and see if that fixes it.
Interceptor777 said:
Luckily Samsung doesn't relock bootloader anymore by flashing stock so RMM Prenormal won't be an issue for me.
Click to expand...
Click to collapse
I'm not sure what you mean by "doesn't relock bootloader anymore", but if you reflash stock vendor without flashing the RMM bypass your bootloader will be relocked and you will be unable to unlock it again for 7 days. This is precisely what I was talking about
partcyborg said:
Exactly as I suspected ?
You don't need combo to get into ril service menu, you just need the settings I spoke of set correctly. I know this first hand as I got into mine this way, no combo necessary.
To turn all the hidden stuff on, you need a combination of the following 3 flags set as given below, and to be on a csc that does not block secret codes/service menus
The flags are all files in efs that need specific values in them. For ease of use I just wrote them all as commands you can copy/paste into a terminal with root or in TWRP recovery after mounting /efs
OBLIGATORY WARNING: USE AT YOUR OWN RISK! modifying efs can be dangerous in that if you mess it up badly you can lose your imei and render your phone radioless. To anyone else reading this, don't do this unless you know what you are doing with it and why.
/efs/FactoryApp/factorymode ON
/efs/FactoryApp/keystr OFF
/efs/carrier/HiddenMenu ON
*NOTE: this one is slightly different because at least on one of my devices the carrier directory did not exist at first as there are no other files in it, so this command is modified to create it if it's not there already.
Run those 3 commands after running su if you do this from adb or a term emulator while booted, or as I said you can do it from TWRP just be sure /efs is mounted first as it's not by default. Then reboot and you should be able to either use shortcut master to get to RIL servicemode (and a few more other goodies too), or you can always just open up either DRParser app or stock Samsung phone and enter *#27663368378# and it should pop right up.
If for some reason it doesn't let me know, there are more things to try including changing CSC, and there is a global hidden menu prop that wasn't necessary for me as the 9650s don't have the actual HiddenMenu app installed at all, but the above was all I had to do to get things working
As for the CSC thing idk if any of the cscs in whatever region you were running do this, or if even any cscs in the 9650 do it at all even but on Samsung "XXXXU" devices sold in the USA certain carriers block all hidden menu type access no matter what, so if this doesn't work take a backup and change your CSC and see if that fixes it.
I'm not sure what you mean by "doesn't relock bootloader anymore", but if you reflash stock vendor without flashing the RMM bypass your bootloader will be relocked and you will be unable to unlock it again for 7 days. This is precisely what I was talking about
Click to expand...
Click to collapse
Hey, unfortunately it didn't work for me ;(
I tried it with TMB USA CSC and also on XEU CSC.
Maybe I also need to change that hiddenmenu prop? My phone actually has the hiddenmenu app.
partcyborg said:
Exactly as I suspected ?
You don't need combo to get into ril service menu, you just need the settings I spoke of set correctly. I know this first hand as I got into mine this way, no combo necessary.
To turn all the hidden stuff on, you need a combination of the following 3 flags set as given below, and to be on a csc that does not block secret codes/service menus
The flags are all files in efs that need specific values in them. For ease of use I just wrote them all as commands you can copy/paste into a terminal with root or in TWRP recovery after mounting /efs
OBLIGATORY WARNING: USE AT YOUR OWN RISK! modifying efs can be dangerous in that if you mess it up badly you can lose your imei and render your phone radioless. To anyone else reading this, don't do this unless you know what you are doing with it and why.
/efs/FactoryApp/factorymode ON
/efs/FactoryApp/keystr OFF
/efs/carrier/HiddenMenu ON
*NOTE: this one is slightly different because at least on one of my devices the carrier directory did not exist at first as there are no other files in it, so this command is modified to create it if it's not there already.
Run those 3 commands after running su if you do this from adb or a term emulator while booted, or as I said you can do it from TWRP just be sure /efs is mounted first as it's not by default. Then reboot and you should be able to either use shortcut master to get to RIL servicemode (and a few more other goodies too), or you can always just open up either DRParser app or stock Samsung phone and enter *#27663368378# and it should pop right up.
If for some reason it doesn't let me know, there are more things to try including changing CSC, and there is a global hidden menu prop that wasn't necessary for me as the 9650s don't have the actual HiddenMenu app installed at all, but the above was all I had to do to get things working
As for the CSC thing idk if any of the cscs in whatever region you were running do this, or if even any cscs in the 9650 do it at all even but on Samsung "XXXXU" devices sold in the USA certain carriers block all hidden menu type access no matter what, so if this doesn't work take a backup and change your CSC and see if that fixes it.
I'm not sure what you mean by "doesn't relock bootloader anymore", but if you reflash stock vendor without flashing the RMM bypass your bootloader will be relocked and you will be unable to unlock it again for 7 days. This is precisely what I was talking about
Click to expand...
Click to collapse
Hey! Nevermind that last comment.
I had to change my CSC from TMB to XAA which is USA unlocked, and I also added the hiddenmenu prop, and it's finally ****ing working now! Dialing the code in dialer brings up the menu.
Thanks so much for your help!
partcyborg said:
Exactly as I suspected ?
You don't need combo to get into ril service menu, you just need the settings I spoke of set correctly. I know this first hand as I got into mine this way, no combo necessary.
To turn all the hidden stuff on, you need a combination of the following 3 flags set as given below, and to be on a csc that does not block secret codes/service menus
The flags are all files in efs that need specific values in them. For ease of use I just wrote them all as commands you can copy/paste into a terminal with root or in TWRP recovery after mounting /efs
OBLIGATORY WARNING: USE AT YOUR OWN RISK! modifying efs can be dangerous in that if you mess it up badly you can lose your imei and render your phone radioless. To anyone else reading this, don't do this unless you know what you are doing with it and why.
/efs/FactoryApp/factorymode ON
/efs/FactoryApp/keystr OFF
/efs/carrier/HiddenMenu ON
*NOTE: this one is slightly different because at least on one of my devices the carrier directory did not exist at first as there are no other files in it, so this command is modified to create it if it's not there already.
Run those 3 commands after running su if you do this from adb or a term emulator while booted, or as I said you can do it from TWRP just be sure /efs is mounted first as it's not by default. Then reboot and you should be able to either use shortcut master to get to RIL servicemode (and a few more other goodies too), or you can always just open up either DRParser app or stock Samsung phone and enter *#27663368378# and it should pop right up.
If for some reason it doesn't let me know, there are more things to try including changing CSC, and there is a global hidden menu prop that wasn't necessary for me as the 9650s don't have the actual HiddenMenu app installed at all, but the above was all I had to do to get things working
As for the CSC thing idk if any of the cscs in whatever region you were running do this, or if even any cscs in the 9650 do it at all even but on Samsung "XXXXU" devices sold in the USA certain carriers block all hidden menu type access no matter what, so if this doesn't work take a backup and change your CSC and see if that fixes it.
I'm not sure what you mean by "doesn't relock bootloader anymore", but if you reflash stock vendor without flashing the RMM bypass your bootloader will be relocked and you will be unable to unlock it again for 7 days. This is precisely what I was talking about
Click to expand...
Click to collapse
Sorry for spam lol but I was wondering if you had any knowledge on how I can enable more carrier aggregation combos.
Currently my phone is not listing 4+12 as a supported combo even though I know 100% the modem supports that. My Exynos S7 and S8 had that combo out of the box.
I've got service menu but I just need to enable that combo to fix my ****ty LTE.
Thanks for a your help.
Interceptor777 said:
Sorry for spam lol but I was wondering if you had any knowledge on how I can enable more carrier aggregation combos.
Currently my phone is not listing 4+12 as a supported combo even though I know 100% the modem supports that. My Exynos S7 and S8 had that combo out of the box.
I've got service menu but I just need to enable that combo to fix my ****ty LTE.
Thanks for a your help.
Click to expand...
Click to collapse
Sorry, unfortunately this isn't an area I've had much experience with in terms of how it works and stuff. I can get to the service mode menu and everything I can find in there that I am at least aware of being related to CA (having "CA" in the menu items) looks to be enabled. It's possible this setting could be in the CSC data which is frustratingly encrypted on s9/+ firmwares, although there is a way to decrypt/reencrypt them but I haven't actually tried it and looked for myself
partcyborg said:
Sorry, unfortunately this isn't an area I've had much experience with in terms of how it works and stuff. I can get to the service mode menu and everything I can find in there that I am at least aware of being related to CA (having "CA" in the menu items) looks to be enabled. It's possible this setting could be in the CSC data which is frustratingly encrypted on s9/+ firmwares, although there is a way to decrypt/reencrypt them but I haven't actually tried it and looked for myself
Click to expand...
Click to collapse
Hey, so I found out how the CSC blocks the service menu, it uses the file in /system/omc/XXX/etc/XXX_keystrings.dat and in /system/etc/XXX_keystrings.dat.
Someone made a script to decrypt this file and edit it: https://github.com/chenxiaolong/keystrings-decrypter
However, my phone does not accept the decrypted file. It will only read the encrypted file.
I have no useful knowledge regarding scripts, would you have any idea how to encrypt the file again using a script similar to that one? Thank you.
partcyborg said:
Wiping efs will not erase the RMM lock. The only thing it fixed was the very specific issue where your bootloader is relocked by non-samsung rom which doesn't look at the frp partition and when you try to unlock again from a Samsung rom, it does try to look at the frp partition which it can't find because the RMM bypass zip sets ro.frp.pst to /dev/block/dummy in /efs/factory.prop. when this happens you're basically screwed because you can't unlock without that prop being set right, and nothing erases that prop file and without root your can't even see it much less change it.
Luckily I found a nice loophole that let me overwrite the entire efs filesystem thus erasing the prop (but not the special data at the end fortunately) and allowing me to unlock again, but the act of doing this resulted in another 7d RMM jail which was annoying but given I was perm locked before it seemed like an ok trade .
What settings are you trying to adjust? I'm not aware of anything that combo has open that you can't get to with rooted stock provided you twiddle all the knobs in efs correctly. Did you set factory ON & keystr OFF an HiddenMenu ON?
Click to expand...
Click to collapse
Hello, I was having the same issue that ro.frp.pst was set to /dev/block/dummy and my phone was permanently locked.
It just said "PersistentDataBlockService: java.io.FileNotFoundException: /dev/block/dummy (Permission denied)" -- I flashed 3rd party files and went back to stock and this happened.
Could you elaborate about the nice loophole that could let me overwrite the efs filesystem and erase the prop?
Thank you!
haojixu said:
Hello, I was having the same issue that ro.frp.pst was set to /dev/block/dummy and my phone was permanently locked.
It just said "PersistentDataBlockService: java.io.FileNotFoundException: /dev/block/dummy (Permission denied)" -- I flashed 3rd party files and went back to stock and this happened.
Could you elaborate about the nice loophole that could let me overwrite the efs filesystem and erase the prop?
Thank you!
Click to expand...
Click to collapse
What device? Is it a g9650?
phhusson said:
Hi all,
I had my S9+ unlocked, but then I flashed stock back (just boot/system/vendor, probably not the same version as the rest), and since then, I can no longer OEM unlock.
I can select the option, and initiate the unlock, this will even actually factory reset the device.
But then, if I go to bootloader, it says FRP unlocked, OEM locked.
I've tried flashing a full firmware, but the result remains the system.
FWIW, I flash usng heimdall not Odin. I'll probably try with Odin, but I expect to get the same result.
I think I've found in the logs the reason for that behaviour:
I have ro.frp.pst = /dev/block/dummy
While it should be /dev/block/persist
I've checked in all partition in the firmware I've flashed if there was any reason some part of the firmware set this to dummy, and I didn't find anything.
I couldn't even find any reference to /dev/block/dummy at all!
So, does someone have some clue about my issue?
Thanks!
Click to expand...
Click to collapse
Look at his post https://forum.xda-developers.com/showthread.php?p=78208022
Sent from my [device_name] using XDA-Developers Legacy app
Johnny camaro said:
Look at his post https://forum.xda-developers.com/showthread.php?p=78208022
Click to expand...
Click to collapse
2 minor things:
1) phutton already said way back this isn't an issue for him anymore
2) even if he was, the link you posted literally has nothing to do with the issue at hand, nor does it contain even links to anything that could even be used in the process of fixing it.
...
I guess by "minor" I meant "can not be distinguished from entering a few random words from this thread into ask jeves and selecting a website at random" ?
partcyborg said:
What device? Is it a g9650?
Click to expand...
Click to collapse
It was a N960N. I solved the issue, but thank you anyway. I just flashed the efs file as a tar zip from the stock image. The IMEI was reset but everything went back to normal.
Related
Under status, Network shows as 'Unknown', Mobile network type shows as 'Unknown', Service state is 'Out of service', and Mobile network state is 'Disconnected'.
IMEI shows as nonnull (valid), and IMEISV shows as nonnull (valid). I'm not sure where the issue is, i'm assuming it is somewhere in the modem, but I flashed the NG3 Modem multiple times.
Not really sure what is wrong, can anyone suggest anything to restore my phone before I try something else again?
..
fffft said:
You didn't give us very much detail about anything from what firmware build you tried to flash to what model of S5 you have, screen shots of your phone information in the settings menu or anything else. Which makes it impossible to delineate what happened.
At a guess and that is all that is possible without a detailed description of your configuration.. it sounds like you may have flashed the wrong firmware - intended for another carrier or S5 variant. Which sometimes screws up wifi /bluetooth or occasionally bricks a phone. Check that your firmware build md5 checksum is valid, that the firmware is intended for your native carrier and variant. And if you were flashing a modem separately, confirm that it is for your carrier and matches your baseband (bootloader). Failing that, restore your backup to recover.
If you don't have a backup for some reason, that should be very high on your list of things to start doing. In that situation, download a full stock firmware that is for your specific phone model and carrier, wipe the cache partition and you should be good. In some cases you may also need to do a factory data reset (do that as a last resort, since it will delete your photos, user files, etc).
.
Click to expand...
Click to collapse
I downloaded the stock tar (the full one) here, and selected AP with it. To be sure that my bootloader is updated, I later used the modem/booloader here and I used the right one (900T) and followed the guide at the top of that page for setting "BP" for bootloader and "CP" for modem. When I run the bootloader check command (getprop ro.boot.bootloader), it returns NG3, so I think that's fine too.
I have the 900T (well, this IS the t-mobile galaxy s5 thread).
I probably should have backed up, but I tend not to because I have rarely ran into issues on my previous Note 2 and the times I did, the backup wouldn't have fixed it (usually because the recovery was too big or the modem got corrupted).
And I did use factory reset multiple times, I don't have much on the phone right now and also have an external sd card where I store most of my things anyways.
Specifically, what part of the settings would you want to see?
..
NG3 Full Stock Tar: http://www.androidfilehost.com/?fid=23578570567722728
^ That was what I used under AP.
When I try to repartition, is says "Erasing USERDATA Partition...\nSECURE CHECK FAIL : PIT".
..
fffft said:
Suggesting that you have partition corruption. The purpose of my earlier suggestion to flash the PIT file was to resolve potential partition corruption. So you could do far worse than follow the suggestions in my last post.
.
Click to expand...
Click to collapse
No longer boots after nand erase all. Since the partition failed, I unchecked it and just left NAND erase checked.
Any other suggestions?
rmanne said:
No longer boots after nand erase all. Since the partition failed, I unchecked it and just left NAND erase checked.
Any other suggestions?
Click to expand...
Click to collapse
I don't know why or what @fffft is trying to get you to do but touching the things you are could end up bricking your device if not too careful.
All you need to do is select the full tar file under "AP" and uncheck the reboot and F reset time options.
EDIT: You need to extract the tar file to get the MD5 file that is what you flash in Odin.
If you have no data, just check that the APN settings are properly configured.
I had to flash the tar file a couple times before the modem upgraded. But don't touch PIT or NAND erase.
..
fffft said:
You can't do a normal boot after erasing the NAND, since that has wiped our your system files. That isn't unexpected. But your phone will still boot to download mode, sometimes called "Odin" mode. Volume down + home + power.
Once your write a replacement firmware image it will boot normally again. Writing a full image is recommended. Odin can be fussy and seemingly a bit more so with larger writes than when flashing smaller writes. And possibly easier with earlier S5 firmware builds (not proven, just an impression).
If you persist Odin will write the image, it just takes several attempts sometimes. If a given write fails, do not reset Odin on your PC, just pull the phone battery, replace it.. boot to download mode again and flash again from the open Odin window. Inevitably the flash will succeed the second time even though Odin balked the first time. If you have persistent problems, try a different USB cable and USB port.
The poster above doesn't understand what the NAND or partition features accomplish, but anyone doing their due diligence would find informed threads supporting my recommendations when partition corruption is suspected or needs to be repaired.
..
Click to expand...
Click to collapse
I didn't just erase the NAND though, I also added the .tar.md5 file that I pointed to earlier, which should have added back the system files. Well in any case, I flashed TWRP, and according to it, the Data partition was not properly partitioned (and thus not mounted) and I wiped that with TWRP, and installed another custom ROM (ViSiX), and it has the same issue right now ("Searching").
I did try the earlier S5 images (NF6, which is what the phone initially came with), and I flashed the proper modem/bootloader there also, but it still has no service.
I know that the sim card is working because I still have my other phone (note 2), and it works fine in that. I still don't understand what about the S5 that is not working. It doesn't even say no service anymore. It's just searching...
by replacement firmware image, do you mean the whole stock rom image? Or do you mean just the firmware, as is given in that stock collection thread.
elesbb said:
I don't know why or what @fffft is trying to get you to do but touching the things you are could end up bricking your device if not too careful.
All you need to do is select the full tar file under "AP" and uncheck the reboot and F reset time options.
EDIT: You need to extract the tar file to get the MD5 file that is what you flash in Odin.
If you have no data, just check that the APN settings are properly configured.
I had to flash the tar file a couple times before the modem upgraded. But don't touch PIT or NAND erase.
Click to expand...
Click to collapse
Also, 'had to flash a couple times'? Why on earth would there be non-determinism involved in a phone? I'm genuinely confused.
APN settings appear to be the exact same as my previous phone, and it shouldn't be the issue anyways because the APN is only useful to look at for network use right? I can't even call/text, since it says that I'm not registered on the network.
rmanne said:
Also, 'had to flash a couple times'? Why on earth would there be non-determinism involved in a phone? I'm genuinely confused.
APN settings appear to be the exact same as my previous phone, and it shouldn't be the issue anyways because the APN is only useful to look at for network use right? I can't even call/text, since it says that I'm not registered on the network.
Click to expand...
Click to collapse
I don't know why but the baseband doesn't always flash. So flashing it twice in a row usually does the trick,
Sent from my SM-G900T using Tapatalk
I did just try the install modem twice in a row with no luck.
What's the best recovery to use with this phone? I'm using the twrp that you can download on their official website right now, but from what I remember, on the Note 2, if you install using the 'wrong' version of TWRP, your service won't work.
Also, another thing that I've noticed is that during the initial one time initialization, instead of saying "Samsung Galaxy S5 (T-Mobile)" (or something like that), it is now saying "Samsung galaxy S5" without the T-Mobile addition to it. I think that it has to do with the recovery that I flashed, since it's what determines the phone model more than anything.
EDIT: used to say "Galaxy S5 ..." and now says "Galaxy S5"
rmanne said:
I did just try the install modem twice in a row with no luck.
Click to expand...
Click to collapse
I'm talking about the entire md5 file.
I use twrp.
Sent from my SM-G900T using Tapatalk
elesbb said:
I don't know why but the baseband doesn't always flash. So flashing it twice in a row usually does the trick,
Sent from my SM-G900T using Tapatalk
Click to expand...
Click to collapse
Does the download mode have something to do with it?
On mine, it says:
ODIN MODE
PRODUCT NAME: SM-G900T
CURRENT BINARY: Custom
SYSTEM STATUS: Custom
KNOX WARRANTY VOID: 0x1 (2)
QUALCOMM SECUREBOOT: ENABLE (CSB)
RP SWREV: S1, T1, R1, A1, P1
UDC START
elesbb said:
I'm talking about the entire md5 file.
I use twrp.
Sent from my SM-G900T using Tapatalk
Click to expand...
Click to collapse
Yep, I was trying to install the entire md5 ("G900T-UVU1BNG3-MODEM.tar.md5"), unless you meant the full stock rom.
..
fffft said:
We're assuming that your stipulation that the IMEI is valid is correct. I'd look at the service mode menu and check the certificate status to confirm that if you haven't already.
You could also do a search to see if anyone is having problems with the most recent G900TUVU1BNG3 firmware. Or even better temporarily revert to the a known stable, earlier firmware version. If you flash a full firmware image from May, your certificate status is valid and your APN info is correct then you'd have a reasonable basis for suspecting a hardware failure.
Hardware is unlikely though unless you can associate it with trauma or pre-existing symptoms, none of which you mentioned. Network connectivity issues inevitably arise from flashing a modem or firmware image intended for a different platform, a corrupt cache or corrupt system files.
.
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=2754957
^ I ran through that first post, and did as it said without any improvement.
How do I check the certificate status?
From what I can tell, no one else is having the issue (or at least no one has yet posted about it). And as I've already said, NF6 didn't work either (it was working when I got my phone, but now doesn't work after trying to revert everything to stock).
APN info is certainly correct.
I didn't unbox this phone, so I'm not actually sure that it's the right model, but its first boot showed the 'T-Mobile' display screen, so I see no reason to doubt that it's a 900T. I will recheck this just in case.
EDIT: I found the certificate status i think
The page says "IMEI Certi: PASS, 1\nUnknown"
also includes "REJECT:6, LU_ATT#: 0", "SERVICE : LIMITED", "STATE: DEREGISTR SUB:1", "PA STATE:0(ET),HDET:0", "and a bunch of numeric values above it. Band 4, BW 10MHz, MCC-MNC, TAC, Earfcn_dl, PCI: 0, RSRP -94, RSRQ -10, SNR 17.4-22.1
What does it mean? What is "LU_ATT"?
Solved!
For whatever reason, it seems that the person who sold the phone reported it as stolen (according to T-Mobile customer service, a phone marked as lost will not be able to access network services) at around the same time that I flashed the update. I did think something was fishy since I didn't immediately lose network. I feel like I was on NG3 for at least a few hours before it stopped working, but I thought I might have just been imagining things, since the timing was just too close to properly make a note of.
Well, thanks anyways, I appreciate the time you two took to attempt to help.
OFFICIAL ONEPLUS 2 STOCK RESET
SOURCE : OnePlus L2 Support Team
VERSION : OxygenOS 2.2.0
DOWNLOADS
1. OnePlus2 Stock Reset Oxygen OS 2.2.0 Google Drive | Mediafire
2. Qualcomm Drivers Version 1.00.11 Google Drive | Mediafire
INSTRUCTIONS
You are doing this on your own responsibility. I take no responsibility whatsoever.
(THIS WILL WIPE YOUR ONEPLUS INCLUDING INTERNAL SD)
Download both the files from above and extract them (WinRAR, WinZIP, 7ZIP etc). You should have 2 folders: "OnePlus2_14_A.11_151211" and "qc"
A. Install the Certificates followed by the Qualcomm drivers.
1. Restart your computer with Driver Signature Enforcement Disabled (Advanced Startup) Let me Google it For You
2. Open the folder "qc" and install the Test Certificate in the following Stores: Trusted Root, Trusted Publisher, Third-Party Root and Personal
3. Run the Qualcomm setup wizard (also located in the qc folder)
4. When completed, restart your PC again with Driver Signature Enforcement Disabled (Advanced Startup)
5. Turn off your phone and disconnect the USB cable from the phone.
6. Hold vol-up and plug in the USB(Do not press Power button). The screen will stay black but you will hear a sound from windows that a device is attached.
7. The driver should now automatically install. If not, go to device manager and right click "Unknown Device" and click "Update Driver" Search up the QC folder and press ok. The driver should now install. (Got the RELINK issue? Take a look here: http://forum.xda-developers.com/show...1&postcount=46)
B. Flashing Process
1. Open the OnePlus2_14_A.11_151211 folder and open "MSM8994DownloadTool.exe"
2. Look if your phone is detected in the list. everything is Chinese but you will see one row with different chinese text from the rest within the list. If not, recheck if driver is detected in Device Manager (If not, go back to Step A - Line 4).
3. First click the right square Chinese button. This will perform an integrity check on the downloaded files by verifying the MD5 hash values.
4. The system will seem to hang for a bit but should give you a pop up with the results of the above verification. When everything is ok. Press the start button. and let the progress finish. (If something is not ok, you will have to re-download the images. Google Drive can help extract only the necessary files.)
5. When it's done. Disconnect the USB cable and turn on the device.
C. Reset TAMPER Flag (Optional)
(This may potentially change your SmartPhone to a rather large paperweight and I will just laugh at you bearing no responsibility)
+ This part of the guide is not an Official Procedure and is in no way affiliated to OnePlus
+ It is advisable to do this before any of the above mentioned operations.
+ Prerequisites:
Root
HEX Editor with root features
Root File Manager
+ BEWARE: You are modifying partitions which cannot be restored regardless of what you flash. You have been warned AGAIN
1. In File Manager browse to the devinfo partition (dev/block/bootdevice/by-name/)
2. Open devinfo using the HEX Editor.
3. Modify the TamperBit (attached screenshot) from 01 to 00.
4. Save and reboot to fastboot.
5. Type fastboot oem device-info to confirm.
CREDITS
OnePlus Team for the Files.
@paultje162 for adaptation of Instructions. Refer his thread here if you are looking for an older version of stock reset (2.1.1).
@thedropdead for his work on Tamper Reset
If this thread has helped you, do press the THANKS button. Should you have issues, questions or doubts, write in this thread.
Just need to confirm that these files are actually official
Pm me the s3 support link
---------- Post added at 13:14 ---------- Previous post was at 13:10 ----------
And my friend
You need to install the test certificate first !
Edit:- file confirmed legit ! Totally official, way to go, @fareed_xtreme !
[email protected] said:
Just need to confirm that these files are actually official
Pm me the s3 support link
---------- Post added at 13:14 ---------- Previous post was at 13:10 ----------
And my friend
You need to install the test certificate first !
Click to expand...
Click to collapse
Thanks for spotting the error. I have fixed the heading. S3 Link PMed.
fareed_xtreme said:
Thanks for spotting the error. I have fixed the heading. S3 Link PMed.
Click to expand...
Click to collapse
Whenever you get drivers like this, dig into their folders and you'll find important documents and instructions to use
That is how I found out about this certificate
Is there any similar process por ONEPLUS ONE?
I only have fastboot mode, without recovery and bootloader locked (fastboot oem unlock doesn't work)
http://forum.xda-developers.com/showthread.php?t=2970390
@xbit
xbit said:
Is there any similar process por ONEPLUS ONE?
I only have fastboot mode, without recovery and bootloader locked (fastboot oem unlock doesn't work)
Click to expand...
Click to collapse
Quick search and: http://forum.xda-developers.com/oneplus-one/general/guide-unbrick-oneplus-one-t3013732
beaverhead said:
http://forum.xda-developers.com/showthread.php?t=2970390
@xbit
Click to expand...
Click to collapse
This didn't work for me:
fastboot oem unlock didn't work because I had a corrupt bootloader.
Spannaa said:
Quick search and: http://forum.xda-developers.com/oneplus-one/general/guide-unbrick-oneplus-one-t3013732
Click to expand...
Click to collapse
But this was great! My OPO is alive now. Thanks
Thank you!!!! this worked.
I was eventually able to get the restore program to recognize it and restore it so it could boot normally. Thank you!
Download from your Link
https://drive.google.com/folderview?id=0BxFd4Zc3_d1CWDdOSFFIVG42VTg&usp=sharing
the File:
OnePlus2_14_A.11_151211.rar
Extract it.
But where is the "QC Folder"
found only "OnePlus2_14_A.11_151211"
Your Link to:
http://forum.xda-developers.com/show...1&postcount=46
is wrong. (Not complete) Error 404
Wagi99 said:
Download from your Link
https://drive.google.com/folderview?id=0BxFd4Zc3_d1CWDdOSFFIVG42VTg&usp=sharing
the File:
OnePlus2_14_A.11_151211.rar
Extract it.
But where is the "QC Folder"
found only "OnePlus2_14_A.11_151211"
Your Link to:
http://forum.xda-developers.com/show...1&postcount=46
is wrong. (Not complete) Error 404
Click to expand...
Click to collapse
Yep, the qc folder is missing from the zip.
The link should be: http://forum.xda-developers.com/showpost.php?p=64674951&postcount=46
I suspect these are both down to copying & pasting the instructions from @paultje162's thread and I'm sure @fareed_xtreme will sort it out when he gets the chance.
Wagi99 said:
Download from your Link
https://drive.google.com/folderview?id=0BxFd4Zc3_d1CWDdOSFFIVG42VTg&usp=sharing
the File:
OnePlus2_14_A.11_151211.rar
Extract it.
But where is the "QC Folder"
found only "OnePlus2_14_A.11_151211"
Your Link to:
http://forum.xda-developers.com/show...1&postcount=46
is wrong. (Not complete) Error 404
Click to expand...
Click to collapse
Thanks for spotting the errors. I have updated them. It is indeed a miss on my part in regards to the QC. Hence I have uploaded it separately and updated the instructions.
Spannaa said:
Yep, the qc folder is missing from the zip.
The link should be: http://forum.xda-developers.com/showpost.php?p=64674951&postcount=46
I suspect these are both down to copying & pasting the instructions from @paultje162's thread and I'm sure @fareed_xtreme will sort it out when he gets the chance.
Click to expand...
Click to collapse
Yup, A copy paste is not the right way to copy a link. Haven't been around these threads for quite some time and guess i did not remember that the links are trimmed down. Thanks for the correct link.
Updated Information with UnTamper Guide
Hello
Doing the anti tamper method you did. Shouldn't this be easier by doing "fastboot oem lock" ?
I think it should have the same effects. Of course, this command must be done when an official ROM is on the phone, doing this in a custom ROM can cause unexpected behaviour, including bricking.
albertocastillo2001 said:
Hello
Doing the anti tamper method you did. Shouldn't this be easier by doing "fastboot oem lock" ?
I think it should have the same effects. Of course, this command must be done when an official ROM is on the phone, doing this in a custom ROM can cause unexpected behaviour, including bricking.
Click to expand...
Click to collapse
From my personal experience, if the Tamper Flag trips, then no matter how official you go it will not go back to Device Tamper= False.
The files in my First Post restores your phone back to an out of box phone state even locking the bootloader but it will not change the tamper flag. Those files are used by OnePlus Support to fix OS issues. Also the fastboot oem lock has not managed for me personally to get the tamper flag back to default (Same as in OPO once down, its down). So the only way for now for the OPT is by modifying the bit that handles the tamper flag.
You are right. Tamper Flag usually trips when you try to relock the bootloader when having root and other non-stock partitions (custom kernel, recovery etc). (Learned the hard way with my old OnePlus 2. Got it swapped for a new one though as the old one was faulty )
Hope this helps.
fareed_xtreme said:
From my personal experience, if the Tamper Flag trips, then no matter how official you go it will not go back to Device Tamper= False.
The files in my First Post restores your phone back to an out of box phone state even locking the bootloader but it will not change the tamper flag. Those files are used by OnePlus Support to fix OS issues. Also the fastboot oem lock has not managed for me personally to get the tamper flag back to default (Same as in OPO once down, its down). So the only way for now for the OPT is by modifying the bit that handles the tamper flag.
You are right. Tamper Flag usually trips when you try to relock the bootloader when having root and other non-stock partitions (custom kernel, recovery etc). (Learned the hard way with my old OnePlus 2. Got it swapped for a new one though as the old one was faulty )
Hope this helps.
Click to expand...
Click to collapse
Thanks for your reply. I noticed that these are the files that OnePlus team sends you when they want to remote into your device to flash the system. I noticed these are password encrypted. I have a session with them on Monday 6th.
I sent the files they sent me to decryption to get the password to a website that does this. However, they couldn't. My other plan was just to catch the password when having the remote session with them.
Since you already posted the files here, this is no longer needed. Seems you did this earlier than me.
The reason they want to do a full flash on my phone is due to the fact that I have a dual SIM issue. At the beginning both SIMs worked until I had to do a change on the second SIM network (it's an international SIM card that works in every country so you must set up the network manually). Since I tried to change the network. Something got messed up and now only one SIM works at a time. I tried restoring the network settings to automatic with no go. And I also tried to do hard restore on the phone to start over to ensure this would solve the issue.
This didn't solve the issue. So it probably means the settings were done in a partition which is not "/data". So a hard reset obviously wouldn't work. But a full flash surely will.
I asked them if I could do this myself by just sending me the files. I have a good expertise on fastboot, ADB and Linux, and I also understand the partition list and partition images. However, since the phone is not rooted or modified in anyway. I decided I will let them do it for me.
I do have a question thought. How did you find about the anti tamper thing? I assume you had remote session with them, and this is why you have those files. Did they "relock" this for you?
I assume they look at this when they get defective devices returned.
Thanks
albertocastillo2001 said:
Thanks for your reply. I noticed that these are the files that OnePlus team sends you when they want to remote into your device to flash the system. I noticed these are password encrypted. I have a session with them on Monday 6th.
I sent the files they sent me to decryption to get the password to a website that does this. However, they couldn't. My other plan was just to catch the password when having the remote session with them.
Since you already posted the files here, this is no longer needed. Seems you did this earlier than me.
The reason they want to do a full flash on my phone is due to the fact that I have a dual SIM issue. At the beginning both SIMs worked until I had to do a change on the second SIM network (it's an international SIM card that works in every country so you must set up the network manually). Since I tried to change the network. Something got messed up and now only one SIM works at a time. I tried restoring the network settings to automatic with no go. And I also tried to do hard restore on the phone to start over to ensure this would solve the issue.
This didn't solve the issue. So it probably means the settings were done in a partition which is not "/data". So a hard reset obviously wouldn't work. But a full flash surely will.
I asked them if I could do this myself by just sending me the files. I have a good expertise on fastboot, ADB and Linux, and I also understand the partition list and partition images. However, since the phone is not rooted or modified in anyway. I decided I will let them do it for me.
I do have a question thought. How did you find about the anti tamper thing? I assume you had remote session with them, and this is why you have those files. Did they "relock" this for you?
I assume they look at this when they get defective devices returned.
Thanks
Click to expand...
Click to collapse
Please note that the Tamper part of the guide is NOT done by OnePlus. Please note that OnePlus is in no way affiliated to the Tamper part of the guide. The Tamper guide is a result of comprehensive research conducted by thedropdead (information provided in the First Post). The guide is an easier interpretation of all the research that went in there.
OnePlus will only reflash this package which will re-lock the Bootloader only. Tamper Flag is not modified. So sit tight and let them reflash it for you.
You are right to assume I had a session with them earlier and that's how i have the files.
Thanks for your reply.
I would say that if the remote support doesn't untamper the device then it might mean they don't even look at it if the device is returned.
Thanks!
albertocastillo2001 said:
Thanks for your reply.
I would say that if the remote support doesn't untamper the device then it might mean they don't even look at it if the device is returned.
Thanks!
Click to expand...
Click to collapse
Remote Support didn't look into mine. However, not very sure about whether it is checked on returning it. Mine went untampered.
fareed_xtreme said:
Remote Support didn't look into mine. However, not very sure about whether it is checked on returning it. Mine went untampered.
Click to expand...
Click to collapse
Oh, then what happened? I thought the remote support tried to fix your phone. Since you said they didn't untamper the device after I expected they remoted to your phone. What happened then?
Thanks
Ok so I acciedently deleted my efs file and can't get any connection or make any calls. I deleted it while in factory binary mode. My Imei says 00000000024 now. Please please help this is my daily phone. Spent hours doing research can't find a way. I have a g965u model att
You shouldnt make a new thread to ask the same thing you asked in a different thread.
Also someone already answered that question. In the other thread you made you mentioned that a repair shop can do it for you. I would suggest going that route to avoid any further issues.
Link to a reply on the same question below:
https://forum.xda-developers.com/showpost.php?p=77779892&postcount=5
scottusa2008 said:
You shouldnt make a new thread to ask the same thing you asked in a different thread.
Also someone already answered that question. In the other thread you made you mentioned that a repair shop can do it for you. I would suggest going that route to avoid any further issues.
Link to a reply on the same question below:
https://forum.xda-developers.com/showpost.php?p=77779892&postcount=5
Click to expand...
Click to collapse
While I figured since it's a different question than the original thread it would be OK but I guess I could have just changed the title And I know I can go do it in a shop but I'd rather learn how to do it myself and save money and learn some more at the same.
It's so frustrating because I see all these people on craigslist YouTube and all over the internet that restore imei so I knows it's possible but I can not find one tutorial I think because my firmware is so dang new
[email protected] said:
While I figured since it's a different question than the original thread it would be OK but I guess I could have just changed the title And I know I can go do it in a shop but I'd rather learn how to do it myself and save money and learn some more at the same.
It's so frustrating because I see all these people on craigslist YouTube and all over the internet that restore imei so I knows it's possible but I can not find one tutorial I think because my firmware is so dang new
Click to expand...
Click to collapse
Well it's not really a different question as much as it is a natural progression over the issue you posted on originally. Thread title is ok, unless the issue you were having was the missing efs and not where you couldn't find the arg8 firmware
For example if a person who had no idea what too do made a thread asking "my phone is acting up" and it was suggested to do a complete backup of the phone (and factory reset) the original poster would ask "how do I factory reset and backup my phone" in that thread rather then in a new one.
This way all information on the issue is kept in the same place, as opposed to several different places.
Now you keep reading those things and it may be possible because they have experience, tools or resources you don't. Places said they could unlock my phone and they did, but this is not something i could have done myself. I highly doubt having new firmware is the case here.. If there are special steps because of this being a Galaxy S9+ maybe another thing.
If it was that simple where a tutorial was all it took someone would have put it on the internet. If you cant find one then it just may mean this isn't something a tutorial can solve.
Personally I would suggest taking/sending your phone into a repair place and having them fix it. You may be at a point where this is beyond what your capable (whether by knowledge, tools, resources, skill, etc) of doing
Well I'm broke right now I will keep digging reaserching and trial and error until I find a way or get the money.
Try running these commands on adb make sure you got USB debugging enabled
adb shell 'dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst1
adb shell 'dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst2'adb reboot
Good Luck
JacobTB said:
Try running these commands on adb make sure you got USB debugging enabled
adb shell 'dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst1
adb shell 'dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst2'adb reboot
Good Luck
Click to expand...
Click to collapse
Will that work with locked boot loader? But I'll give it a try anyway when I get home I hope it works but I doubt its gonna be that easy on this phone because they haven't even got root yet
[email protected] said:
Will that work with locked boot loader? But I'll give it a try anyway when I get home I hope it works but I doubt its gonna be that easy on this phone because they haven't even got root yet
Click to expand...
Click to collapse
It should work on locked bootloader without route because it's through adb
JacobTB said:
It should work on locked bootloader without route because it's through adb
Click to expand...
Click to collapse
I pray this works im gonna try it now. Thank you
It says not found for either modem. Damn it ughhhh fml
Okay the last thing I recommend you do is go to https://updato.com/firmware-archive-select-model and download the firmware for your device then Odin flash with the phone efs clear option selected and flash the firmware. remember to backup your stuff as it will perform factory reset.
This will not trip Knox as it's official firmware and can be done without the need for root or unlocking the bootloader
JacobTB said:
Okay the last thing I recommend you do is go to https://updato.com/firmware-archive-select-model and download the firmware for your device then Odin flash with the phone efs clear option selected and flash the firmware. remember to backup your stuff as it will perform factory reset.
This will not trip Knox as it's official firmware and can be done without the need for root or unlocking the bootloader
Click to expand...
Click to collapse
Unfortunately I already did this actually how i lost the efs, i hit back up and i guess it never did. Then when i flashed the stock firmware it ware gone.
Anybody else? I wish i could figure this out I wana use my phone so bad.
I know I could do it with xposed framework but I need root and this phone is unrootable
[email protected] said:
Unfortunately I already did this actually how i lost the efs, i hit back up and i guess it never did. Then when i flashed the stock firmware it ware gone.
Anybody else? I wish i could figure this out I wana use my phone so bad.
I know I could do it with xposed framework but I need root and this phone is unrootable
Click to expand...
Click to collapse
What region are you in? And what model number is your phone?
JacobTB said:
What region are you in? And what model number is your phone?
Click to expand...
Click to collapse
G965USQU3ARG8 s9+
And I am in the United States.
Oh god I'm am a United Kingdom user and everything here exynos is easy to replace I would recommend a repair or replacement from Samsung themselves as long as you say you device broke during upgrade and your Knox isn't tripped you should be fine
Thats out of the question for me because i got it from a private seller and insurance is up. Hey btw when i typed in the code you gave me in adb it said unathorized. I think if i can get it to authorize adb can fix it. Any idea about that error. And i cant believe flashing back into factory and back into stock wont bring it back.
Perhaps it might work if you use adb. Make sure you go into the developer options on your phone you can do this by going to the build number in about phone in the settings and tapping it 5 times developer options will be a new menu on the settings page then go in and enable usb debugging. From there plug your phone into the computer open adb and type adb devices and grant permission on your phone when the prompt pops up then try and run the commands again
JacobTB said:
Perhaps it might work if you use adb. Make sure you go into the developer options on your phone you can do this by going to the build number in about phone in the settings and tapping it 5 times developer options will be a new menu on the settings page then go in and enable usb debugging. From there plug your phone into the computer open adb and type adb devices and grant permission on your phone when the prompt pops up then try and run the commands again
Click to expand...
Click to collapse
This never worked for me. Fml 2 weeks now with my s9 out of the picture. I know somebody knows a way help a man use his 900+ phone lmao I'm to broke right now to take it to a shop.
I don't know any other methods to fix this ?
[email protected] said:
Ok so I acciedently deleted my efs file and can't get any connection or make any calls. I deleted it while in factory binary mode. My Imei says 00000000024 now. Please please help this is my daily phone. Spent hours doing research can't find a way. I have a g965u model att
Click to expand...
Click to collapse
You deleted efs while in factory binary?
You typed in a dialer code to delete efs?
So now only samsung or a special repair shop can rewrite your imei.
It is gone and also other data which all has to be rewritten.
Hello,
I was installing different custom ROMS for this phone, then reverted back to Stock ROM. It updated itself, and IMEI got erased somehow.
Is there any way possible to flash a custom ROM, or even custom recovery using MSMDownloadTool? I had a global version N10, so it was sim unlocked and bootloader unlockable, and I do actually have my IMEI on the back of my box, but can't put it into my phone as I have to root it. But I can't root it because the bootloader is now locked, and the bootloader is now locked because there is no IMEI......
This leaves me locked out of fastboot, so the only option is edl, which works just fine. However, only MSMDownloadTool is compatible with this mode, and it only installs Stock ROMs.
I tried extracting the .OPS files, replacing the stock recovery with twrp (and then renaming it to recovery.img), repacking the .ops then installing it. It installs, but then never boots and is just stuck in edl mode until I reflash the normal stock rom with the stock recovery.
What Do I do?
Thanks
CrustyBurger33 said:
Hello,
I was installing different custom ROMS for this phone, then reverted back to Stock ROM. It updated itself, and IMEI got erased somehow.
Is there any way possible to flash a custom ROM, or even custom recovery using MSMDownloadTool? I had a global version N10, so it was sim unlocked and bootloader unlockable, and I do actually have my IMEI on the back of my box, but can't put it into my phone as I have to root it. But I can't root it because the bootloader is now locked, and the bootloader is now locked because there is no IMEI......
This leaves me locked out of fastboot, so the only option is edl, which works just fine. However, only MSMDownloadTool is compatible with this mode, and it only installs Stock ROMs.
I tried extracting the .OPS files, replacing the stock recovery with twrp (and then renaming it to recovery.img), repacking the .ops then installing it. It installs, but then never boots and is just stuck in edl mode until I reflash the normal stock rom with the stock recovery.
What Do I do?
Thanks
Click to expand...
Click to collapse
If your bootloader was relocked, encryption and partition checking were enabled again.
TWRP would only cause your phone to register as modified and lock itself...and due to streamlining of a lot of functions, you can't even use the dialer to enter the menu needed.
Best you can do is totally wipe everything on your phone and generate a new android ID. (You have to do this from the actual OS instead of recovery though. Recovery format uses predetermined instructions. The format option from the android settings panel has a different set of instructions and one of them is to generate a new android ID, which includes IMEI)
Thanks for the reply, although im kinda confused by your answer. How do I generate a new android ID? (what does that even mean lol). I checked in my settings and I can't find any "format option"
CrustyBurger33 said:
Thanks for the reply, although im kinda confused by your answer. How do I generate a new android ID? (what does that even mean lol). I checked in my settings and I can't find any "format option"
Click to expand...
Click to collapse
Android ID is what determines your phone is the phone it claims to be when pinging google services.
Move any files you want to keep to somewhere safe. Format your phone, android will push you a new id number. It won't fix your IMEI, but it'll keep your phone from being absolutely useless in the process.
After your phone is formated and has booted back into the OS, you can enable adb. Adb into fastboot, use fastboot to determine if your device is still bootloader unlocked using the fastboot oem device-info command
ninjasinabag said:
After your phone is formated and has booted back into the OS, you can enable adb. Adb into fastboot, use fastboot to determine if your device is still bootloader unlocked using the fastboot oem device-info command
Click to expand...
Click to collapse
I tried everything you said, reset everything, still no IMEI, and even if the Android ID is different it hasn't really changed anything. Just to be clear, when I flashed the stock ROM earlier, everything worked as intended apart from the SIM card (which doesnt work at all) and the WiFi (which keeps dropping after 5 seconds of connection). Those problems persist even now.
Guess I'll be messing around with the SMT mode in MSMDownloadTool since I've already lost my IMEI, see what I can do from that. If there's anything I do actually end up finding out, I'll post it on xda.
Update
I installed an update by download a zip, installed update via settings. System rebooted to complete update, and somehow the oem unlock option opened!!
From this point, fixing it will be pretty straight forward I think
Thanks for your help
CrustyBurger33 said:
Update
I installed an update by download a zip, installed update via settings. System rebooted to complete update, and somehow the oem unlock option opened!!
From this point, fixing it will be pretty straight forward I think
Thanks for your help
Click to expand...
Click to collapse
Nice! If everything is working properly besides the IMEI at this point, there's a couple of PC applications you can use.
I'd recommend write dual imei, not gonna post a link since IMEI fudging is against the rules (even if you're just trying to repair your IMEI)
Use the IMEI that's on your device sticker or on your phone packaging specifically.
Either way, hoping you get your phone back up to 100%.
As it turns out, it's not easy at all. My WiFi has exactly the same issue... keeps dropping, No SIM card, no baseband version. What's crazy is that I have rooted, and even repaired the IMEI via a tool. If I read the IMEI via the tool (and different ones just to be sure), they will all show the IMEI the same as the one that I wrote (which were the original ones).
But for some reason the phone still doesnt recognize it. I reboot it. Same story. The tool recognizes, the phone doesn't. I know for a fact that the issue cannot be hardware, at least for WiFi. If it was, it wouldn't connect to any network, but it does, and then disconnects after a few seconds. I think I have been all over every post on the internet regarding this issue, but still no luck.
Honestly, check with OnePlus if you're under the 1 year warranty window. This sounds like an issue that can really only be fixed with a replacement device.
CrustyBurger33 said:
As it turns out, it's not easy at all. My WiFi has exactly the same issue... keeps dropping, No SIM card, no baseband version. What's crazy is that I have rooted, and even repaired the IMEI via a tool. If I read the IMEI via the tool (and different ones just to be sure), they will all show the IMEI the same as the one that I wrote (which were the original ones).
But for some reason the phone still doesnt recognize it. I reboot it. Same story. The tool recognizes, the phone doesn't. I know for a fact that the issue cannot be hardware, at least for WiFi. If it was, it wouldn't connect to any network, but it does, and then disconnects after a few seconds. I think I have been all over every post on the internet regarding this issue, but still no luck.
Click to expand...
Click to collapse
Hi I have a similar problem.. My phone oneplus 8t is stuck in 'SMT Download failed error' mode. I was tryimg out custom roms which has caused this. My phone says can only be fixed via SMT Download mode. Can you help me out using the SMT download mode? I have tried MSM Tool normally to unbrick my phone but it doesn't work.
hello @nightfury04
If you have a Oneplus 8T you have to download the appropriate MSMDownloadTool (specifically for it) and make sure the version is correct too. Is your phone global/ locked to a carrier?
Yesterday, decided to remove bloatware(mostly Google) on my Huawei p8 lite using ADB. And somehow removed this.
:/ $ pm uninstall -k --user 0 com.android.location.fused
Restarted.
Boot Loop.
Before I rebooted my phone usb debugging was on.
Phone boots into eRecovery with 4 options
1)Download latest version and recovery(usuless gives my an "Getting package info failed")
2)Wipe data/factory reset
3)Reboot
4)Shutdown
When I'm connected to pc I allways get a message "Unable to open MTP device".
I don't have the root privalage so I can't folow these steps in this guide below.
Bootloop after removing com.android.location.fused [SOLVED]My questions is:
1. Any method of saving data on bootloop phone without root?
2. Should I try factory reset?
I don't understand what you want, but you can't root in boot loop.
But I hear you will root, it's really easy to root Huawei!
Guide.
1. Get your firmware, with hisuite, after install downgrade or update, will firmware file be saved in document folder on PC.
2. Extract files inside the firmware file, and find the boot.img, system.img or boot.img and opened it and modified, some you will and repack it again.
3. Update hash's for partition controller.
4. Make a form of server and port forward your device to think this is the server there get updating from and see request some your phone ask for or read source of Huaweis update.apk.
4. Configure your server, with coding and upload the firmware to your server.
5. Now just install your update and you have custom os
JonasHS said:
But I hear you will root, it's really easy to root Huawei!
Click to expand...
Click to collapse
This guide is missing most important predecessor step: unlocking bootloader (and therefore useless)
JonasHS said:
I don't understand what you want, but you can't root in boot loop.
Click to expand...
Click to collapse
Thanks for reply. Sorry that I not spicified. My problem is that I unistalled com.android.location.fused witch resulted in boot loop. My phone is not rooted and I don't know what to do next. Only think I can is factory reset, becouse eRecovery gives me an error. I just looking right now for any way to save my data. I found a similar problem solved, but person rooted phone before boot loop. So I guess I only have 1 option then?
You can try to start you Huawei in back up mode,
JonasHS said:
You can try to start you Huawei in back up mode,
Click to expand...
Click to collapse
Yes my phone in recovery mode. Should I try "Wipe data/factory reset"? Because "Download latest version and recovery" option gives me an error"Getting package info failed".
You don't need to unlock bootloader for edit system, i making my own exploit and do it.
O just look at this:
We say you can't edit Any software file on your device, because you don't has permission, like Linux nonroot user.
There are only 1 way to get this permission, it's unlocking bootloader and add your code to software.
NOT TRUE.
if we put this together with a door that's locked and you don't have the key, what do you do?
I will find another way to open the door.
so to show what i mean: update.apk ask server for download the update and send it back too your phone, and your phone will install. Inside an update package, where are boot.img and system.img, what if we edit this file before update, and put a code some will give your user on system the highest privilege. But we can't edit this file, because they are saved on folder, we don't has permission too?
For do this, can we manipulate the data server send back too us.
Prot forwarding.
JonasHS said:
You don't need to unlock bootloader for edit system, i making my own exploit and do it.
Click to expand...
Click to collapse
So you're a hacker and found method to properly sign system.img with huawei's private oem key? you're a genius!
https://android.googlesource.com/platform/external/avb/+/master/README.md#The-VBMeta-struct
Unfortunately the repair has to be done in /data/system/users/0/package-restrictions.xml and requires root access. Furthermore /data is encrypted therefore that modification can't be done offline, it requires booted android to stage where we can enter screen unlock pin (or at least to stage where /data/system is decrypted)
JonasHS said:
You don't need to unlock bootloader for edit system, i making my own exploit and do it.
O just look at this:
We say you can't edit Any software file on your device, because you don't has permission, like Linux nonroot user.
There are only 1 way to get this permission, it's unlocking bootloader and add your code to software.
NOT TRUE.
if we put this together with a door that's locked and you don't have the key, what do you do?
I will find another way to open the door.
so to show what i mean: update.apk ask server for download the update and send it back too your phone, and your phone will install. Inside an update package, where are boot.img and system.img, what if we edit this file before update, and put a code some will give your user on system the highest privilege. But we can't edit this file, because they are saved on folder, we don't has permission too?
For do this, can we manipulate the data server send back too us.
Prot forwarding.
Click to expand...
Click to collapse
That sounds awesome. I guess we can try.
aIecxs said:
So you're a hacker and found method to properly sign system.img with huawei's private oem key? you're a genius!
https://android.googlesource.com/platform/external/avb/+/master/README.md#The-VBMeta-struct
Unfortunately the repair has to be done in /data/system/users/0/package-restrictions.xml and requires root access. Furthermore /data is encrypted therefore that modification can't be done offline, it requires booted android to stage where we can enter screen unlock pin (or at least to stage where /data/system is decrypted)
Click to expand...
Click to collapse
Dahm.
The easiest way to fix bootloop is factory reset. There is no way to safe userdata without fixing bootloop, sorry. it's a hen and egg dilemma.
aIecxs said:
The easiest way to fix bootloop is factory reset. There is no way to safe userdata without fixing bootloop, sorry. it's a hen and egg dilemma.
Click to expand...
Click to collapse
I agree.
Just reset its easiest.
Think about this here: your PC has SSD or HDD and you can take it off and take it into new pc, and edit everythiny on the disk without admin and make a backup.
The true is, you can do the same with a phones chip, but it's hard to do
Next time, before playing with packages, do a backup of your pictures.
Btw you can unlock bootloader with PotatoNV and root with Magisk. rooted devices you can backup with Migrate or TWRP.
New to said:
Yes
Huawei don't store theres OEM keys on devices chip, so they will never could control if i replaced it with my own, and avb will still work in offline mode, so I can just read vbmeta.img with avbtool.py and generate the same vbmeta.img with different size or hash of partitions, some is benn modified.
Click to expand...
Click to collapse
You could me a hacker, i am not a hacker, i have just a good kwoning of code and dissembling
JonasHS said:
Just reset its easiest.
Think about this here: your PC has SSD or HDD and you can take it off and take it into new pc, and edit everythiny on the disk without admin and make a backup.
The true is, you can do the same with a phones chip, but it's hard to do
Click to expand...
Click to collapse
aIecxs said:
Next time, before playing with packages, do a backup of your pictures.
Btw you can unlock bootloader with PotatoNV and root with Magisk. rooted devices you can backup with Migrate or TWRP.
Click to expand...
Click to collapse
Thanks for replys(they gived me alot of ideas what I can learn about phone and hacking).I will be more careful about deleting packages in future.
I just did Factory reset and my phone is working fine again.
JonasHS said:
Huawei don't store theres OEM keys on devices chip, so they will never could control if i replaced it with my own, and avb will still work in offline mode, so I can just read vbmeta.img with avbtool.py and generate the same vbmeta.img with different size or hash of partitions, some is benn modified.
Click to expand...
Click to collapse
Of course they don't. No, you can't flash own vbmeta.img on locked bootloader as the bootloader verifies the hash of vbmeta which is oem signed (you don't have key).
If you know about any flash tool for HiSilicon Kirin exist (IDT?) it would probably easier to flash magisk patched (properly avb signed) ramdisk.img to get root access and adb (osm0sis AIK is capable of signing AVBv2) instead of modifying system.
Nevertheless this won't fix bootloop therefore it's pointless, as the culprit lies in package-restrictions.xml. it's impossible to decrypt userdata partition offline, so there is no hope sorry.
Who has told you this here, i am developer and has readers the source code, yes you can make your own sign keys with openssl
yes, that is called user-settable root of trust and requires you to compile own complete ROM, for example LineageOS. In any case that is impossible with stock EMUI as again you can't cheat Android Verified Boot chain of trust per design. That's the whole purpose of locked bootloader.