Thank you for the read-visit.
I recently bought a second hand Tmobile Samsung SGH-T889 Galaxy Note II. Unfortunately,
I inherited a host of issues. The IMEI is corrupted. In this thread, I'm hoping to figure
out why I can't successfully write to the device. I will list everything that I've tried so far,
and to be honest, I really don't know what I can try next. Share your input please!
SGH-T889
Build Version: M9615ACEHWMAZD17513035
Version Dir ;: ACEFWMAZ
Firmware: T889UVALK8:_(4.1.1) (12/19/12) [FACTORY IMAGE]
Preface:
I read in a few other threads where people were having issues with the 4.1.2 firmware, so
I elected to downgrade to the 4.1.1 using a factory image by flashing using Odin 3.0.7.
I then used "Galaxy Note2 Toolkit" to flash root of the device while also including clockworkmod
recovery and busybox.
First Method:
After downloading and installing the Android Terminal Emulator, I tried to enter
the following code to write to the device:
su
echo 'AT +EGMR=1,7,"IMEI_1"'> /dev/pttycmd1
The device accepted the commands, but the write never occurred.
On the web, this solution is everywhere; however, I think that the
solution is specifically for MTK phones. In fact, the output command
"pttycmd1" isn't in the /dev directory or anywhere within the root file structure.
Second Method:
Accessing the hidden menu on the phone by entering *#7284#, I modified
the Qualcomm USB settings to allow for a serial USB connection.
I then used the "Qualcomm NV Tools," included in the fourth tab of EFS Professional
development software, to restore the backup IMEI to the device at the memory block located
at decimal address 550. The device accepted the command and I received
no indication of error, but the device was again not overwritten.
Third Method:
I installed RootExplorer application and used this tool to access the root directory and made
a copy of the EFS folder where I assumed the IMEI is stored. I then deleted the folder allowing
the system to recreate the EFS Folder after a reboot and a factory reset. I repeated the
previous methods, but I wasn't able to make a difference. Consequently, I restored my EFS folder.
Fourth Method:
I tried messing around with permissions allowing for read/write for the "efs" and "factory" folders
within the root file structure. Notwithstanding, I also expanded my read/write changes to the /dev/block folder focusing in particular on /dev/block/mmcblk0p3. (I read in another thread that the IMEI was stored in this block
/dev/block/mmcblk0p3.) Changing ownership of the files "owner" and "group" to root, I then tried writing to the device again using the previous methods mentioned, as well as fiddling around with another software called
"NV-items reader_writer v1.0," but all these approaches failed too.
Just as an added comment, I think that file manager such as Root Explorer re-mounts a read only root file
structure as a floating read/write. Therefore, while I think that I'm making changes to permissions -- I am, because I can see the change occur -- this change is actually temporary until the device is rebooted.
General Comments:
I suspect the GSM US variant of the Galaxy Note II is different, because I can't explain
why the device will not update the IMEI even with superuser rights. Along the way, I tried to
do a factory reset as well, but remember this approach made little difference since the device
was near factory settings from the onset since I just downgraded to 4.1.1.
Questions
Am I missing another method? please point me in the correct direction -- I'm stumped.
I value and appreciate any input in advance that you could lend.
when you first bought the phone and put in your t-mobile S I M card in it..
what happened .
are you sure its not a blocked imei phone.
this seems to be going around...
are you trying to use it on t- mobile ..
please post the original issue not just want you done to try and fix it..
Thank you for the reply.
This problem stinks.
I don't have a tmobile sim card. The phone is for Tmobile and I hope to use the phone on T-mobile's MVNO (mobile network virtual operator) SimpleMobile, a carrier that piggybacks on the Tmobile carrier. I have Simplemobile SIM card, which the device does not recognize. The network in the "About Phone" in Settings is listed as Unknown. I think that the phone is locked, but I thought that this issue is exclusive of my present dilemma.
So, what is preventing me from writing an update to the device? There are a couple of good Qulalcomm
tools on the market like DFS CDMA ver. 4.7.0.2 and Qualcomm NV Tools, but both of which
fail to restore the IMEI. Is this a CDMA vs GSM tool interface issue?
Where is the IMEI stored on the device? My efs/imei folder only has one file: "mps_code.dat"
(I guess NV_DATA.BIN file is not present for LTE users.)
Thanks again, in any case.
If I were you, I'd try writing the T889 NV backup from the AWS mod thread with QPST or QXDM. Then finish off with the IMEI using EFS Professional.
As you've noticed, no NV_DATA.BIN for our devices. The /efs partition isn't enough of a backup to fix things.
Information applicable to the N7100 is going to be useless here since it has an Intel baseband, as opposed to the LTE variants which run on a Qualcomm chip.
Darkshado said:
If I were you, I'd try writing the T889 NV backup from the AWS mod thread with QPST or QXDM. Then finish off with the IMEI using EFS Professional.
As you've noticed, no NV_DATA.BIN for our devices. The /efs partition isn't enough of a backup to fix things.
Information applicable to the N7100 is going to be useless here since it has an Intel baseband, as opposed to the LTE variants which run on a Qualcomm chip.
Click to expand...
Click to collapse
Thank you Dark Shado[w].
Fifth Method:
I used QPST configuration to establish a serial connection. Using one of the software's client applications called
QPST Software Download, I made a backup of NV Memory Files and then used a hex editor
to locate the IMEI number (offset 00001700 --fyi) and made the repair. However, when I attempted to restore the
file using QPST Software Download, the software failed to update the device. Take note that the software indicated the memory restore worked. However, again, I'm not sure what is preventing me from writing to the device.
Every editor or tool that I have used to interface with the device successfully reads the device but does not write.
In the Qualcomm USB Settings, I have chosen either "RNDIS + DM + Modem" or "DM + MODEM + ADB" settings.
I also try to make sure that "USB Debugging" is checked in "Developer options" in Settings. (This
setting appears to toggle depending on which USB serial setting is chosen.)
I began messing around again with EFS Professional. The problem with this approach is that the backup file is stored in the form of an image file. Unfortunately, I can't edit the image to repair the IMEI with a hex editor.
Previously the backup file was in the form of a bin or text format making the process of editing easy.
I also confirmed indeed that the address location of the efs folder including the IMEI is recorded in /dev/block/mmcblk0p3 for Galaxy Note II LTE variants.
Any other ideas? Is there any other toolkits that might be easier to work with?
Hey since you already odin 4.1.1 go ahead and unlock your phone using the free unlock method. Than try using your simple mobile sim again.
G7Baker said:
Hey since you already odin 4.1.1 go ahead and unlock your phone using the free unlock method. Than try using your simple mobile sim again.
Click to expand...
Click to collapse
Hi G7Baker. Thank you for the reply.
I was not able to unlock the device using the *#197328640# approach.
The device is missing the "Press [4] NW LOCK NV DATA INITIALLIZ"
I read elsewhere that I needed to downgrade the device to 4.1.1 and this option
would reappear in the menu settings. Specifically, if I downgraded the modem from
4.1.2 to 4.1.1, this option would again appear. In my case, the option is still missing.
I figured that I would just focus on my corrupt IMEI before addressing the locking issue...but if you any ideas,
i am open.
I'll be blunt: you haven't listened to anything I've said.
Use the .qcn file from the AWS mod thread. Not yours hex-edited to contain your IMEI. You NV items are already messed up.
Toggling USB Debugging might undo the "RNDIS + DM + Modem" setting.
Use EFS Professional to type in (not copy-paste, it's a quirk in the UI) your IMEI, then write it. Make sure you've got the latest version, and that you're using the Qualcomm tools. Or hex-edit the file from the AWS mod thread since you're capable of doing so.
Ditch this "toolkit" mindset and get their actual components, latest versions, straight from the devs. You'll be able to check for issues in their respective threads as well.
Good luck,
Darkshado
Darkshado said:
I'll be blunt: you haven't listened to anything I've said.
Use the .qcn file from the AWS mod thread. Not yours hex-edited to contain your IMEI. You NV items are already messed up.
Toggling USB Debugging might undo the "RNDIS + DM + Modem" setting.
Use EFS Professional to type in (not copy-paste, it's a quirk in the UI) your IMEI, then write it. Make sure you've got the latest version, and that you're using the Qualcomm tools. Or hex-edit the file from the AWS mod thread since you're capable of doing so.
Ditch this "toolkit" mindset and get their actual components, latest versions, straight from the devs. You'll be able to check for issues in their respective threads as well.
Good luck,
Darkshado
Click to expand...
Click to collapse
Thank you Darkshado[w] for the advise.
Game plan
qcn generic file (binary format) --> modify imei in qcn generic file --> EFS Professional-Qualcomm (fourth tab) to apply Restore
Darkshado[w], I'm looking at the EFS Professional -- Qualcomm tab (fourth tab). Just to be clear, this tab has a
"Qualcomm NV Tools" button, to which I don't proceed. This tab has also a set of "NV Backup" and "NV Restore" functions. These functions are supported for US variants only. (The T-mobile T889 has a Qualcomm chipset Gobi MDM9215, making the device eligible, right? or I guess these tools are meant only for Sprint and Verizon variants only) These tools, I believe, are where you would like me to use to make my restoration possible.
Just to be clear, this Restore/Backup receives a binary file, opposed to "Qualcomm NV Tools" that receive a text file.
However, when I click on "NV Backup" or "NV Restore," the phone immediately reboots.
On the same page the following disclaimer is written "If these functions are not supported your phone will just reboot." My device rebooted and I can't use this approach for the moment.
---
I was searching the AWS thread to which you alluded.
On December 28, 2012, I saw that you posted a full NV backup, IMEI removed, at the following thread:
http://50.23.216.69/showthread.php?t=2068041&page=2
I downloaded your attachment and modified the TEXT file to include my repaired IMEI for the T889 and then used
EFS Profressional via "Qualcomm NV Tools" to restore to my device.
I made sure that the device was set for a USB serial connection,
since "Qualcomm NV Tools" would not make the SPC connection otherwise.
The restore procedure completed without any errors, but the device was not successfully written to...again.
---
I also downloaded the ATT_I317_AWSMOD_dumimei.qcn file from the thread. Using QPST via their client application "Software Download" I attempted to make the restoration.
I attempted the restoration twice using "RNDIS + DM + Modem" and "DM + Modem + ADB" settings. In the phone utility menu, UART was always set to "PDA" and USB was set to "PDA" as well. In both cases, the device was not written. The software indicated that the restoration was successful when in fact this case was untrue.
--
On the EFS Professional version2.0.062, I was able to generate backup files using the backup option located on the second tab.
For this backup option, I selected "International LTE Variants" for the "Device Filter." The software
generated one tar.gz file; however, when extracted, a efs.img file and four other bin files are revealed. Unfortunately, the image file of efs contains my corrupted IMEI, which I'm not sure how to edit. I tried to use Hex Workshop Hex Editor to edit the file but can't find the IMEI in this type of file. Alternatively,
is there a generic backup tar.gz of SGH-T889 that I can try to restore?
--
What are your thoughts? Please advise.
garbageslot said:
Hi G7Baker. Thank you for the reply.
I was not able to unlock the device using the #197328640# approach.
The device is missing the "Press [4] NW LOCK NV DATA INITIALLIZ"
I read elsewhere that I needed to downgrade the device to 4.1.1 and this option
would reappear in the menu settings. Specifically, if I downgraded the modem from
4.1.2 to 4.1.1, this option would again appear. In my case, the option is still missing.
I figured that I would just focus on my corrupt IMEI before addressing the locking issue...but if you any ideas,
i am open.
Click to expand...
Click to collapse
I later downgraded the firmware from T889UVALK8 to T889UVALJ1 of 4.1.1. The NW LOCK NV DATA INITIALLIZ
finally appeared and was able to unlock the device successfully. Awesome!
However, I'm still trying to figure why my NV Memory Block refuses to be written. Please share your input!
No solution ... yet.
I tried deleting the efs folder and then I went back through all the methods that I have discussed
really to determine if and when the device was being written. Trying to restore the efs folder from a backup
copy, my findings seem conclusive.
I found that the ONLY solution that replaced my efs folders was EFS Professional--Restore (third tab).
In my case, I'm just restoring my corrupt NV memory backup back onto the device, but this approach can
work for me. In all other methods that I employed, the device and software indicated that a successful update was
made but these cases are untrue; the device is not updated.
Where does this leave me? If I am going to flash my device using this restore feature of EFS Professional(third tab),
I need to flash a modified efs.img that is corrected for my corrupted imei.
Does anyone have a solution out there for the SGH-T889?
garbageslot said:
I later downgraded the firmware from T889UVALK8 to T889UVALJ1 of 4.1.1. The NW LOCK NV DATA INITIALLIZ
finally appeared and was able to unlock the device successfully. Awesome!
However, I'm still trying to figure why my NV Memory Block refuses to be written. Please share your input!
Click to expand...
Click to collapse
I learned today that someone claimed that this SGH-T889 device has a hardware security measure in place. The device has a chip that has the IMEI that is write/no-rewrite (eMMC?); therefore, successful service combines both a hardware and software approach. My "deep throat" operative also said that the IMEI for this particular device appears in five different places within the NV Memory block, making the repair not so trivial.
Can anyone confirm this statement? I can't find anywhere where this statement is validated.
I would have to call bulls..t on that, I lost my imei flashing a tmobile modem to get lte and was able to rewrite my imei and get it working. Took me 2 days and lots of messing around but finally worked.
http://forum.xda-developers.com/showthread.php?t=2068281
You can try this link has some valuable info and links.
rail205 said:
I would have to call bulls..t on that, I lost my imei flashing a tmobile modem to get lte and was able to rewrite my imei and get it working. Took me 2 days and lots of messing around but finally worked.
http://forum.xda-developers.com/showthread.php?t=2068281
You can try this link has some valuable info and links.
Click to expand...
Click to collapse
Thank you Rail205 for your reply. Reviewing the thread that you sent,
I'm still not sure how I should proceed.
I was comparing my device allocation using the df command on the android emulation terminal .
# df
My partition allocations are consistent with jravi and darkshado[w] on the first page of the thread,
so I'm wary if I flash with an updated PIT file that this approach will make a difference.
My device is reading the correct internal storage for example.
To reiterate, if the block allocations are the same, can I assume that using a new T889V pit file
on my device the T889 will make no difference?
Currently, my device is now unlocked, rooted with a 4.1.2 OS.
The device has radio service.
Unlike everyone else who has been successful e.g. Darkshado[w] who has successfully
written an editable hex file or text file (depending on the method employed), my
device remains unmodified when performing approaches of this kind.
The only method that appears to work for me is flashing an image file
using EFS Professional (third tab).
This dilemma is the chicken / egg conundrum, how do I flash the device with the corrected img file
when I don't have a copy of an img file with the corrected imei with which to flash? Otherwise, considering
a no-img file approach, I could try to make the partitions writable (fyi I have used Root Explorer already to modify
the permissions of /dev/block, /efs and /factory before attempting an update -- you guessed it, no luck.)
Anyone, any thoughts? Anyone?
Success!
Sixth Method
NOTE: Please also refer to "Six Method. Addendum" post #21 located later in this thread. Both posts are critical to understanding the complete solution.
Well, I decided to go to one of these guys who advertise on Craigslist to repair corrupt IMEI. He claimed that he was using one of these boxes that reads and writes without technically flashing the device.
I sat with him for a couple hours, and, in the end, he could not do it! My IMEI went from some corrupted output to reading simply "0/9." At that point, I had limited phone service and mobile data EDGE only. The device had trouble finding the DM mode as well. (He felt so bad that he couldn't take my money, but this moment was also a validation for me that my device had a very specific problem, not a trivial contest in the least, but an awesome validation that this last week's efforts were not in vain: If the 'expert' can't figure this out, then where would this leave me?)
An important note worth mentioning is that the Craigslist guy downgraded my android OS from 4.1.2 prior to making modifications. Unfortunately,
I did not note to which version and build he downgraded. (My guess: most likely a build variation of 4.1.1 OS)
Anyhow, so I returned home and decided to get to work and access the phone through the service mode with the intention of rebuilding the NV memory block.
*#197328640#
[1] UMTS
[6] Common
[6] NV REBUILD
[1] Load defaut NV
This approach changed my IMEI from "0/9" to "0/0." Now, when I tried connecting to the device, the software read the correct DM Mode. (Interestingly, I still received limited phone service.)
I used a program called "NV-items reader_writer v1.0." Of the many programs that I tried, this program is super simple since the software output is text based i.e. you don't need a hex editor. The download link is here.
http://modemfiles.blogspot.com/2013/09/download-free-nv-items-reader-writer.html
I extracted the memory block from decimal address 550 to 550 and modified the block to read my non-corrupted IMEI. (I didn't need
to change root permissions or anything complicated like that, steps I performed in some of my previous method-approaches.)
My device finally was written and read the correct IMEI!
Thank you to everyone who contributed. My success is your own!
UPDATE:
So, as I mentioned above that I was receiving EDGE only and the carrier service was spotty. In the end, I realized that my NV Build was corrupted, and since I was now able to write to the device, I corrected this problem by referencing Darkshado[w]'s post.
On December 28, 2012, I saw that he posted a full NV backup for the T889, IMEI removed, at the following thread:
http://50.23.216.69/showthread.php?t=2068041&page=2
UPDATE: XDA admins have invalided the hyperlink to Darkshado[w]'s original post. If you require the text file, private message me with your email
and I will send you the same template file that he had originally made available. (edited 7/18/2015)
Using "NV-items reader_writer v1.0," I wrote to my device using the file provided by Darkshado[w]. Again just to be clear, I restored the entire NV build and only changed the IMEI block, which is located at decimal address 550. Now, my device is finally getting reliable connectivity at 4G speeds (only 4G, opposed to LTE, since I'm using a MVNO instead of a direct Tmobile plan). Anyways awesome still!
I'm glad you fixed it man!..you went through Hell fixing your phone.
I ALWAYS read and follow these "bad IMEI" threads to learn something "just in case" and I must say that your case it's the most complex (for me anyways) I've ever read.
Cheers to you!
New link to file please
garbageslot said:
Success!
Sixth Method
Well, I decided to go to one of these guys who advertise on Craigslist to repair corrupt IMEI. He was using one of these boxes
that reads and writes without technically flashing the device.
I sat with him for a couple hours, and, in the end, he could not do it! My IMEI went from some corrupted output
to reading simply "0/9." I had limited phone service and mobile data EDGE only. The device had trouble finding the DM mode as well. (He felt so bad that he couldn't take my money, but this moment was also a validation for me that my device had a very specific problem, not a trivial contest in the least, but an awesome validation that this last week's efforts were not in vain: If the 'expert' can't figure this out, then where would this leave me?)
Anyhow, so I returned home and decided to get to work and put the phone into a service mode with the intention
of rebuilding the NV memory block.
*#197328640#
[1] UMTS
[6] Common
[6] NV REBUILD
[1] Load defaut NV
This approach changed my IMEI from 0/9 to 0/0. Now, when I tried connecting to the device,
the software read the correct DM Mode. (Interestingly, I still received limited phone service.)
I used a program called "NV-items reader_writer v1.0." Of the many programs that I tried, this program
is super simple since the software output is text based i.e. you don't need a hex editor. I extracted the memory block
from decimal address 550 to 550 and and modified the block to read my non-corrupted IMEI. (I didn't need
to change root permissions or anything complicated like that, steps I performed in some of my previous
method-approaches.)
My device finally was written and reads the correct IMEI!
The guy from Craigslist suspects -- mind you, he wasn't gregarious in the least-- he hinted that "the box"
was needed to break some kind of internal logical state between the device's IMEI and
T-mobile's network protocols. Once this state was broken, the device was receptive to being written.
Thank you to everyone who contributed. My success is your own!
UPDATE:
So, as I mentioned above that I was receiving EDGE only and the carrier service was spotty. In the end, I realized that my NV Build was corrupted, but since I was now able to write to the device, I corrected this problem by referencing Darkshado[w]'s post.
On December 28, 2012, I saw that he posted a full NV backup for the T889, IMEI removed, at the following thread:
Using "NV-items reader_writer v1.0," I wrote to my device with the corrected IMEI using the file from Darkshado[w] as a template (replacing decimal address 550). Now, my device is finally getting reliable connectivity and 4G speeds (only 4G, opposed to LTE, since I'm using a MVNO instead of a direct Tmobile plan). Anyways awesome still!
Click to expand...
Click to collapse
Hello! I'm facing the same issue with my T889, could you please re-post the file from darkshadow's post?
Thank you!
NV Backup Blank-IMEI Template File
walydiesel said:
Hello! I'm facing the same issue with my T889, could you please re-post the file from darkshadow's post?
Thank you!
Click to expand...
Click to collapse
Thank you WalyDiesel for the follow up.
The administrators of this site appear to have made the original link outdated since I started this thread..
Please internally message me your email and I will send you the NV Backup Blank-IMEI template file.
(The file exceeded the attachment limits for this thread.)
You still need to edit decimal address 00550
to your specific IMEI number. Upon doing so,
write the entire file to your T889 device.
Good luck! -- You are in the home stretch.
garbageslot said:
Thank you WalyDiesel for the follow up.
The administrators of this site appear to have made the original link outdated since I started this thread..
Please internally message me your email and I will send you the NV Backup Blank-IMEI template file.
(The file exceeded the attachment limits for this thread.)
You still need to edit decimal address 00550
to your specific IMEI number. Upon doing so,
write the entire file to your T889 device.
Good luck! -- You are in the home stretch.
Click to expand...
Click to collapse
Ok! I sent you my email inbox.
Thank you!
walydiesel said:
Ok! I sent you my email inbox.
Thank you!
Click to expand...
Click to collapse
I'm back!
Unfortunately, the past two days I tried, But I can't write back the file to phone using nv_reader_writer tool. I can't even read from phone. It keeps saying "Failed, phone does not answer".
I read on a thread that it could be because my chip is not Qualcomm. In fact my chip is Exynos. Is it the problem? Is there another tool that I could use? Thank you.
P.S: I'm running stock android 4.3. I also tried stock 4.1.2. Same result and Service mode just leads me to a black screen with Serviceode written on top.
Related
I am using QPST 2.7 Build 378, on both Windows XP and Win7. Yes, I have installed Galaxy s2 USB driver. Connected to my computer using COM3. Sent SPC correctly. EFS Explorer shows title: FFA6550-ZRF6500.
However, in the left column, there is only root directory shown, i.e. /, there are no sub directories. Thus I cannot find a directory named nvm. Right clicking on the root directory gives the menu: "New" & "Delete"..
Has anyone used QPST EFS Explorer on Epic 4G touch before? What trick is there for showing the internal memory directories?
Thanks in advance.
what are you trying to do???? to my knowledge you don't need the nvm directory for anything, if you are trying to repair meid/esn use QXDM if you don't no how send me a PM and will guide you.
ctzw said:
I am using QPST 2.7 Build 378, on both Windows XP and Win7. Yes, I have installed Galaxy s2 USB driver. Connected to my computer using COM3. Sent SPC correctly. EFS Explorer shows title: FFA6550-ZRF6500.
However, in the left column, there is only root directory shown, i.e. /, there are no sub directories. Thus I cannot find a directory named nvm. Right clicking on the root directory gives the menu: "New" & "Delete"..
Has anyone used QPST EFS Explorer on Epic 4G touch before? What trick is there for showing the internal memory directories?
Thanks in advance.
Click to expand...
Click to collapse
same issue
Hi, I have same issue going on.
can't read anything under EFS explorer except the symbol for root folder.
I'm trying to back up my NVM as when I try to make changes under
QPST 2.7 378build, Service Programming, when I try write anything, (even if I make no changes to anything), I get an error:
NV ITEM = NV_UE_IMEI_I , STATUS NV_READONLY_S. I got this recently probably after performing one of the following:
I think this started since I performed a factory reset, by ##RTN# or was it ##72786# not sure anymore sorry.
Or it might have been simply by running this program called "Samsung MEID Repair.exe" from the verizon galaxy s2 forum.
Can anyone help me out? thanks.
strange
In case anyone is following this.
The Epic Touch has a mind of it's own.
I haven't changed anything at all, but QPST Service Programming is still producing that error I mentioned earlier. But
my changes are in fact saved after the phone reboots. I'm really not sure if this was the case before, may have or may not have.
I do believe I tried writing something before, and it would not save. "Now I don't know what to believe."
Anyway EFS Explorer is now working, it's reading all the directories.
So I'm relieved.
thanks
Hello XDA!
A quick thanks to those reading/interested and I apologize in advance if this belongs in the development section. I don't have permission to post their yet (perhaps with good reason!). After much searching, I've come to the conclusion there is, as yet, no free method of network unlocking the Galaxy Wonder GT-I8150.
I want to find a method to do this, test it, and then automate the process through a shell script and/or batch file. If it doesn't cost too much, I'll even try and make an app for it. I have two reasons for doing this: I own this model of phone (surprise!) and more importantly, I want to expand my portfolio of little computer projects because I want a job in IT, and I want it now.
So this thread will serve as a knowledge base and brainstorming place. Please -anyone with ideas about how to go about this - let me know!
Here's what I'm trying at the moment: based on a similar method used to unlock the HTC Sensation (and some other models), I'm going through the mmcblk virtual partitions after copying them to a .txt file (filetype is binary, .txt is just so my girl's Mac opens them with a text editor). Using a grep command with a regular expression I'm pulling every single 8 character long string of only digits and exporting the result to another txt file.
I then search the mmcblkXpXX file for these 8 long strings one at a time, trying to read through what I can of the binary file for giveaways like "isim_auth_key" or what not.
I started yesterday so I'm only up to mmcblk0p06.
If you have a network unlocked version of this phone, I might end up needing certain files to compare, but I won't ask unless I think I'm onto something.
Finally, if anyone has found an NV_data.bin, bml5 file (or equivalent) for this model, tell me what it's called! Or where I need to extract it from.
Thanks in advance,
GrayedFox
Info
Here are some links to information about unlocking various models of phones, using slightly different methods, for those interested. None apply directly to the gt-i8150 but I'm trying to tweak them just as a starting point.
http://forum.xda-developers.com/showthread.php?t=828534
http://forum.xda-developers.com/showpost.php?p=17148825&postcount=334
http://forum.xda-developers.com/showthread.php?t=1693491
http://forum.xda-developers.com/showthread.php?t=1335548
http://forum.xda-developers.com/showthread.php?t=1064978
Here is some information from my mmcblk0p06 file... wrapped in spoilers.
PERSO: Failure to write: %sPerso Command can be handled only on a provisioned session or when Card is not present on slotmits/perso.txt
[first mention of a person.txt file I've found]
EFS file read successfully [this implies there IS an efs file somewhere…]
EFS: Creating ISN file
EFS store sequence number
EFS: ISN file not present
AMSS\products\7x30\core\securemsm\smetest\test_crypto\src\sectestcipher.c
if anyone knows how to access that perso.txt file listed, please post the linux command here!
I'm afraid to say I'm running out of ideas here I've pulled every single mmcblk file on the phone - on stock rom and on cyanogenmod - looking for some sort of reference to a network unlock key but it's just not there. I even got Vodafone to send me my unlock key and have been searching the files for the exact key but it's no where on the phone.
I've even data dumped each of these files too - with an authenticated and nonauthenticated sim (network unlocked and network locked) sim and searched using a hex editor. I will have to move on to another project soon, but perhaps this will serve as an informing post for some: let it be known, there are absolutely NO references to an unencrypted network unlock key for this model of phone on stock rom.
Not in any of the mmcblkXpXX files (where most unlock keys are found for other phones) - and I've searched hard.
if anyone has further suggestions I'll remain subbed to this thread. Peace.
Probably they save a lock code, and the unclock is calculated with that lock code and IMEI.
GrayedFox said:
I'm afraid to say I'm running out of ideas here I've pulled every single mmcblk file on the phone - on stock rom and on cyanogenmod - looking for some sort of reference to a network unlock key but it's just not there. I even got Vodafone to send me my unlock key and have been searching the files for the exact key but it's no where on the phone.
I've even data dumped each of these files too - with an authenticated and nonauthenticated sim (network unlocked and network locked) sim and searched using a hex editor. I will have to move on to another project soon, but perhaps this will serve as an informing post for some: let it be known, there are absolutely NO references to an unencrypted network unlock key for this model of phone on stock rom.
Not in any of the mmcblkXpXX files (where most unlock keys are found for other phones) - and I've searched hard.
if anyone has further suggestions I'll remain subbed to this thread. Peace.
Click to expand...
Click to collapse
Hello
while searching for sim unlock i found this method for galaxy s4 mini could you check if it work with our wonder device?
here -> http://forum.xda-developers.com/showthread.php?t=1693491
Regards
So I hope this thread isn't too useless. I've been researching how to restore my imei after losing 4g signal when my phone randomly (just sitting there on the desk, not touching it), decided to get stuck in a reboot loop.
Here's my specs:
Network: AT&T
ROM: CyanogenMod 11-20141112-SNAPSHOT-M12-d2lte
Modem: UCUEMJB
Recovery: ClockworkMod 6.0.4.3
Device Model: SAMSUNG-SGH-I747
Product Code: Not Active
PDA Version:
Baseband Version: I747UCUEMJB
CSC Version:
Kernel Release: 3.4.104-cyanogenmod-g9f57632
Kernel Version: #1 SMP PREEMPT Tue Nov 11 22:15:56 PST 2014
ROM Build: d2uc-user 4.3 JSS15J I747UCUEMJB release-keys
Android Version: 4.4.4
BusyBox Version: 1.22.1
SU Binary Version: 2.40:SUPERSU
So here's what I've learned. My IMEI was lost due to a weird Samsung backup procedure that backed up my /efs folder with essentially a blank copy of important information. I have my IMEI, but writing it to the phone is very difficult. From this tutorial I learned to download QPST, and somewhere else I heard about EFS Professional.
So I tried to use EFS Professional first, and have been able to connect my phone (Had to install adb first via the official android sdk). I was able to make a backup of my efs folder. I was also able to change the usb settings to DIAG + MODEM + ADB. Then I launched the Qualcomm NV Tools. From there, by unchecking "Send SPC" and "Read Phone" I was able to connect to the phone, but any other button I pressed didn't accomplish anything except disconnecting the phone again.
This is when I turned to QPST. I knew from EFS Professional which COM port my phone was using each time, and I added the COM ports to the QPST Configuration program for listening. But my phone was never listed as available in the ports tab, nor was it listed in my device manager under COM ports. I tried using the RF NV Item Manager anyway, entering in my IMEI "backwards" with an 8 in the first line and an "a" after the first real number in my IMEI, but my phone was never really connected, so of course nothing happened.
I learned this was probably because I have no IOTHiddenMenu / Qualcomm USB Settings Menu / whatever you want to call it with USSD codes, because I'm using an AOSP ROM (Cyanogenmod). This thread and this thread were useless in enabling DIAG mode, because of broken links and scripts that no longer work on newer versions of CM.
My next plan is to change ROMs to a TouchWiz ROM, but I haven't found a good one yet, especially considering I've upgraded my bootloader and I know that if I flash a ROM with a downgraded bootloader, I'll definitely brick my phone. So is there a ROM I can use with an upgraded bootloader that won't brick my phone and will allow me to enter DIAG mode so that I can connect to QPST via a COM Port, use the RF NV Item Manager, and put in my old IMEI? Or am I just going about this all wrong?
You do have to be on a TW ROM with a stock dialer for ussd codes to work. Based on everything you posted you should be on the mjb boot loader, but confirm that first. Enter this into a terminal or adb shell:
Code:
getprop ro.bootloader
If you are on an mjb bootloader, then this ROM should work for you http://forum.xda-developers.com/showpost.php?p=47816011&postcount=18. It's a rooted deknoxed at&t stock mjb.
Good luck.
---------- Post added at 12:04 PM ---------- Previous post was at 11:57 AM ----------
You probably already discovered this in your research, but just in case. When you get your imei problem solved, before flashing something other than a TW ROM, enter this in a terminal or adb shell:
Code:
su
reboot nvbackup
That will fix Samsung's whoops and give you a working efs backup partition instead of a blank one.
Thanks! I'll try this and get back.
alexalexalex09 said:
Thanks! I'll try this and get back.
Click to expand...
Click to collapse
You were right about the bootloader - when I looked up the ro.bootloader property, it spit back what I thought was my modem identifier, I747UCUEMJB - so yes, MJB. I'll get a chance to flash the new ROM tomorrow or the next day and see how it goes.
So, two steps forward and three steps back. I did install the new ROM. Initially, it appeared to work, because I was able to dial *#7284# to access the service mode menu and change UART to MODEM, and then dial *#0808# to access the USB Settings menu and change that to RMNET+DM+MODEM. After that, the phone showed up under COM5 in the Device Manager. I opened up QPST Configuration and added COM5 (labelled it "COM5") under ports. However, the phone never showed up (Phone column read "No Phone").
I then tried EFS Professional, but it was unable to detect the phone. I opened up the command line and tried an adb shell, but it didn't connect. Of course, the phone was in RMNET+DM+MODEM mode, not and ADB mode. I then went back into USB settings, changed it to DM+MODEM+ADB, and reconnected the phone. The phone wasn't detected by the computer, and hasn't been since.
I've restarted the phone and the computer multiple times (Windows 7 32 bit), uninstalled the phone drivers, reinstalled them in two different versions, uninstalled and reinstalled QPST (removing the relevant registry entries in between installs), and went through a number of combinations of settings on the phone. I tried with UART set to MODEM and PDA, with USB settings set to DM+MODEM+ADB, RMNET+DM+MODEM, MTP, and MTP+ADB. I made sure superuser was installed correctly and that developer mode was enabled. I still have not gotten the phone to charge in that USB port or show up in Device Manager in any way, even though the USB port on the computer still functions (can access flash drives from it). I plan to do some more googling and troubleshooting about this, but I haven't had the time to yet. On Wednesday I'll hopefully have a minute to try using my work laptop to access the phone. I think once I get the phone to be recognized via USB again I'll be able to have QPST Configuration recognize it, then I'll be able to use that RF NV Item Manager to enter in the new IMEI.
Also, in potentially unrelated news, my install of Titanium Backup is unable to recognize any apps I backed up, even ones that have been previously restored. It sees them in the backup folder (backup folder location says this folder contains 52 backups), but no apps wee listed in the backup/restore tab. Maybe this has something to do with the mount namespace separation setting in SuperSU? I'll test that later.
Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.
audit13 said:
Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.
Click to expand...
Click to collapse
Thanks for chiming in, but I don't understand how this applies. I was on CM11 when my IMEI was removed. When you lose your IMEI, the main symptom is that you can't connect to 4g anymore, and you're stuck on EDGE, which is what happened in my case. I can in fact make calls and send texts, and even load web pages without wifi. It's just slow and prone to call dropping.
As for your advice to install an older ROM, I just flashed a stock ROM, the one linked above. It didn't cause my current lack of USB connection, because I had a USB connection for a while until I changed the UART and USB settings.
I definitely will not touch the bootloader - I've been warned about the dangers of downgrading from an MJB bootloader. I'm not sure what you mean by not touching the modem, but I'm going to assume it's as scary/difficult as the bootloader, so I'll be sure to stay away from changing that too.
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.
alexalexalex09 said:
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.
Click to expand...
Click to collapse
I should note that I took a look at my EFS folder while writing this last post, and it's completely empty now. So that's fun.
I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.
audit13 said:
I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.
Click to expand...
Click to collapse
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.
alexalexalex09 said:
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.
Click to expand...
Click to collapse
I got it! Problem solved!!
So what I realized after going back over those research threads quickly was that I was using Peoplearmy's QCN generator incorrectly. Here's how I fixed it.
1. Opened QPST, followed directions here to connect my phone and start up QPST Software Download.
2. Having already injected my IMEI, I used the backup tab to make a backup.
3. I opened Peoplearmy's SG3QCNGenerator and imported the QCN file that QPST just created. I left "inject IMEI" unchecked, since I already had my original IMEI. I clicked Save As to set the directory and name of the new file, and clicked the Verify IMEI button that appeared to verify that it was correct.
This was the step I had missed - because I never had a valid QCN file to import, I never was able to create a new QCN file. My error in thinking was that, since my current QCN file was obviously messed up, I couldn't use it to make a new QCN file, but that's the whole point of this software.
4. Once I had the new QCN file, I went back to QPST's Software Download program and used the Restore tab. The QCN file generated by Peoplearmy's tool didn't match my model number, but I approved it anyway. It restored the QCN file correctly, but it had an error when it tried to reset the phone.
5. I rebooted the phone manually, and I now have 4G signal!
So, to summarize the difficulties I had:
1. I didn't make an nvbackup before I flashed CM a year ago, and it didn't hurt me until now.
2. I lost my IMEI and couldn't restore it because 1) I was on CM, which stopped me from putting my phone in DM + MODEM + ADB mode and 2) The computer/cable I was using to work on my phone, for whatever reason, were being stupid.
3. I didn't understand that in order to fix my phone I needed to restore my IMEI and repair my nv items (.qcn file)
4. I didn't realize that I could use Peoplearmy's tool to take a messed up nv items qcn file, fix it, and restore it to my phone.
All the tools I ended up needing: Samsung Drivers, ADB, ES Professional, QPST, and Peoplearmy's SG3 Data Restorer. Hope this helps someone else out there.
:good: thanks for posting fix.
"all i can really do , is stay out of my own way and let the will of heaven be done"
Great job. Thanks for posting your solution back here so others can find it.
OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
fastboot erase modem st 1
fastboot erase modem st 2
Click to expand...
Click to collapse
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
BlazingBullets said:
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
Click to expand...
Click to collapse
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Greatuser123 said:
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Click to expand...
Click to collapse
No no, please do not think I meant you by that. It was other users (understandably) that questioned my motives before you. I absolutely would have taken you up on your offer if I did not already have the phone on the way Either way, I really appreciate your help during this, and I hope you continue to help other users the same way you did for me.
decrypterfixer said:
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Click to expand...
Click to collapse
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
BlazingBullets said:
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
Click to expand...
Click to collapse
I can help u
Well done mate you will be a hero someday haha good job ?
Leevii2208 said:
I can help u
Click to expand...
Click to collapse
Please provide your support ouvertly here and not via social media!
I've edited your post; please refer to https://forum.xda-developers.com/oneplus-5t/how-to/telegram-chat-channels-forward-t3765018
not work
ty but not working or i did wrong. i wrote (change my imei, two way u and other program) and post new "good.qcn" (i see finished in QPST Software). i restart phone but nothing change. i think phone in document just "read-only".
I want redmagic 3 qcn file
good job bro
Is it works for rog phone 3?
I can't find that hex
hello friends 08 3A 85 99 99 99 99 99 99 no found please help me
Hi, perfect post friend. Im try backup qcn to my Rog Phone 3, but when try said Satuts: Memory Backup Failer and Errors: Disr Error while write to file, any solution to this? I appreciate your help.
decrypterfixer said:
OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Click to expand...
Click to collapse
I tried it till finish, but when I check, I lost my wifi mac address (status unavailable) and my imei still unknown. And now I wanna retry, I stuck at QPST Configuration application at step 17, it sometimes detected the phone, sometimes don't, it make me can't continue to click "star clients", (check in device manager, nothing wrong). can you help me?
sure which device rog 2 or 3?
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
uhhg that's a issue just download visual c++ redistributable 2010 sp1 x86 and it should be fine
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
Rog2. The port keep blinking when in QPST Tools, sometimes it detected, sometimes don't, so I can't copy the qcn to the phone. And also I don't know what's wrong with the qcn, I had follow the instruction, but it not works
hmmm use another pc or cable.
gjkhan said:
hmmm use another pc or cable.
Click to expand...
Click to collapse
Try itt but problem still persist
Hello,
while attempting to root my Blackview BV6000s (containing Mediatek MT6737T chip) I lost both IMEI's. Although I succeeded in rooting the phone, I was not able to restore the IMEI.
1) If I use Mediatek Engineering apk, when I send the string "AT+ EGMR=1,7,"IMEI_1″ I receive the error "This Command is not allowed in user build". I have read a lot of forum posts where they say to put a blank after "AT+", but it doesn't work placing the blank in any place: before or after the "+", or without blank at all. Always the same result: "This Command is not allowed in user build". I have tried all the versions of MTK engineering apk that I found inside and outside google play store
2) It is not possible to get any connection with "MTK Droid tool". Same result with MauiMETA
3) With SN write tool, when I plug the USB cable the phone powers on and the Blackview logo is shown, and after few seconds a red "FAIL" message is shown by the SN writer tool. It seems that the phone is not able to enter in "meta mode"
4) I have generated an IMEI file named "MP0B_001" and I have copied it in the right place with the root browser, but after the reboot the IMEI are still empty. I remark that when I try to set the write permissions, the root browses pops up an error message saying that the file system doesn't allow changing the permissions of the files. Then I packed the MP0B_001 in a zip file and I installed it with the TWRP recovery. The installation with TWRP doesn't show any error, but then after the reboot the IMEI are still invalid (null). Note: in ALL the posts that describe how to install the MP0B_001, they indicate /data/nvram/md/NVRAM/NVD_IMEI/MP0B_001 as the path where the file is stored. But in my phone the path is different, and precisely it is /nvdata/md/NVRAM/NVD_IMEI/MP0B_001. This makes me think that nobody have tried to apply this procedure to BV6000s. Anyhow, I tried to pack and install the zip with both paths, with the same unsuccessful result.
5) The only way I could write something in the 2 IMEI's is with Chamelephon. However there must be an incompatibility between Chamelephon and my phone. In fact, after applying the new IMEI's and rebooting, when reading the IMEI I find random strings instead of null strings. What is odd is that one of the 2 SIM cards succeeds in connecting with to the mobile networks and receive calls and SMS, even with this corrupted IMEI, while the other SIM still gives "invalid IMEI" error. I tried to find newer versions of Chameleon, but it seems that only version 1.0 exists
6) I tried to install all the ROM's that are compatible with MT6737T but the results of attempts 1-5 are the same.
In conclusion, it seems quite impossible to fix the IMEI. I have the impression that nobody tried to fix the IMEI on this specific phone, or that the producer has decided to "punish" whoever tries to root the phone, by preventing the repairing the IMEI. All the forum posts and guides, on which I based the attempts that I have described in this post, are not referring explicitly to BV6000s. Before resigning myself, I decided to create this post. Maybe it could be helpful also to other persons, if a solution exists and is described here.
Best regards
I have solved the issue and I am reporting here the solution for the benefit of those who should face the same problem.
I had to remove the encryption from the phone. I have installed the "no verity" package (no-verity-opt-encrypt-6.1.zip) with TWRP recovery and formatted the data section. This made necessary to reinstall all the applications from scratch. Further information: https://www.androidinfotech.com/no-verity-opt-encrypt-versions/
Then I used ghost phone (from google play store) to fix the IMEI; anyway after removing the encryption also Chamelephon was working.
***
Now I am in doubt whether I should restore the encryption.
If I restore the encryption, I am afraid that this could cause the loss of IMEI's again, or re-introduce some other annoying restrictions.
If I leave it not encrypted, I am afraid that my phone is more vulnerable to rootkits and similar malwares.