{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory - HTC Desire 526

{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory
I know everyone is eager to unlock the Verizon Boot-Loader.
We are not quite there yet however this is another step in the right direction.
We are getting deeper and deeper into this so be FOR-WARNED.
If you decide to play around with these tools you do so at your own risk :crying:
I will help anyone who kills there device But I TAKE NO RESPONSIBILITY.
------------------------------------------------------------------------------------------------------------------------------
Follow my instructions exactly and everything will be ok
------------------------------------------------------------------------------------------------------------------------------
Lets Get Started Shall We :highfive:
PREREQUISITES
The ability to follow each step in order :good:
ADB installed ( Android Studio )
Install HTC Sync from the link below. Then uninstall it. This will load and leave the drivers.
Make sure you uninstall it. HTC Sync will interfere.
http://www.htc.com/us/support/software/htc-sync-manager.aspx
STEP 1)
Set Windows 7 or 8 or 10 into TEST MODE ! ( I Am Running Windows 10 )
You can read up on this process here if you have trouble with my instructions.
http://www.drivethelife.com/windows...e-enforcement-on-windows-10-8-7-xp-vista.html
http://www.howtogeek.com/167723/how...8.1-so-that-you-can-install-unsigned-drivers/
You’ll need to run a command from an Administrator Command Prompt to do this. To launch one, right-click the Start button or press Windows+X and select “Command Prompt (Admin)”.
Execute This Command
Code:
bcdedit /set testsigning on
If you did it correct you should see the following.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Reboot your computer.
If you did it correct you should see the following.
STEP 2) Install the Diag Driver in Windows.
Download the DIAG.zip here. It contains all of the files we need to work with at this point.
Code:
http://www.mediafire.com/file/3ta2ua4tkibn3lb/DIAG%282%29.zip
Unzip the file and install the drivers.
There are 2 drivers. 1 for diagnostic mode and one for Emergency Download Mode.
HTC CDMA LTE DIAG Modem Driver v3.0.2.0 (Diagnostic Driver)
Qualcomm_Diag_QD_Loader_2016_driver (Emergency Download Driver)
When you install the Qualcomm_Diag_QD_Loader_2016_driver you will want your screen to look like this.
The Diagnostic Driver install is pretty self explanatory.
I,m going to leave this section for setup details. More could be added later.
In the next post we will install the tools we need and get the phone connected in diagnostic mode.
Also please see here
https://forum.xda-developers.com/desire-626/general/programming-modem-qpst-qxdm-boost-t3488993 @anthonykb deserves the credit for originally leading me to this idea.
We are using the process for different purpose but it all stems from the same idea.
REMEMBER THE DESIRE 526 AND THE DESIRE 626S AND THE DESIRE 530 ALL HAVE THE SAME CHIPSET.
What works for one of these devices should theoretically work on the others.

Checking Drivers + Setup Tools
I think it's time for us to set up some tools and see if our drivers are installed correctly.
There are 3 tools included in the zip.
QPST.2.7.438 ( Just install it. There is nothing special to do )
QXDM Pro 3.14.594 ( Read IMPORTANT text in the patch folder and follow the instructions )
RevSkills V 2.08.6 Pro Edition (Read the readme file)
Install all 3 and proceed to the next step
Set The device into DIAGNOSTIC MODE
My device is already s-off and unlocked. So this might take an extra step for you.
First try this.
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
I tested this on a fully locked 526 so you will get the DIAG Screen.
You should see this screen.
IF ##3424# isn't giving you that screen you will need the extra step
This might not be 100% necessary BUT I RECOMMEND IT
First you will have to get temp root.
Follow here. It will give you root in the shell only. Not root for apps.
https://forum.xda-developers.com/desire-526/general/temp-root100-how-to-temp-root-desire-t3498969
*********************************************************************************************************
ONCE YOU HAVE ROOT ACCESS
Open up a administrator command window.
Execute these commands in the shell.
Code:
adb devices
adb shell
su
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/func_en
*********************************************************************************************************
IF YOU CAN'T GET ROOT THIS SHOULD STILL WORK !!
*********************************************************************************************************
Verify the Diagnostic Port is Available (ALL DRIVERS WORKING)
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
Connect the device to the computer.
Open up windows device manager.
With all nessessary drivers installed this is what you should see. :highfive:
If you didn't install and uninstall HTC Sync it will look like this
Some things work but this isn't right. DONT DO IT
The HTC Drivers and Diag Drivers are missing. REALLY DONT DO THIS

Time to do some Work
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:

Backup the entire nv ram
Ok lets get too it. Here we will backup the entire NV Ram.
After it is dumped to a file I believe the file can be edited.
It is easy to restore the backup to the device.
Lets get started.
#1) Dial ##3424# then send to get to diagnostic mode.
#2) Open QPST Configuration
#3) You Should See This Screen
#4) In QPST Configuration Click START CLIENTS ( EFS EXPLORER)
Select your device under phone selection
#5)EFS EXPLORER Reads the device
#6)The NV Items Look Like This
Notice the red circle ( We cant access those )
But we can fix NVM to get access using open sesame door
#7)Click File Then NEW then Directory
#7)Add open sesame door
Now reboot the device.
Dial ##3424# again.
Then open QPST Configuration and EFS Explorer again.
Make sure you have the open sesame door folder
Notice NVM is no longe a red circle. ITS UNLOCKED.
After reboot and restart qpst it should look like this.
OK were all done with that part. ( OPEN SESAME DOOR )
Lets dump our Embedded File System now.
Close the EFS File Explorer.
Go to the QPST Configuration and Start Clients -->>> Software Download.
Notice the MPSS Version ---->>>> This tells us what version of Source to USE.
#8)Click The BackupTab
On the backup tab where it says xQCNFile select a a location and name for the file.
#9)Click Start To make the backup.
Pay attention to all the files it creates.
Look at the images below.
TO FLASH A BACKUP EFS FILE
#9)Now Go To the Restore Tab
Select the backup file you want to restore.
Make sure Allow phone/file ESN mismatch is NOT Checked.
The backup you flash has to be from the device you created it from.
Or the backup file will need the ESN Edited to match your device. (DANGEROUS)
I need to find a way to use the ESN mismatch but right now it gives error.
Anyway lets flash our backup.
Select the file.
Click Start.
Restoring NV Memory
Restoring NV ITEM FILES
Restoring BREW FILES
Restoring COMPLETE
So there you have it. We can indeed use the QPST / QXDM tools to communicate and flash the device.
THIS BACKUP IS IMPORTANT.
IF YOU BRICK YOUR PHONE. YOU COULD NEED THIS BACKUP TO RESTORE IT COMPLETELY.
WE CAN EDIT THE BACKUP FILE USING A HEX EDITOR OR THE TOOL I WILL TALK ABOUT NEXT.
In light of all this Someone Who Knows What to Changecould help reduce the device security and help us to further customize the device.
Unfortunately this is fairly new to me so I DONT Know the best things to change.
Best I can think of is to compare the backup from my fully unlocked device. ( S-Off / Super CID )
Against the backup from a factory LOCKED State.
Make any necessary changes to the Locked NV Backup.
Know that the wrong mistake here will brick your device for sure.
Feel free to explore the tools and things that can be accomplished with them.
I recommend highly....DONT CHANGE ANYTHING UNLESS YOU KNOW WHAT YOUR DOING.
Hitting some of the buttons in the tools can be dangerous.
Have Fun. The best thing is this device cost only $34.
So it's perfect for learning these tools and testing.
Then when you do this on your expensive device.
You won't brick it.

GREAT!!
Please make a rom to global GSMcard for connection data,

Wow, I am a newbie and when I seen all these instructions I almost gave up before I started. I can proudly say I successfully completed this tutorial. Does this mean my bootloader is now unlocked? What do I need to do next to root this thing. Once again, please forgive my ignorance, like I said this is all new to me.
I just went in to recovery mode and it still says locked. ???

@blahforme
I'm glad everything worked for you.
I try to write my guides so everyone can follow and get good results.
Unfortunately this is not a boot loader unlock.
So you can't root yet.
But you do have a backup of your NV Memory and you learned something.
Plus you have the drivers and whatnot installed.
So it was worth the effort.
I have build a device image that if it can be flashed will allow you to unlock the boot loader.
I'm working on the flashing part.
The rom build is here and you can learn a whole lot about htc devices in this thread.
Really it's not for a new bee so don't be surprised when you see the complexity of things.
https://forum.xda-developers.com/de...-rom-msm8909-service-rom-source-qpst-t3544178
As soon as i have a way to unlock the boot loader you will all know. Hopefully soon.

BigCountry907 said:
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:
Click to expand...
Click to collapse
Hi @BigCountry907,
First and foremost, thank you for all of your hard work on the MSM8909 chipset. I've found your many posts to be extremely enlightening! I plan to attempt building your AOSP kernel at some point soon on my Desire 626s; I just need to setup my Linux dev box. I realize this is now an older device, but I'm enjoying learning & getting close to the metal on this one.
Pertaining to these instructions, I am encountering an issue and wanted to see if you might have any ideas.
Have QXDM drivers properly installed; diag port enabled via adb; QPST recognizes the phone (although ESN is blank). As I attempt RevSkills, HTC Unlock SPC = success "Done sending SuperSPC." As I click "Change SPC", I receive "Error writing NV value". However, after several attempts at it, I finally get success. Send SPC = I get a return "41 01 ¶ A" and after "Send SP" get a return of "46 01 ¶ F". I'm going to assume these are successful.
The issue presents itself when I enter ##3424# (DM Command- after writing SPC). It prompts me to enter the MSL. I attempt 000000 and the phone will either: reboot or will say incorrect MSL (and will not allow me into the menu). I'm unable to access DM Command.
While I've already enabled the diag port, I am interested in sending AT commands and going further into using qcdiag to monitor gsm/3g/lte packets. As I understand it, I need to enable serial com in order to send AT commands to the modem. I'd like to get my KC and use rtl-sdr to sniff and decrypt my own traffic to better understand... Currently, as I attempt Putty on COM3 (valid diag port) unable to connect.
To give some supporting information, I am using a Cricket Wireless Desire 626s device unlocked on Marshmallow 2.27.651.6 T-Mobile network (Sprint debloated ROM as Cricket did not update to MM). However, I've attempted this after using the Cricket RUU as well as a few other custom ROMs w/o success.
I've also looked into QXDM - NV Browser - Item 0085 after a supposedly successful SPC write, and get the return "No DIAG Response Received". I've tried to pack as much pertinent info into these screenshots as possible.
Ultimately, I'm interested in getting to packet level data using qxdm, and am hoping you might help steer me a bit. Osmo-qcdiag has some really cool stuff they are working towards and I'd like to use this device. Also, if you happen to have an idea of the NV values to open up additional 3g & LTE bands- that would be super helpful! (I'm on T-Mobile network currently).
Thank you so very much for all of your hard work on this device.
FYI, unfortunately unable to post my image as I"m a "new" member. However,
imgur . com /a / ZiuXP

Related

[Q] Restoring IMEI i747 ATT

So I hope this thread isn't too useless. I've been researching how to restore my imei after losing 4g signal when my phone randomly (just sitting there on the desk, not touching it), decided to get stuck in a reboot loop.
Here's my specs:
Network: AT&T
ROM: CyanogenMod 11-20141112-SNAPSHOT-M12-d2lte
Modem: UCUEMJB
Recovery: ClockworkMod 6.0.4.3
Device Model: SAMSUNG-SGH-I747
Product Code: Not Active
PDA Version:
Baseband Version: I747UCUEMJB
CSC Version:
Kernel Release: 3.4.104-cyanogenmod-g9f57632
Kernel Version: #1 SMP PREEMPT Tue Nov 11 22:15:56 PST 2014
ROM Build: d2uc-user 4.3 JSS15J I747UCUEMJB release-keys
Android Version: 4.4.4
BusyBox Version: 1.22.1
SU Binary Version: 2.40:SUPERSU
So here's what I've learned. My IMEI was lost due to a weird Samsung backup procedure that backed up my /efs folder with essentially a blank copy of important information. I have my IMEI, but writing it to the phone is very difficult. From this tutorial I learned to download QPST, and somewhere else I heard about EFS Professional.
So I tried to use EFS Professional first, and have been able to connect my phone (Had to install adb first via the official android sdk). I was able to make a backup of my efs folder. I was also able to change the usb settings to DIAG + MODEM + ADB. Then I launched the Qualcomm NV Tools. From there, by unchecking "Send SPC" and "Read Phone" I was able to connect to the phone, but any other button I pressed didn't accomplish anything except disconnecting the phone again.
This is when I turned to QPST. I knew from EFS Professional which COM port my phone was using each time, and I added the COM ports to the QPST Configuration program for listening. But my phone was never listed as available in the ports tab, nor was it listed in my device manager under COM ports. I tried using the RF NV Item Manager anyway, entering in my IMEI "backwards" with an 8 in the first line and an "a" after the first real number in my IMEI, but my phone was never really connected, so of course nothing happened.
I learned this was probably because I have no IOTHiddenMenu / Qualcomm USB Settings Menu / whatever you want to call it with USSD codes, because I'm using an AOSP ROM (Cyanogenmod). This thread and this thread were useless in enabling DIAG mode, because of broken links and scripts that no longer work on newer versions of CM.
My next plan is to change ROMs to a TouchWiz ROM, but I haven't found a good one yet, especially considering I've upgraded my bootloader and I know that if I flash a ROM with a downgraded bootloader, I'll definitely brick my phone. So is there a ROM I can use with an upgraded bootloader that won't brick my phone and will allow me to enter DIAG mode so that I can connect to QPST via a COM Port, use the RF NV Item Manager, and put in my old IMEI? Or am I just going about this all wrong?
You do have to be on a TW ROM with a stock dialer for ussd codes to work. Based on everything you posted you should be on the mjb boot loader, but confirm that first. Enter this into a terminal or adb shell:
Code:
getprop ro.bootloader
If you are on an mjb bootloader, then this ROM should work for you http://forum.xda-developers.com/showpost.php?p=47816011&postcount=18. It's a rooted deknoxed at&t stock mjb.
Good luck.
---------- Post added at 12:04 PM ---------- Previous post was at 11:57 AM ----------
You probably already discovered this in your research, but just in case. When you get your imei problem solved, before flashing something other than a TW ROM, enter this in a terminal or adb shell:
Code:
su
reboot nvbackup
That will fix Samsung's whoops and give you a working efs backup partition instead of a blank one.
Thanks! I'll try this and get back.
alexalexalex09 said:
Thanks! I'll try this and get back.
Click to expand...
Click to collapse
You were right about the bootloader - when I looked up the ro.bootloader property, it spit back what I thought was my modem identifier, I747UCUEMJB - so yes, MJB. I'll get a chance to flash the new ROM tomorrow or the next day and see how it goes.
So, two steps forward and three steps back. I did install the new ROM. Initially, it appeared to work, because I was able to dial *#7284# to access the service mode menu and change UART to MODEM, and then dial *#0808# to access the USB Settings menu and change that to RMNET+DM+MODEM. After that, the phone showed up under COM5 in the Device Manager. I opened up QPST Configuration and added COM5 (labelled it "COM5") under ports. However, the phone never showed up (Phone column read "No Phone").
I then tried EFS Professional, but it was unable to detect the phone. I opened up the command line and tried an adb shell, but it didn't connect. Of course, the phone was in RMNET+DM+MODEM mode, not and ADB mode. I then went back into USB settings, changed it to DM+MODEM+ADB, and reconnected the phone. The phone wasn't detected by the computer, and hasn't been since.
I've restarted the phone and the computer multiple times (Windows 7 32 bit), uninstalled the phone drivers, reinstalled them in two different versions, uninstalled and reinstalled QPST (removing the relevant registry entries in between installs), and went through a number of combinations of settings on the phone. I tried with UART set to MODEM and PDA, with USB settings set to DM+MODEM+ADB, RMNET+DM+MODEM, MTP, and MTP+ADB. I made sure superuser was installed correctly and that developer mode was enabled. I still have not gotten the phone to charge in that USB port or show up in Device Manager in any way, even though the USB port on the computer still functions (can access flash drives from it). I plan to do some more googling and troubleshooting about this, but I haven't had the time to yet. On Wednesday I'll hopefully have a minute to try using my work laptop to access the phone. I think once I get the phone to be recognized via USB again I'll be able to have QPST Configuration recognize it, then I'll be able to use that RF NV Item Manager to enter in the new IMEI.
Also, in potentially unrelated news, my install of Titanium Backup is unable to recognize any apps I backed up, even ones that have been previously restored. It sees them in the backup folder (backup folder location says this folder contains 52 backups), but no apps wee listed in the backup/restore tab. Maybe this has something to do with the mount namespace separation setting in SuperSU? I'll test that later.
Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.
audit13 said:
Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.
Click to expand...
Click to collapse
Thanks for chiming in, but I don't understand how this applies. I was on CM11 when my IMEI was removed. When you lose your IMEI, the main symptom is that you can't connect to 4g anymore, and you're stuck on EDGE, which is what happened in my case. I can in fact make calls and send texts, and even load web pages without wifi. It's just slow and prone to call dropping.
As for your advice to install an older ROM, I just flashed a stock ROM, the one linked above. It didn't cause my current lack of USB connection, because I had a USB connection for a while until I changed the UART and USB settings.
I definitely will not touch the bootloader - I've been warned about the dangers of downgrading from an MJB bootloader. I'm not sure what you mean by not touching the modem, but I'm going to assume it's as scary/difficult as the bootloader, so I'll be sure to stay away from changing that too.
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.
alexalexalex09 said:
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.
Click to expand...
Click to collapse
I should note that I took a look at my EFS folder while writing this last post, and it's completely empty now. So that's fun.
I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.
audit13 said:
I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.
Click to expand...
Click to collapse
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.
alexalexalex09 said:
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.
Click to expand...
Click to collapse
I got it! Problem solved!!
So what I realized after going back over those research threads quickly was that I was using Peoplearmy's QCN generator incorrectly. Here's how I fixed it.
1. Opened QPST, followed directions here to connect my phone and start up QPST Software Download.
2. Having already injected my IMEI, I used the backup tab to make a backup.
3. I opened Peoplearmy's SG3QCNGenerator and imported the QCN file that QPST just created. I left "inject IMEI" unchecked, since I already had my original IMEI. I clicked Save As to set the directory and name of the new file, and clicked the Verify IMEI button that appeared to verify that it was correct.
This was the step I had missed - because I never had a valid QCN file to import, I never was able to create a new QCN file. My error in thinking was that, since my current QCN file was obviously messed up, I couldn't use it to make a new QCN file, but that's the whole point of this software.
4. Once I had the new QCN file, I went back to QPST's Software Download program and used the Restore tab. The QCN file generated by Peoplearmy's tool didn't match my model number, but I approved it anyway. It restored the QCN file correctly, but it had an error when it tried to reset the phone.
5. I rebooted the phone manually, and I now have 4G signal!
So, to summarize the difficulties I had:
1. I didn't make an nvbackup before I flashed CM a year ago, and it didn't hurt me until now.
2. I lost my IMEI and couldn't restore it because 1) I was on CM, which stopped me from putting my phone in DM + MODEM + ADB mode and 2) The computer/cable I was using to work on my phone, for whatever reason, were being stupid.
3. I didn't understand that in order to fix my phone I needed to restore my IMEI and repair my nv items (.qcn file)
4. I didn't realize that I could use Peoplearmy's tool to take a messed up nv items qcn file, fix it, and restore it to my phone.
All the tools I ended up needing: Samsung Drivers, ADB, ES Professional, QPST, and Peoplearmy's SG3 Data Restorer. Hope this helps someone else out there.
:good: thanks for posting fix.
"all i can really do , is stay out of my own way and let the will of heaven be done"
Great job. Thanks for posting your solution back here so others can find it.

How to get into Qualcomm diagnostic mode?

Hello there.
I have been having the 'stupidly set baseband to USA and unable to change back' issue with my Nexus 5x, using a European version. I live in Croatia, so as you would imagine this has meant a complete loss of signal/mobile operator/3g etc.
As per my other thread in Nexus 5x help and troubleshooting,
http://forum.xda-developers.com/nexus-5x/help/usa-baseband-set-european-model-t3252879
I have exhausted other options and have come to the realisation that as per other users issues with other phones that the use of QPST tools and using a clean QCN file to inject into my phone is the only course of action left. However, I have no knowledge of such things (not to say that I am unable to inform myself).
I emailed a developer with regards to users issues with Nexus 5 phones (not 5x), and he said that I need to enter this mode on my phone.
Could anyone help me out with this, and in general with this issue? As some have tried to help but unfortunately my thread has more of my own replies than other users. (In elaborating on steps taken to resolve my misery).
I am not looking for a 'one button fix', I have educated myself far and beyond with regards to this issue, I just need some more expert help so that I can sort this out myself.
Please, anyone?
Marko
Thank God.
I can actually get a new phone. Help not needed in the end.
Thanks anyway.
Marko
was.once.dead said:
Thank God.
I can actually get a new phone. Help not needed in the end.
Thanks anyway.
Marko
Click to expand...
Click to collapse
glad you got your probelm fixed dont know if this will help you or others but if you press *#*#4636#*#* your phone will enter a radio diagnostics tool where you can set your preferred network type and also select your radio baseband by using the 3 dots at the top. For my 5X i can select USA BAnd or Band mode 6, Band mode 7.
sorry if this is OT and not related to your issue.
Thank you for your input. However my phone does not have those options. Only USA band, which led to this week long stress for me. Im going to be able to get a replacement device in the end, so im happy about that, but this issue is unfortunately somewhat of a one way street wherin the usual simple solutions or even more complex adb, fastboot, etc etc things do not bring about any resolutions.
Again, thanks for trying to help but its a phone to phone kind of thing.
Marko
Best advice I can give. Don't mess with the basebands
zelendel said:
Best advice I can give. Don't mess with the basebands
Click to expand...
Click to collapse
Best advice ever...
But.... If you are really hot on getting the 5x into diagnostic mode to run QPST, QXDM, etc., do this. (I did this on my 5x to obtain the QCN file to check out the NV and EFS items, grab QXDM logs, etc.)
1. Use Heisenberg's most excellent step-by-step tutorial on unlocking the boot loader, rooting the phone, and installing super user apk.
2. Once rooted, connect the phone to a PC and open up adb, then issue the adb shell command.
3. Once in adb shell, type: su -c 'setprop sys.usb.config diag,adb'
4. At this point, you should see a pop up on the phone to authorize super user access. Click to allow access.
5. Now you will probably have to load a driver on the computer for diag access. I got lucky (since I have a mess of drivers on my computer) and the driver loaded automatically. As I recall, my computer selected qcusbser.sys. Seems to be a pretty generic QCOM driver vs. an LG specific driver.
6. You now have diag access. You will have to run steps 2 - 3 after each phone reboot. In other words, these steps aren't "sticky" between reboots.
7. ????
8. Profit
I did this and it worked for me.
clivemckracken said:
Best advice ever...
But.... If you are really hot on getting the 5x into diagnostic mode to run QPST, QXDM, etc., do this. (I did this on my 5x to obtain the QCN file to check out the NV and EFS items, grab QXDM logs, etc.)
1. Use Heisenberg's most excellent step-by-step tutorial on unlocking the boot loader, rooting the phone, and installing super user apk.
2. Once rooted, connect the phone to a PC and open up adb, then issue the adb shell command.
3. Once in adb shell, type: su -c 'setprop sys.usb.config diag,adb'
4. At this point, you should see a pop up on the phone to authorize super user access. Click to allow access.
5. Now you will probably have to load a driver on the computer for diag access. I got lucky (since I have a mess of drivers on my computer) and the driver loaded automatically. As I recall, my computer selected qcusbser.sys. Seems to be a pretty generic QCOM driver vs. an LG specific driver.
6. You now have diag access. You will have to run steps 2 - 3 after each phone reboot. In other words, these steps aren't "sticky" between reboots.
7. ????
8. Profit
I did this and it worked for me.
Click to expand...
Click to collapse
Please give me the global version of rfnv files:good:
Please give me the global version of rfnv files
Sorry, bro. I only have the values from my US version.

[Guide] How to flash the Open Market FFU for the IDOL4s Open Market 6071W

As we currently know it the open market FFU for the IDOL 4s will not flash properly to the open market model IDOL 4s phone. The below steps and attached files will allow this to change.
I was thankfully able to find this information due to a member over at 4pda who put together steps using the full engineering tool (link). They shared the link here to that post. Since I cannot attach the full files of that tool here due to size restrictions, I came up with an alternate method to share on this site and attach the needed files to flash.
This is a an alternate method to flash your open market IDOL 4s with the Open market FFU. You do this at your own risk. I personally feel it is relatively safe to use this method since we are in EDL (Emergency Download) mode anyway, yet even though I have done this now 4 or 5 times flashing an ffu to the IDOL 4s there is still a risk that something could go wrong. So I/we are not responsible if you kill your phone. The following directions assume you are running Windows 10 Creators update on the PC you are flashing from. If you need assistance downloading or installing the Qualcomm HS-USB QDLoader 9008 drivers you will need to look on the internet or search XDA forums. There are plenty of resources on that. The good thing is that when I tested it from my tablet for the first time the device showed up in device manager as QHUSB_BULK. I simply right clicked it in device manager and updated the driver to get the correct USB driver installed. It flashed fine after that. With that out of the way I can share the information to flash the open market ffu.
Make sure you charge your phone prior. To be safe 100%. This can be done at the minimum 40% charge or maybe 20% but that could be pushing it depending on the health of your battery.
--Obtain the open market ffu file
Download the open market firmware ffu from WDRT by opening the tool and selecting the open market IDOL 4s and advancing the steps/windows until it finishes downloading. Click cancel once done and close WDRT. By default it should download to C:\ProgramData\Alcatel\Packages\Products\6071W\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
--Download the attached Idol4S.zip
Download the attached zip file
In the attached zip file you will find the following:
Idol4S_PRO_WIN_NPRG7627.bin
rawprogram_6071w_OM.xml
emmcdl.exe
You only need to use the emmcdl.exe file and the bin file. Don't worry about the xml file for now.
--Setup the files for flashing
Extract them to their own folder. So for the sake of argument we have them here: C:\Idol4S\
There will be 3 files in the Idol4s folder. Next move the FFU file you downloaded previously to this folder for simplicity.
Now you will see 4 files there under C:\Idol4S\:
RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
Idol4S_PRO_WIN_NPRG7627.bin
rawprogram_6071w_OM.xml
emmcdl.exe
--Reboot your IDOL 4s into Emergency download mode.
Turn off your Idol 4s windows phone. Once powered down push and hold the volume Down Key in and keep it held in.
Next plug in the phone to the USB C cable connected to your PC.
It will vibrate but continue to hold the Down volume key for a second or two. You should see device manager recognize the phone as something like QHUSB_BULK or Qualcomm HS-USB QDLoader 9008.
If it shows up as QHUSB_BULK or something else you need to install the correct drivers in order for it to appear as QDloader 9008.
Once it shows as QDloader 9008 like the pic below. Write down the port number it shows up under...in my case COM3
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
--Flash the phone
Once in EDL mode open the folder where your 4 files for flashing are stored. Then either open a powershell prompt or command prompt Click File > Open Windows PowerShell or click File > Open Command prompt.
Begin to run the below commands:
from Windows PS --
Code:
.\emmcdl.exe -p com3 -f C:\Idol4S\Idol4S_PRO_WIN_NPRG7627.bin -ffu C:\Idol4S\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
from cmd --
Code:
emmcdl.exe -p com3 -f C:\Idol4S\Idol4S_PRO_WIN_NPRG7627.bin -ffu C:\Idol4S\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
The flashing takes a bit of time. You will see lots of output scrolling. Just leave the device and the screen alone for a bit until it finishes. Once it's finished the phone will reboot automatically.
If it stalls at he beginning or fails. Reboot your phone and put it into EDL mode again. Or reattach the usb cable and put into EDL mode again. Retry the command.
Again, to repeat, if you choose to do any of this it is at the risk to your own device. Thanks.
Did you ever try WPID for it?
djtonka said:
Did you ever try WPID for it?
Click to expand...
Click to collapse
I believe so. Tried ffutool.exe too.
Great tutorial Nate!
Easy to follow and working without a glitch.
Just a remark for those who might think that this could sim-unlock their 6071W - IT DOES NOT!
While it will load the Open market FFU the model reported is still 6071W, still locked to TMO and WDRT will still not recognise it to load Open market sw.
the sequence for 9008 mode is Vol_dn & Power
compu829 said:
the sequence for 9008 mode is Vol_dn & Power
Click to expand...
Click to collapse
If I plug the phone in while it is powered off, and push only both volume rocker buttons in at the same time it will go into edl mode every time. I dont think I tried both the power and volume down keys though. If that works too, then good.
nate0 said:
If I plug the phone in while it is powered off, and push only both volume rocker buttons in at the same time it will go into edl mode every time. I dont think I tried both the power and volume down keys though. If that works too, then good.
Click to expand...
Click to collapse
If you are starting it with the phone off, just hold VolDn while plugging it into the computer.
Thanks for double checking this. I updated the post with that small detail .
Folks, here is the tool that helped me acquire the loader file for this phone. The tool packages are greater than 30MB so I had to share a link for them. Someone might find this useful. It was originally hosted on the 4pda forums, so the credit goes to those guys over there for making this tool available. The tool can also reflash the OpenMarket Idol4s. It basically works by building a compressed exe file from the FFU based on the model you chose (Idol4Pro). You launch that newly made exe file and it opens as a flashing tool. You put your phone into EDL mode and the tool then can flash the phone. Link
Model of alcatel idol 4s is: ALCATEL IDOL 4S with Windows 10 NA
If I connect my idol 4s to WDRT & select 'Open Market' from the list and proceed, in firmware line it says firmware version: unknown. [for Device]
available firmware on server: 1052.16.09031.50700
How to proceed? Thanks.
sco1984 said:
Model of alcatel idol 4s is: ALCATEL IDOL 4S with Windows 10 NA
If I connect my idol 4s to WDRT & select 'Open Market' from the list and proceed, in firmware line it says firmware version: unknown. [for Device]
available firmware on server: 1052.16.09031.50700
How to proceed? Thanks.
Click to expand...
Click to collapse
Are you trying to flash your device from WDRT? What have you done so far, what are you trying to do?
nate0 said:
Are you trying to flash your device from WDRT? What have you done so far, what are you trying to do?
Click to expand...
Click to collapse
@nate0 : As per the instructions in this thread I am trying to =
Download the open market firmware ffu from WDRT
Click to expand...
Click to collapse
My device has same firmware version as on server.
So the question is do I need to download that file to proceed with rest of the process?
The reason I want to flash my device using better/different firmware is because WhatsApp web isn't working in my phone.
Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code.
However 3rd party application is able to scan whatsapp web QR code.
sco1984 said:
@nate0 : As per the instructions in this thread I am trying to =
My device has same firmware version as on server.
So the question is do I need to download that file to proceed with rest of the process?
The reason I want to flash my device using better/different firmware is because WhatsApp web isn't working in my phone.
Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code.
However 3rd party application is able to scan whatsapp web QR code.
Click to expand...
Click to collapse
Alcatel only has one fw revision per device variant. Each has the same issue which you list...Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code. You can change fw but I doubt that will fix your issue as each variant faces that whatsapp issue even the Idol 4 Pro EURO variant.
I tried to get into Emergency Download Mode.
Q1: Instead of "QHUSB_BULK" or "Qualcomm HS-USB QDLoader 9008" I only see "Care Suite Emergency Connectivity". What should I do?
Q2: Once Q1 is solved, can I use VMware running Windows 10 Creators update? Because it says it's assumed to run that. Also I have Windows 7 on my machine; that's why I should use the Virtual Machine
dyasten said:
I tried to get into Emergency Download Mode.
Q1: Instead of "QHUSB_BULK" or "Qualcomm HS-USB QDLoader 9008" I only see "Care Suite Emergency Connectivity". What should I do?
Q2: Once Q1 is solved, can I use VMware running Windows 10 Creators update? Because it says it's assumed to run that. Also I have Windows 7 on my machine; that's why I should use the Virtual Machine
Click to expand...
Click to collapse
For Q1 you might try to right click it in device manager and Update the Driver manually. Or let windows search for a better driver...
For Q2, technically you can as long as your HW supports virualizaion which is enabled in the bios (whole other topic...)
nate0 said:
For Q1 you might try to right click it in device manager and Update the Driver manually. Or let windows search for a better driver...
For Q2, technically you can as long as your HW supports virualizaion which is enabled in the bios (whole other topic...)
Click to expand...
Click to collapse
I managed to get Q1 working. Thanks
I asked a friend to borrow his computer running the latest Windows 10 update. Should I use his computer? He will bring it this weekend. Or do I really need the Windows 10 Creators update?
@dyasten
With emmcdl.exe do a test first.
emmcdl.exe -l ::: this should list devices it sees and you should see your port COMxx...or whatever the COM number is.
emmcdl.exe -p COMxx -f <Idol4S_PRO_WIN_NPRG7627.bin> ::: this should result in just a command complete. All it does is load the programmer and look for a repsonse.
If those work, I would assume you are good to flash the phone at that point. I will leave it up to you to decide on using a W10 pc or not...
nate0 said:
@dyasten
With emmcdl.exe do a test first.
emmcdl.exe -l ::: this should list devices it sees and you should see your port COMxx...or whatever the COM number is.
emmcdl.exe -p COMxx -f <Idol4S_PRO_WIN_NPRG7627.bin> ::: this should result in just a command complete. All it does is load the programmer and look for a repsonse.
If those work, I would assume you are good to flash the phone at that point. I will leave it up to you to decide on using a W10 pc or not...
Click to expand...
Click to collapse
I got command complete on my current Windows 7. It was on COM6. I did shift + right-click in the folder and opened cmd; there I did:
Code:
emmcdl.exe -p COM6 -f Idol4S_PRO_WIN_NPRG7627.bin -ffu RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
It flashed succesfully I think:
Code:
<log value="Finished programming start_sector 122142720 and TotalSectorsToProgram 256"/>
</data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="ACK" rawmode="false" />
</data>
Status: 0 The operation completed successfully.
The reason I wanted to flash is because I want Dutch language on my phone. But after succesfully flashing I still don't see Dutch. How could I get the Dutch (Belgian) language pack?
You should be able to load the language pack cab file if it is missing by using iutool. What region are you residing in? If you are in Europe I guess you could flash the Idol 4 Pro variant ffu which I believe should have that language pack already packed in, but you would need to confirm that first...
Edit: There are 3 variant FFUs for this phone. The T-Mobile US / Open market / Idol 4 Pro
I flashed your ffu open marked there is no Dutch in it. Where to download the cab? I'm from Belgium, language is Dutch/Flemisch

[GUIDE] Restoring IMEI and EFS after erasing or corrupting (No backup needed)

OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
fastboot erase modem st 1
fastboot erase modem st 2
Click to expand...
Click to collapse
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
BlazingBullets said:
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
Click to expand...
Click to collapse
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Greatuser123 said:
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Click to expand...
Click to collapse
No no, please do not think I meant you by that. It was other users (understandably) that questioned my motives before you. I absolutely would have taken you up on your offer if I did not already have the phone on the way Either way, I really appreciate your help during this, and I hope you continue to help other users the same way you did for me.
decrypterfixer said:
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Click to expand...
Click to collapse
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
BlazingBullets said:
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
Click to expand...
Click to collapse
I can help u
Well done mate you will be a hero someday haha good job ?
Leevii2208 said:
I can help u
Click to expand...
Click to collapse
Please provide your support ouvertly here and not via social media!
I've edited your post; please refer to https://forum.xda-developers.com/oneplus-5t/how-to/telegram-chat-channels-forward-t3765018
not work
ty but not working or i did wrong. i wrote (change my imei, two way u and other program) and post new "good.qcn" (i see finished in QPST Software). i restart phone but nothing change. i think phone in document just "read-only".
I want redmagic 3 qcn file
good job bro
Is it works for rog phone 3?
I can't find that hex
hello friends 08 3A 85 99 99 99 99 99 99 no found please help me
Hi, perfect post friend. Im try backup qcn to my Rog Phone 3, but when try said Satuts: Memory Backup Failer and Errors: Disr Error while write to file, any solution to this? I appreciate your help.
decrypterfixer said:
OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Click to expand...
Click to collapse
I tried it till finish, but when I check, I lost my wifi mac address (status unavailable) and my imei still unknown. And now I wanna retry, I stuck at QPST Configuration application at step 17, it sometimes detected the phone, sometimes don't, it make me can't continue to click "star clients", (check in device manager, nothing wrong). can you help me?
sure which device rog 2 or 3?
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
uhhg that's a issue just download visual c++ redistributable 2010 sp1 x86 and it should be fine
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
Rog2. The port keep blinking when in QPST Tools, sometimes it detected, sometimes don't, so I can't copy the qcn to the phone. And also I don't know what's wrong with the qcn, I had follow the instruction, but it not works
hmmm use another pc or cable.
gjkhan said:
hmmm use another pc or cable.
Click to expand...
Click to collapse
Try itt but problem still persist

OnePlus 8 Pro (EU) - Repair from scratch guide... SMT - QC Flash, IMEI repair, fingerprint...

AS LONG AS PHONE CAN BE TURNED ON - WHETHER IT IS RECOVERY, FASTBOOT, QUALCOMM CRASHDUMP OR SOMETHING SIMILAR YOUR DEVICE CAN BE FIXED...
WARNING:
Regarding QC MSM Flash tool - make sure you back up persist.img before flashing device otherwise you won't be able to recover fingerprint sensor...
Regarding QC SP IMEI Write tool - You can only use IMEI that is on the box...
Your data will be lost, obviously...
This guide is for EU devices (download links have EU firmware), but it is applicable for other as well as long as you have required firmware...
Required stuff:
Download from GDrive
Passwords:
IMEI TOOL: ustest
MSM TOOL: te123
1.) Make sure to back up EFS, if you don't you will lose ability to make or receive calls.
If you didn't backup EFS that's not problem, I found temp. solution... After doing MSM SMT clean installation your imei wil be 0 but you will be able to make calls. At this point you MUST BACK UP: mdm1m9kefs1, mdm1m9kefs2, mdm1m9kefs3 and mdm1m9kefsc...
After updating your IMEI and OS to latest version you will lose ability to make or receive calls but, you can than do:
fastboot flash mdm1m9kef
fastboot flash mdm1m9kef
fastboot flash mdm1m9kef
fastboot flash mdm1m9kefsc
fasboot flashing lock_critical
...and boom your device is now fixed!!!
1. A) Backing up persist.img DIFFICULTY: 3/5
Download and extract: MSM TOOL 10.5.4, open "MsmDownloadTool V4.0.exe" -> Other -> Next
We're just gonna flash your OS so do not use SMT mode yet (If you don't know what is SMT mode then just follow steps)
Click on TARGET and select EU, click start and wait for it to say "Waiting for device", now when your device is powered off, hold volume up and volume down button and connect it to the cable, MSM should now start flashing your OS
After it's completed (around 5 minutes) you will be able to boot into OS, go to developer options (after setting up device), go to developer options and enable "OEM Unlocking"... Now update your system using local files: UPDATE 10.5.5 on GDrive (extract it, you are gonna find OnePlus zip FullOTA and magisk boot.img) and reboot to fastboot after update, connect your phone to adb and do "fastboot flash boot <magisk.img - from gdrive>" now set up magisk.apk and make sure root is working, go back to adb on your computer and run these commands:
adb shell
su (there will be pop-up and you need to grant root access to shell)
adb shell dd if=/dev/block/bootdevice/by-name/persist of=/tmp/persist.img
Now store that persist.img to your pc
1.B) If your device looks like this and you didn't back up persist.img you will have to play around because I don't know if you can get your fingerprint sensor back without it but if you do please let us know in the comments, you will need to flash using SMT mode...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
To flash it via SMT, you need to open MSM V4.0 and click Verify, after you get MD5 Check... you need to click on SMT download mode
and now press SMT on top
then COM Setup and enable your ports. After you click start it will ask you for password: te123, and also you need to put your original storage size, now press volume up and down on your device and connect it to pc...
Your system will be flashed on chipset level...
2. Repair fingerprint sensor DIFFICULTY: 3/5
Follow steps on this video: Fingerprint Repair
But instead of holding finger on all test except BLACK RUBBER test, you need to hold it only when testing FLESH RUBBER, do not cover sensor with anything on other tests. And you should get red error saying: FAIL GF ERROR BAD POINT CLUSTER... and now you can proceed with copying data and engineermode to persist via root explorer (in GDrive) just like in the video...
3. Repair IMEI DIFFICULTY: 4/5
Download IMEI repair, open settings and input password: ustest, enable dual IMEI and write MEID as well... apply settings and connect your device,
go to dialer app and enter *#801# enable Diag,Adb and Serial, go to GDrive and download QC Important Driver.zip
Go to device manager and you should see your phone in COM/LPT section, IN2023 or something like that... There could be like two devices IN2023 and you must install this driver on both! Right click on it and select update driver, Browse computer>Let me pick...>Show All> Have disk and now go to qcser.inf_amd64 and select qcser.inf and click OK, from all the drivers from the list you need to select Qualcomm HS-USB Diagnostics 90B6 and now go to IMEI write tool and click Write. Your IMEI should now be written... You can go back to *#801# and disable diag,adb serial and you just need to restart device to reload new IMEI
Sources:
Repar IMEI
Fingerprint Repair
vrabaci said:
Qualcomm HS-USB Diagnostics 90B6
Click to expand...
Click to collapse
@vrabaci Can you specify the right Driver for the IMEI WRITE tool? There is no "Qualcomm HS-USB Diagnostics 90B6" , only "Qualcomm HS-USB MDM Diagnostics 90B6". "MDM" is missing from your post. Is that the right one?
I tried with this and IMEI WRITE tool say "Connecting to smart phone".... then Fails with timeout. It doesnt connect.
Can you help with connection?
mimix2ppp said:
@vrabaci Can you specify the right Driver for the IMEI WRITE tool? There is no "Qualcomm HS-USB Diagnostics 90B6" , only "Qualcomm HS-USB MDM Diagnostics 90B6". "MDM" is missing from your post. Is that the right one?
I tried with this and IMEI WRITE tool say "Connecting to smart phone".... then Fails with timeout. It doesnt connect.
Can you help with connection?
Click to expand...
Click to collapse
Yes that is the correct driver, check if there is another IN20223 in device manager there should be one in COM&LPT and one should appear like IN2023 or OnePlus (with yellow triangle), click on it and update driver to MDM906B
vrabaci said:
Yes that is the correct driver, check if there is another IN20223 in device manager there should be one in COM&LPT and one should appear like IN2023 or OnePlus (with yellow triangle), click on it and update driver to MDM906B
Click to expand...
Click to collapse
I did that many times... I still cannot connect....
setprop sys.usb.config diag,adb,serial​​OR *#801# , enable Engineer Mode and Serial​​both ways, no result.... write tool doesnt connect.​​Maybe the setprop doesnt work right? How do I check it?​​is there Another Write Tool I can use?​​also. I have a MEID found from system logs. but it says Parity Bit Error. does it mean that the MEID I found is wrong? is MEID necessary to have a working phone for sim/calls ?​​Also. what is interesting. Fingerprint works, persist.img survived the flashes. but IMEI and MEID etc are all wiped out. ​​any ideas...​
you should enable only serial and diag,adb, rest of them should be disabled...
i also used only this tool but i've been unsuccessful in finding new one
I
mimix2ppp said:
I did that many times... I still cannot connect....
setprop sys.usb.config diag,adb,serial​​OR *#801# , enable Engineer Mode and Serial​​both ways, no result.... write tool doesnt connect.​​Maybe the setprop doesnt work right? How do I check it?​​is there Another Write Tool I can use?​​also. I have a MEID found from system logs. but it says Parity Bit Error. does it mean that the MEID I found is wrong? is MEID necessary to have a working phone for sim/calls ?​​Also. what is interesting. Fingerprint works, persist.img survived the flashes. but IMEI and MEID etc are all wiped out. ​​any ideas...​
Click to expand...
Click to collapse
If you put your IMEI1/imei2 and MEID from the box it should not give any parity errors, also don't check save to access database and also I had IMEI 0 and MEID 0 and I could make calls so I don't think it's really required but I have no idea how that system works...
vrabaci said:
If you put your IMEI1/imei2 and MEID from the box it should not give any parity errors, also don't check save to access database and also I had IMEI 0 and MEID 0 and I could make calls so I don't think it's really required but I have no idea how that system works...
Click to expand...
Click to collapse
I dont have the box........ only what I find from filesystem.....
can you check this file in your phone /mnt/vendor/persist/engineermode/engineermode_config to see if the IMEI there is the correct IMEI1 of your phone?
can you check /data/opdiagnose and search for "meid" with ripgrep https://github.com/BurntSushi/ripgrep , "rg -i -M 1000 meid" command. is the meid in these logs the same as your real MEID?
also. How long was "Connecting to the smart phone" in Write Tool for you? or was it instant for you?
how did you find the right driver qcser.inf_amd64_da2bdde674bc3d1e ? there are too many drivers in your zip...
what choice in USB Preference? No data transfer, or USB Tethering, or File Transfer?
mimix2ppp said:
I dont have the box........ only what I find from filesystem.....
can you check this file in your phone /mnt/vendor/persist/engineermode/engineermode_config to see if the IMEI there is the correct IMEI1 of your phone?
can you check /data/opdiagnose and search for "meid" with ripgrep https://github.com/BurntSushi/ripgrep , "rg -i -M 1000 meid" command. is the meid in these logs the same as your real MEID?
also. How long was "Connecting to the smart phone" in Write Tool for you? or was it instant for you?
Click to expand...
Click to collapse
Sorry, I sent my device to repair to CTDI because they perform such repairs:
And then those incompetent idi**s sent me this:
mimix2ppp said:
what choice in USB Preference? No data transfer, or USB Tethering, or File Transfer?
Click to expand...
Click to collapse
File transfer is required for IMEI writing to work I believe...
mimix2ppp said:
I dont have the box........ only what I find from filesystem.....
can you check this file in your phone /mnt/vendor/persist/engineermode/engineermode_config to see if the IMEI there is the correct IMEI1 of your phone?
can you check /data/opdiagnose and search for "meid" with ripgrep https://github.com/BurntSushi/ripgrep , "rg -i -M 1000 meid" command. is the meid in these logs the same as your real MEID?
also. How long was "Connecting to the smart phone" in Write Tool for you? or was it instant for you?
Click to expand...
Click to collapse
Connecting to the smart phone was instant...
mimix2ppp said:
how did you find the right driver qcser.inf_amd64_da2bdde674bc3d1e ? there are too many drivers in your zip...
Click to expand...
Click to collapse
Driver qcser is under:
necesito una copia del qcn del in2025 oneplus 8 pro me quede sin imei
I need a copy of the qcn of the in2025 oneplus 8 pro I ran out of imei
vrabaci said:
Make sure to back up EFS
Click to expand...
Click to collapse
I don't know how to do it
Hi, I hv one plus 8 tmob. In converting to global ans dual sim I tried to repair IMEI and the tool I used messed up efs I think. Now it doesn't repair IMEI neither any network. In just a locked state. I want to use your guide but it is for eu and my bootloader is locked too. I hv unlock token but after that mess my OEM unlock is grayed too. Any suggestions

Categories

Resources