Develop Bugs

[Q] Corrupted/Bad/Invalid IMEI -- looking for another option.

Thank you for the read-visit.
I recently bought a second hand Tmobile Samsung SGH-T889 Galaxy Note II. Unfortunately,
I inherited a host of issues. The IMEI is corrupted. In this thread, I'm hoping to figure
out why I can't successfully write to the device. I will list everything that I've tried so far,
and to be honest, I really don't know what I can try next. Share your input please!
SGH-T889
Build Version: M9615ACEHWMAZD17513035
Version Dir ;: ACEFWMAZ
Firmware: T889UVALK8:_(4.1.1) (12/19/12) [FACTORY IMAGE]
Preface:
I read in a few other threads where people were having issues with the 4.1.2 firmware, so
I elected to downgrade to the 4.1.1 using a factory image by flashing using Odin 3.0.7.
I then used "Galaxy Note2 Toolkit" to flash root of the device while also including clockworkmod
recovery and busybox.
First Method:
After downloading and installing the Android Terminal Emulator, I tried to enter
the following code to write to the device:
su
echo 'AT +EGMR=1,7,"IMEI_1"'> /dev/pttycmd1
The device accepted the commands, but the write never occurred.
On the web, this solution is everywhere; however, I think that the
solution is specifically for MTK phones. In fact, the output command
"pttycmd1" isn't in the /dev directory or anywhere within the root file structure.
Second Method:
Accessing the hidden menu on the phone by entering *#7284#, I modified
the Qualcomm USB settings to allow for a serial USB connection.
I then used the "Qualcomm NV Tools," included in the fourth tab of EFS Professional
development software, to restore the backup IMEI to the device at the memory block located
at decimal address 550. The device accepted the command and I received
no indication of error, but the device was again not overwritten.
Third Method:
I installed RootExplorer application and used this tool to access the root directory and made
a copy of the EFS folder where I assumed the IMEI is stored. I then deleted the folder allowing
the system to recreate the EFS Folder after a reboot and a factory reset. I repeated the
previous methods, but I wasn't able to make a difference. Consequently, I restored my EFS folder.
Fourth Method:
I tried messing around with permissions allowing for read/write for the "efs" and "factory" folders
within the root file structure. Notwithstanding, I also expanded my read/write changes to the /dev/block folder focusing in particular on /dev/block/mmcblk0p3. (I read in another thread that the IMEI was stored in this block
/dev/block/mmcblk0p3.) Changing ownership of the files "owner" and "group" to root, I then tried writing to the device again using the previous methods mentioned, as well as fiddling around with another software called
"NV-items reader_writer v1.0," but all these approaches failed too.
Just as an added comment, I think that file manager such as Root Explorer re-mounts a read only root file
structure as a floating read/write. Therefore, while I think that I'm making changes to permissions -- I am, because I can see the change occur -- this change is actually temporary until the device is rebooted.
General Comments:
I suspect the GSM US variant of the Galaxy Note II is different, because I can't explain
why the device will not update the IMEI even with superuser rights. Along the way, I tried to
do a factory reset as well, but remember this approach made little difference since the device
was near factory settings from the onset since I just downgraded to 4.1.1.
Questions
Am I missing another method? please point me in the correct direction -- I'm stumped.
I value and appreciate any input in advance that you could lend.

when you first bought the phone and put in your t-mobile S I M card in it..
what happened .
are you sure its not a blocked imei phone.
this seems to be going around...
are you trying to use it on t- mobile ..
please post the original issue not just want you done to try and fix it..

Thank you for the reply.
This problem stinks.
I don't have a tmobile sim card. The phone is for Tmobile and I hope to use the phone on T-mobile's MVNO (mobile network virtual operator) SimpleMobile, a carrier that piggybacks on the Tmobile carrier. I have Simplemobile SIM card, which the device does not recognize. The network in the "About Phone" in Settings is listed as Unknown. I think that the phone is locked, but I thought that this issue is exclusive of my present dilemma.
So, what is preventing me from writing an update to the device? There are a couple of good Qulalcomm
tools on the market like DFS CDMA ver. 4.7.0.2 and Qualcomm NV Tools, but both of which
fail to restore the IMEI. Is this a CDMA vs GSM tool interface issue?
Where is the IMEI stored on the device? My efs/imei folder only has one file: "mps_code.dat"
(I guess NV_DATA.BIN file is not present for LTE users.)
Thanks again, in any case.

If I were you, I'd try writing the T889 NV backup from the AWS mod thread with QPST or QXDM. Then finish off with the IMEI using EFS Professional.
As you've noticed, no NV_DATA.BIN for our devices. The /efs partition isn't enough of a backup to fix things.
Information applicable to the N7100 is going to be useless here since it has an Intel baseband, as opposed to the LTE variants which run on a Qualcomm chip.

Darkshado said:
If I were you, I'd try writing the T889 NV backup from the AWS mod thread with QPST or QXDM. Then finish off with the IMEI using EFS Professional.
As you've noticed, no NV_DATA.BIN for our devices. The /efs partition isn't enough of a backup to fix things.
Information applicable to the N7100 is going to be useless here since it has an Intel baseband, as opposed to the LTE variants which run on a Qualcomm chip.
Click to expand...
Click to collapse
Thank you Dark Shado[w].
Fifth Method:
I used QPST configuration to establish a serial connection. Using one of the software's client applications called
QPST Software Download, I made a backup of NV Memory Files and then used a hex editor
to locate the IMEI number (offset 00001700 --fyi) and made the repair. However, when I attempted to restore the
file using QPST Software Download, the software failed to update the device. Take note that the software indicated the memory restore worked. However, again, I'm not sure what is preventing me from writing to the device.
Every editor or tool that I have used to interface with the device successfully reads the device but does not write.
In the Qualcomm USB Settings, I have chosen either "RNDIS + DM + Modem" or "DM + MODEM + ADB" settings.
I also try to make sure that "USB Debugging" is checked in "Developer options" in Settings. (This
setting appears to toggle depending on which USB serial setting is chosen.)
I began messing around again with EFS Professional. The problem with this approach is that the backup file is stored in the form of an image file. Unfortunately, I can't edit the image to repair the IMEI with a hex editor.
Previously the backup file was in the form of a bin or text format making the process of editing easy.
I also confirmed indeed that the address location of the efs folder including the IMEI is recorded in /dev/block/mmcblk0p3 for Galaxy Note II LTE variants.
Any other ideas? Is there any other toolkits that might be easier to work with?

Hey since you already odin 4.1.1 go ahead and unlock your phone using the free unlock method. Than try using your simple mobile sim again.

G7Baker said:
Hey since you already odin 4.1.1 go ahead and unlock your phone using the free unlock method. Than try using your simple mobile sim again.
Click to expand...
Click to collapse
Hi G7Baker. Thank you for the reply.
I was not able to unlock the device using the *#197328640# approach.
The device is missing the "Press [4] NW LOCK NV DATA INITIALLIZ"
I read elsewhere that I needed to downgrade the device to 4.1.1 and this option
would reappear in the menu settings. Specifically, if I downgraded the modem from
4.1.2 to 4.1.1, this option would again appear. In my case, the option is still missing.
I figured that I would just focus on my corrupt IMEI before addressing the locking issue...but if you any ideas,
i am open.

I'll be blunt: you haven't listened to anything I've said.
Use the .qcn file from the AWS mod thread. Not yours hex-edited to contain your IMEI. You NV items are already messed up.
Toggling USB Debugging might undo the "RNDIS + DM + Modem" setting.
Use EFS Professional to type in (not copy-paste, it's a quirk in the UI) your IMEI, then write it. Make sure you've got the latest version, and that you're using the Qualcomm tools. Or hex-edit the file from the AWS mod thread since you're capable of doing so.
Ditch this "toolkit" mindset and get their actual components, latest versions, straight from the devs. You'll be able to check for issues in their respective threads as well.
Good luck,
Darkshado

Darkshado said:
I'll be blunt: you haven't listened to anything I've said.
Use the .qcn file from the AWS mod thread. Not yours hex-edited to contain your IMEI. You NV items are already messed up.
Toggling USB Debugging might undo the "RNDIS + DM + Modem" setting.
Use EFS Professional to type in (not copy-paste, it's a quirk in the UI) your IMEI, then write it. Make sure you've got the latest version, and that you're using the Qualcomm tools. Or hex-edit the file from the AWS mod thread since you're capable of doing so.
Ditch this "toolkit" mindset and get their actual components, latest versions, straight from the devs. You'll be able to check for issues in their respective threads as well.
Good luck,
Darkshado
Click to expand...
Click to collapse
Thank you Darkshado[w] for the advise.
Game plan
qcn generic file (binary format) --> modify imei in qcn generic file --> EFS Professional-Qualcomm (fourth tab) to apply Restore
Darkshado[w], I'm looking at the EFS Professional -- Qualcomm tab (fourth tab). Just to be clear, this tab has a
"Qualcomm NV Tools" button, to which I don't proceed. This tab has also a set of "NV Backup" and "NV Restore" functions. These functions are supported for US variants only. (The T-mobile T889 has a Qualcomm chipset Gobi MDM9215, making the device eligible, right? or I guess these tools are meant only for Sprint and Verizon variants only) These tools, I believe, are where you would like me to use to make my restoration possible.
Just to be clear, this Restore/Backup receives a binary file, opposed to "Qualcomm NV Tools" that receive a text file.
However, when I click on "NV Backup" or "NV Restore," the phone immediately reboots.
On the same page the following disclaimer is written "If these functions are not supported your phone will just reboot." My device rebooted and I can't use this approach for the moment.
---
I was searching the AWS thread to which you alluded.
On December 28, 2012, I saw that you posted a full NV backup, IMEI removed, at the following thread:
http://50.23.216.69/showthread.php?t=2068041&page=2
I downloaded your attachment and modified the TEXT file to include my repaired IMEI for the T889 and then used
EFS Profressional via "Qualcomm NV Tools" to restore to my device.
I made sure that the device was set for a USB serial connection,
since "Qualcomm NV Tools" would not make the SPC connection otherwise.
The restore procedure completed without any errors, but the device was not successfully written to...again.
---
I also downloaded the ATT_I317_AWSMOD_dumimei.qcn file from the thread. Using QPST via their client application "Software Download" I attempted to make the restoration.
I attempted the restoration twice using "RNDIS + DM + Modem" and "DM + Modem + ADB" settings. In the phone utility menu, UART was always set to "PDA" and USB was set to "PDA" as well. In both cases, the device was not written. The software indicated that the restoration was successful when in fact this case was untrue.
--
On the EFS Professional version2.0.062, I was able to generate backup files using the backup option located on the second tab.
For this backup option, I selected "International LTE Variants" for the "Device Filter." The software
generated one tar.gz file; however, when extracted, a efs.img file and four other bin files are revealed. Unfortunately, the image file of efs contains my corrupted IMEI, which I'm not sure how to edit. I tried to use Hex Workshop Hex Editor to edit the file but can't find the IMEI in this type of file. Alternatively,
is there a generic backup tar.gz of SGH-T889 that I can try to restore?
--
What are your thoughts? Please advise.

garbageslot said:
Hi G7Baker. Thank you for the reply.
I was not able to unlock the device using the #197328640# approach.
The device is missing the "Press [4] NW LOCK NV DATA INITIALLIZ"
I read elsewhere that I needed to downgrade the device to 4.1.1 and this option
would reappear in the menu settings. Specifically, if I downgraded the modem from
4.1.2 to 4.1.1, this option would again appear. In my case, the option is still missing.
I figured that I would just focus on my corrupt IMEI before addressing the locking issue...but if you any ideas,
i am open.
Click to expand...
Click to collapse
I later downgraded the firmware from T889UVALK8 to T889UVALJ1 of 4.1.1. The NW LOCK NV DATA INITIALLIZ
finally appeared and was able to unlock the device successfully. Awesome!
However, I'm still trying to figure why my NV Memory Block refuses to be written. Please share your input!

No solution ... yet.
I tried deleting the efs folder and then I went back through all the methods that I have discussed
really to determine if and when the device was being written. Trying to restore the efs folder from a backup
copy, my findings seem conclusive.
I found that the ONLY solution that replaced my efs folders was EFS Professional--Restore (third tab).
In my case, I'm just restoring my corrupt NV memory backup back onto the device, but this approach can
work for me. In all other methods that I employed, the device and software indicated that a successful update was
made but these cases are untrue; the device is not updated.
Where does this leave me? If I am going to flash my device using this restore feature of EFS Professional(third tab),
I need to flash a modified efs.img that is corrected for my corrupted imei.
Does anyone have a solution out there for the SGH-T889?

garbageslot said:
I later downgraded the firmware from T889UVALK8 to T889UVALJ1 of 4.1.1. The NW LOCK NV DATA INITIALLIZ
finally appeared and was able to unlock the device successfully. Awesome!
However, I'm still trying to figure why my NV Memory Block refuses to be written. Please share your input!
Click to expand...
Click to collapse
I learned today that someone claimed that this SGH-T889 device has a hardware security measure in place. The device has a chip that has the IMEI that is write/no-rewrite (eMMC?); therefore, successful service combines both a hardware and software approach. My "deep throat" operative also said that the IMEI for this particular device appears in five different places within the NV Memory block, making the repair not so trivial.
Can anyone confirm this statement? I can't find anywhere where this statement is validated.

I would have to call bulls..t on that, I lost my imei flashing a tmobile modem to get lte and was able to rewrite my imei and get it working. Took me 2 days and lots of messing around but finally worked.
http://forum.xda-developers.com/showthread.php?t=2068281
You can try this link has some valuable info and links.

rail205 said:
I would have to call bulls..t on that, I lost my imei flashing a tmobile modem to get lte and was able to rewrite my imei and get it working. Took me 2 days and lots of messing around but finally worked.
http://forum.xda-developers.com/showthread.php?t=2068281
You can try this link has some valuable info and links.
Click to expand...
Click to collapse
Thank you Rail205 for your reply. Reviewing the thread that you sent,
I'm still not sure how I should proceed.
I was comparing my device allocation using the df command on the android emulation terminal .
# df
My partition allocations are consistent with jravi and darkshado[w] on the first page of the thread,
so I'm wary if I flash with an updated PIT file that this approach will make a difference.
My device is reading the correct internal storage for example.
To reiterate, if the block allocations are the same, can I assume that using a new T889V pit file
on my device the T889 will make no difference?
Currently, my device is now unlocked, rooted with a 4.1.2 OS.
The device has radio service.
Unlike everyone else who has been successful e.g. Darkshado[w] who has successfully
written an editable hex file or text file (depending on the method employed), my
device remains unmodified when performing approaches of this kind.
The only method that appears to work for me is flashing an image file
using EFS Professional (third tab).
This dilemma is the chicken / egg conundrum, how do I flash the device with the corrected img file
when I don't have a copy of an img file with the corrected imei with which to flash? Otherwise, considering
a no-img file approach, I could try to make the partitions writable (fyi I have used Root Explorer already to modify
the permissions of /dev/block, /efs and /factory before attempting an update -- you guessed it, no luck.)
Anyone, any thoughts? Anyone?

Success!
Sixth Method
NOTE: Please also refer to "Six Method. Addendum" post #21 located later in this thread. Both posts are critical to understanding the complete solution.
Well, I decided to go to one of these guys who advertise on Craigslist to repair corrupt IMEI. He claimed that he was using one of these boxes that reads and writes without technically flashing the device.
I sat with him for a couple hours, and, in the end, he could not do it! My IMEI went from some corrupted output to reading simply "0/9." At that point, I had limited phone service and mobile data EDGE only. The device had trouble finding the DM mode as well. (He felt so bad that he couldn't take my money, but this moment was also a validation for me that my device had a very specific problem, not a trivial contest in the least, but an awesome validation that this last week's efforts were not in vain: If the 'expert' can't figure this out, then where would this leave me?)
An important note worth mentioning is that the Craigslist guy downgraded my android OS from 4.1.2 prior to making modifications. Unfortunately,
I did not note to which version and build he downgraded. (My guess: most likely a build variation of 4.1.1 OS)
Anyhow, so I returned home and decided to get to work and access the phone through the service mode with the intention of rebuilding the NV memory block.
*#197328640#
[1] UMTS
[6] Common
[6] NV REBUILD
[1] Load defaut NV
This approach changed my IMEI from "0/9" to "0/0." Now, when I tried connecting to the device, the software read the correct DM Mode. (Interestingly, I still received limited phone service.)
I used a program called "NV-items reader_writer v1.0." Of the many programs that I tried, this program is super simple since the software output is text based i.e. you don't need a hex editor. The download link is here.
http://modemfiles.blogspot.com/2013/09/download-free-nv-items-reader-writer.html
I extracted the memory block from decimal address 550 to 550 and modified the block to read my non-corrupted IMEI. (I didn't need
to change root permissions or anything complicated like that, steps I performed in some of my previous method-approaches.)
My device finally was written and read the correct IMEI!
Thank you to everyone who contributed. My success is your own!
UPDATE:
So, as I mentioned above that I was receiving EDGE only and the carrier service was spotty. In the end, I realized that my NV Build was corrupted, and since I was now able to write to the device, I corrected this problem by referencing Darkshado[w]'s post.
On December 28, 2012, I saw that he posted a full NV backup for the T889, IMEI removed, at the following thread:
http://50.23.216.69/showthread.php?t=2068041&page=2
UPDATE: XDA admins have invalided the hyperlink to Darkshado[w]'s original post. If you require the text file, private message me with your email
and I will send you the same template file that he had originally made available. (edited 7/18/2015)
Using "NV-items reader_writer v1.0," I wrote to my device using the file provided by Darkshado[w]. Again just to be clear, I restored the entire NV build and only changed the IMEI block, which is located at decimal address 550. Now, my device is finally getting reliable connectivity at 4G speeds (only 4G, opposed to LTE, since I'm using a MVNO instead of a direct Tmobile plan). Anyways awesome still!

I'm glad you fixed it man!..you went through Hell fixing your phone.
I ALWAYS read and follow these "bad IMEI" threads to learn something "just in case" and I must say that your case it's the most complex (for me anyways) I've ever read.
Cheers to you!

New link to file please
garbageslot said:
Success!
Sixth Method
Well, I decided to go to one of these guys who advertise on Craigslist to repair corrupt IMEI. He was using one of these boxes
that reads and writes without technically flashing the device.
I sat with him for a couple hours, and, in the end, he could not do it! My IMEI went from some corrupted output
to reading simply "0/9." I had limited phone service and mobile data EDGE only. The device had trouble finding the DM mode as well. (He felt so bad that he couldn't take my money, but this moment was also a validation for me that my device had a very specific problem, not a trivial contest in the least, but an awesome validation that this last week's efforts were not in vain: If the 'expert' can't figure this out, then where would this leave me?)
Anyhow, so I returned home and decided to get to work and put the phone into a service mode with the intention
of rebuilding the NV memory block.
*#197328640#
[1] UMTS
[6] Common
[6] NV REBUILD
[1] Load defaut NV
This approach changed my IMEI from 0/9 to 0/0. Now, when I tried connecting to the device,
the software read the correct DM Mode. (Interestingly, I still received limited phone service.)
I used a program called "NV-items reader_writer v1.0." Of the many programs that I tried, this program
is super simple since the software output is text based i.e. you don't need a hex editor. I extracted the memory block
from decimal address 550 to 550 and and modified the block to read my non-corrupted IMEI. (I didn't need
to change root permissions or anything complicated like that, steps I performed in some of my previous
method-approaches.)
My device finally was written and reads the correct IMEI!
The guy from Craigslist suspects -- mind you, he wasn't gregarious in the least-- he hinted that "the box"
was needed to break some kind of internal logical state between the device's IMEI and
T-mobile's network protocols. Once this state was broken, the device was receptive to being written.
Thank you to everyone who contributed. My success is your own!
UPDATE:
So, as I mentioned above that I was receiving EDGE only and the carrier service was spotty. In the end, I realized that my NV Build was corrupted, but since I was now able to write to the device, I corrected this problem by referencing Darkshado[w]'s post.
On December 28, 2012, I saw that he posted a full NV backup for the T889, IMEI removed, at the following thread:
Using "NV-items reader_writer v1.0," I wrote to my device with the corrected IMEI using the file from Darkshado[w] as a template (replacing decimal address 550). Now, my device is finally getting reliable connectivity and 4G speeds (only 4G, opposed to LTE, since I'm using a MVNO instead of a direct Tmobile plan). Anyways awesome still!
Click to expand...
Click to collapse
Hello! I'm facing the same issue with my T889, could you please re-post the file from darkshadow's post?
Thank you!

NV Backup Blank-IMEI Template File
walydiesel said:
Hello! I'm facing the same issue with my T889, could you please re-post the file from darkshadow's post?
Thank you!
Click to expand...
Click to collapse
Thank you WalyDiesel for the follow up.
The administrators of this site appear to have made the original link outdated since I started this thread..
Please internally message me your email and I will send you the NV Backup Blank-IMEI template file.
(The file exceeded the attachment limits for this thread.)
You still need to edit decimal address 00550
to your specific IMEI number. Upon doing so,
write the entire file to your T889 device.
Good luck! -- You are in the home stretch.

garbageslot said:
Thank you WalyDiesel for the follow up.
The administrators of this site appear to have made the original link outdated since I started this thread..
Please internally message me your email and I will send you the NV Backup Blank-IMEI template file.
(The file exceeded the attachment limits for this thread.)
You still need to edit decimal address 00550
to your specific IMEI number. Upon doing so,
write the entire file to your T889 device.
Good luck! -- You are in the home stretch.
Click to expand...
Click to collapse
Ok! I sent you my email inbox.
Thank you!

walydiesel said:
Ok! I sent you my email inbox.
Thank you!
Click to expand...
Click to collapse
I'm back!
Unfortunately, the past two days I tried, But I can't write back the file to phone using nv_reader_writer tool. I can't even read from phone. It keeps saying "Failed, phone does not answer".
I read on a thread that it could be because my chip is not Qualcomm. In fact my chip is Exynos. Is it the problem? Is there another tool that I could use? Thank you.
P.S: I'm running stock android 4.3. I also tried stock 4.1.2. Same result and Service mode just leads me to a black screen with Serviceode written on top.

[Q] Restoring IMEI i747 ATT

So I hope this thread isn't too useless. I've been researching how to restore my imei after losing 4g signal when my phone randomly (just sitting there on the desk, not touching it), decided to get stuck in a reboot loop.
Here's my specs:
Network: AT&T
ROM: CyanogenMod 11-20141112-SNAPSHOT-M12-d2lte
Modem: UCUEMJB
Recovery: ClockworkMod 6.0.4.3
Device Model: SAMSUNG-SGH-I747
Product Code: Not Active
PDA Version:
Baseband Version: I747UCUEMJB
CSC Version:
Kernel Release: 3.4.104-cyanogenmod-g9f57632
Kernel Version: #1 SMP PREEMPT Tue Nov 11 22:15:56 PST 2014
ROM Build: d2uc-user 4.3 JSS15J I747UCUEMJB release-keys
Android Version: 4.4.4
BusyBox Version: 1.22.1
SU Binary Version: 2.40:SUPERSU
So here's what I've learned. My IMEI was lost due to a weird Samsung backup procedure that backed up my /efs folder with essentially a blank copy of important information. I have my IMEI, but writing it to the phone is very difficult. From this tutorial I learned to download QPST, and somewhere else I heard about EFS Professional.
So I tried to use EFS Professional first, and have been able to connect my phone (Had to install adb first via the official android sdk). I was able to make a backup of my efs folder. I was also able to change the usb settings to DIAG + MODEM + ADB. Then I launched the Qualcomm NV Tools. From there, by unchecking "Send SPC" and "Read Phone" I was able to connect to the phone, but any other button I pressed didn't accomplish anything except disconnecting the phone again.
This is when I turned to QPST. I knew from EFS Professional which COM port my phone was using each time, and I added the COM ports to the QPST Configuration program for listening. But my phone was never listed as available in the ports tab, nor was it listed in my device manager under COM ports. I tried using the RF NV Item Manager anyway, entering in my IMEI "backwards" with an 8 in the first line and an "a" after the first real number in my IMEI, but my phone was never really connected, so of course nothing happened.
I learned this was probably because I have no IOTHiddenMenu / Qualcomm USB Settings Menu / whatever you want to call it with USSD codes, because I'm using an AOSP ROM (Cyanogenmod). This thread and this thread were useless in enabling DIAG mode, because of broken links and scripts that no longer work on newer versions of CM.
My next plan is to change ROMs to a TouchWiz ROM, but I haven't found a good one yet, especially considering I've upgraded my bootloader and I know that if I flash a ROM with a downgraded bootloader, I'll definitely brick my phone. So is there a ROM I can use with an upgraded bootloader that won't brick my phone and will allow me to enter DIAG mode so that I can connect to QPST via a COM Port, use the RF NV Item Manager, and put in my old IMEI? Or am I just going about this all wrong?

You do have to be on a TW ROM with a stock dialer for ussd codes to work. Based on everything you posted you should be on the mjb boot loader, but confirm that first. Enter this into a terminal or adb shell:
Code:
getprop ro.bootloader
If you are on an mjb bootloader, then this ROM should work for you http://forum.xda-developers.com/showpost.php?p=47816011&postcount=18. It's a rooted deknoxed at&t stock mjb.
Good luck.
---------- Post added at 12:04 PM ---------- Previous post was at 11:57 AM ----------
You probably already discovered this in your research, but just in case. When you get your imei problem solved, before flashing something other than a TW ROM, enter this in a terminal or adb shell:
Code:
su
reboot nvbackup
That will fix Samsung's whoops and give you a working efs backup partition instead of a blank one.

Thanks! I'll try this and get back.

alexalexalex09 said:
Thanks! I'll try this and get back.
Click to expand...
Click to collapse
You were right about the bootloader - when I looked up the ro.bootloader property, it spit back what I thought was my modem identifier, I747UCUEMJB - so yes, MJB. I'll get a chance to flash the new ROM tomorrow or the next day and see how it goes.

So, two steps forward and three steps back. I did install the new ROM. Initially, it appeared to work, because I was able to dial *#7284# to access the service mode menu and change UART to MODEM, and then dial *#0808# to access the USB Settings menu and change that to RMNET+DM+MODEM. After that, the phone showed up under COM5 in the Device Manager. I opened up QPST Configuration and added COM5 (labelled it "COM5") under ports. However, the phone never showed up (Phone column read "No Phone").
I then tried EFS Professional, but it was unable to detect the phone. I opened up the command line and tried an adb shell, but it didn't connect. Of course, the phone was in RMNET+DM+MODEM mode, not and ADB mode. I then went back into USB settings, changed it to DM+MODEM+ADB, and reconnected the phone. The phone wasn't detected by the computer, and hasn't been since.
I've restarted the phone and the computer multiple times (Windows 7 32 bit), uninstalled the phone drivers, reinstalled them in two different versions, uninstalled and reinstalled QPST (removing the relevant registry entries in between installs), and went through a number of combinations of settings on the phone. I tried with UART set to MODEM and PDA, with USB settings set to DM+MODEM+ADB, RMNET+DM+MODEM, MTP, and MTP+ADB. I made sure superuser was installed correctly and that developer mode was enabled. I still have not gotten the phone to charge in that USB port or show up in Device Manager in any way, even though the USB port on the computer still functions (can access flash drives from it). I plan to do some more googling and troubleshooting about this, but I haven't had the time to yet. On Wednesday I'll hopefully have a minute to try using my work laptop to access the phone. I think once I get the phone to be recognized via USB again I'll be able to have QPST Configuration recognize it, then I'll be able to use that RF NV Item Manager to enter in the new IMEI.
Also, in potentially unrelated news, my install of Titanium Backup is unable to recognize any apps I backed up, even ones that have been previously restored. It sees them in the backup folder (backup folder location says this folder contains 52 backups), but no apps wee listed in the backup/restore tab. Maybe this has something to do with the mount namespace separation setting in SuperSU? I'll test that later.

Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.

audit13 said:
Some newer ROMs will install but not give you cell service without the newest bootloader and modem.
Try flashing the last release of CM11. I would not touch the bootloader, modem, or EFS folder until you try an older ROM.
Click to expand...
Click to collapse
Thanks for chiming in, but I don't understand how this applies. I was on CM11 when my IMEI was removed. When you lose your IMEI, the main symptom is that you can't connect to 4g anymore, and you're stuck on EDGE, which is what happened in my case. I can in fact make calls and send texts, and even load web pages without wifi. It's just slow and prone to call dropping.
As for your advice to install an older ROM, I just flashed a stock ROM, the one linked above. It didn't cause my current lack of USB connection, because I had a USB connection for a while until I changed the UART and USB settings.
I definitely will not touch the bootloader - I've been warned about the dangers of downgrading from an MJB bootloader. I'm not sure what you mean by not touching the modem, but I'm going to assume it's as scary/difficult as the bootloader, so I'll be sure to stay away from changing that too.
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.

alexalexalex09 said:
As far as not touching the EFS folder, as far as I see it, that's my only way out of this hole, because my end goal is to replace the IMEI that I randomly lost last week, and that's part of the EFS folder in some way that hasn't been explained to me (although I know it has to do with NV settings, maybe some file called nvdata.bin that I've never found, or the /EFS/IMEI folder?). So I think I have to ignore that bit of advice, unless you can give me a good reason to change my goal in all this.
Click to expand...
Click to collapse
I should note that I took a look at my EFS folder while writing this last post, and it's completely empty now. So that's fun.

I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.

audit13 said:
I suggested flashing back to an older ROM because you made some changes since your original post.
I suggested not touching the bootloader, modem, and EFS because flashing an incompatible bootloader/modem combination can hard brick the phone.
Since your bootloader and modem match, I'm out of suggestions other than perhaps visiting a repair shop to have it fixed.
Click to expand...
Click to collapse
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.

alexalexalex09 said:
Thanks for the clarifications. I did visit a shop to see if they could fix it, and all I got were blank stares and people who don't want to deal with IMEI repairs. So back to my own attempts! I realized a couple days ago that my problem in connecting to the computer is that I've developed a crack on my phone's USB port. Also, I think my home desktop's messed up. So with a nice, sturdy cable I installed all the necessary program on my work laptop (Samsung Drivers, ADB, ES Professional, and QPST just for fun). I tried ES Professional first and by using the Qualcomm NV tools I was able to restore my IMEI! I rebooted the phone and now by dialing *#06# I see my IMEI followed by "/ 17".
So now onto the next problem: Still no 4g signal. Under Connections > More Networks > Mobile Networks, there are some errors. I only have one APN, named "ATT Phone" with an APN of "phone" and an MMSC of mmsc.mobile.att.net, and under network operator it simply says "Default Setup". Some research later, I realized this is a common problem, and I guess it has to do with my NV Data being messed up. Obviously, item 550 (0x226) is correct, which I was able to verify using a program called NV-items-reader-writer, but something else is screwed up. Peoplearmy has released a tool that can restore a backup up QCN file, which of course I don't have, so I'm in the process of seeking help from a generous soul who has an app that might help me. Apparently I could also use someone else's NV Items backup, replacing their IMEI with my own. But, I don't have one, so I'm stuck waiting on someone to be nice to me
I did try the method posted here: http://forum.xda-developers.com/showthread.php?t=1808408&page=16
But it didn't work. This thread and this thread and this thread were helpful to me for research.
Click to expand...
Click to collapse
I got it! Problem solved!!
So what I realized after going back over those research threads quickly was that I was using Peoplearmy's QCN generator incorrectly. Here's how I fixed it.
1. Opened QPST, followed directions here to connect my phone and start up QPST Software Download.
2. Having already injected my IMEI, I used the backup tab to make a backup.
3. I opened Peoplearmy's SG3QCNGenerator and imported the QCN file that QPST just created. I left "inject IMEI" unchecked, since I already had my original IMEI. I clicked Save As to set the directory and name of the new file, and clicked the Verify IMEI button that appeared to verify that it was correct.
This was the step I had missed - because I never had a valid QCN file to import, I never was able to create a new QCN file. My error in thinking was that, since my current QCN file was obviously messed up, I couldn't use it to make a new QCN file, but that's the whole point of this software.
4. Once I had the new QCN file, I went back to QPST's Software Download program and used the Restore tab. The QCN file generated by Peoplearmy's tool didn't match my model number, but I approved it anyway. It restored the QCN file correctly, but it had an error when it tried to reset the phone.
5. I rebooted the phone manually, and I now have 4G signal!
So, to summarize the difficulties I had:
1. I didn't make an nvbackup before I flashed CM a year ago, and it didn't hurt me until now.
2. I lost my IMEI and couldn't restore it because 1) I was on CM, which stopped me from putting my phone in DM + MODEM + ADB mode and 2) The computer/cable I was using to work on my phone, for whatever reason, were being stupid.
3. I didn't understand that in order to fix my phone I needed to restore my IMEI and repair my nv items (.qcn file)
4. I didn't realize that I could use Peoplearmy's tool to take a messed up nv items qcn file, fix it, and restore it to my phone.
All the tools I ended up needing: Samsung Drivers, ADB, ES Professional, QPST, and Peoplearmy's SG3 Data Restorer. Hope this helps someone else out there.

:good: thanks for posting fix.
"all i can really do , is stay out of my own way and let the will of heaven be done"

Great job. Thanks for posting your solution back here so others can find it.

How to get into Qualcomm diagnostic mode?

Hello there.
I have been having the 'stupidly set baseband to USA and unable to change back' issue with my Nexus 5x, using a European version. I live in Croatia, so as you would imagine this has meant a complete loss of signal/mobile operator/3g etc.
As per my other thread in Nexus 5x help and troubleshooting,
http://forum.xda-developers.com/nexus-5x/help/usa-baseband-set-european-model-t3252879
I have exhausted other options and have come to the realisation that as per other users issues with other phones that the use of QPST tools and using a clean QCN file to inject into my phone is the only course of action left. However, I have no knowledge of such things (not to say that I am unable to inform myself).
I emailed a developer with regards to users issues with Nexus 5 phones (not 5x), and he said that I need to enter this mode on my phone.
Could anyone help me out with this, and in general with this issue? As some have tried to help but unfortunately my thread has more of my own replies than other users. (In elaborating on steps taken to resolve my misery).
I am not looking for a 'one button fix', I have educated myself far and beyond with regards to this issue, I just need some more expert help so that I can sort this out myself.
Please, anyone?
Marko

Thank God.
I can actually get a new phone. Help not needed in the end.
Thanks anyway.
Marko

was.once.dead said:
Thank God.
I can actually get a new phone. Help not needed in the end.
Thanks anyway.
Marko
Click to expand...
Click to collapse
glad you got your probelm fixed dont know if this will help you or others but if you press *#*#4636#*#* your phone will enter a radio diagnostics tool where you can set your preferred network type and also select your radio baseband by using the 3 dots at the top. For my 5X i can select USA BAnd or Band mode 6, Band mode 7.
sorry if this is OT and not related to your issue.

Thank you for your input. However my phone does not have those options. Only USA band, which led to this week long stress for me. Im going to be able to get a replacement device in the end, so im happy about that, but this issue is unfortunately somewhat of a one way street wherin the usual simple solutions or even more complex adb, fastboot, etc etc things do not bring about any resolutions.
Again, thanks for trying to help but its a phone to phone kind of thing.
Marko

Best advice I can give. Don't mess with the basebands

zelendel said:
Best advice I can give. Don't mess with the basebands
Click to expand...
Click to collapse
Best advice ever...
But.... If you are really hot on getting the 5x into diagnostic mode to run QPST, QXDM, etc., do this. (I did this on my 5x to obtain the QCN file to check out the NV and EFS items, grab QXDM logs, etc.)
1. Use Heisenberg's most excellent step-by-step tutorial on unlocking the boot loader, rooting the phone, and installing super user apk.
2. Once rooted, connect the phone to a PC and open up adb, then issue the adb shell command.
3. Once in adb shell, type: su -c 'setprop sys.usb.config diag,adb'
4. At this point, you should see a pop up on the phone to authorize super user access. Click to allow access.
5. Now you will probably have to load a driver on the computer for diag access. I got lucky (since I have a mess of drivers on my computer) and the driver loaded automatically. As I recall, my computer selected qcusbser.sys. Seems to be a pretty generic QCOM driver vs. an LG specific driver.
6. You now have diag access. You will have to run steps 2 - 3 after each phone reboot. In other words, these steps aren't "sticky" between reboots.
7. ????
8. Profit
I did this and it worked for me.

clivemckracken said:
Best advice ever...
But.... If you are really hot on getting the 5x into diagnostic mode to run QPST, QXDM, etc., do this. (I did this on my 5x to obtain the QCN file to check out the NV and EFS items, grab QXDM logs, etc.)
1. Use Heisenberg's most excellent step-by-step tutorial on unlocking the boot loader, rooting the phone, and installing super user apk.
2. Once rooted, connect the phone to a PC and open up adb, then issue the adb shell command.
3. Once in adb shell, type: su -c 'setprop sys.usb.config diag,adb'
4. At this point, you should see a pop up on the phone to authorize super user access. Click to allow access.
5. Now you will probably have to load a driver on the computer for diag access. I got lucky (since I have a mess of drivers on my computer) and the driver loaded automatically. As I recall, my computer selected qcusbser.sys. Seems to be a pretty generic QCOM driver vs. an LG specific driver.
6. You now have diag access. You will have to run steps 2 - 3 after each phone reboot. In other words, these steps aren't "sticky" between reboots.
7. ????
8. Profit
I did this and it worked for me.
Click to expand...
Click to collapse
Please give me the global version of rfnv files:good:

Please give me the global version of rfnv files
Sorry, bro. I only have the values from my US version.

{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory

{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory
I know everyone is eager to unlock the Verizon Boot-Loader.
We are not quite there yet however this is another step in the right direction.
We are getting deeper and deeper into this so be FOR-WARNED.
If you decide to play around with these tools you do so at your own risk :crying:
I will help anyone who kills there device But I TAKE NO RESPONSIBILITY.
------------------------------------------------------------------------------------------------------------------------------
Follow my instructions exactly and everything will be ok
------------------------------------------------------------------------------------------------------------------------------
Lets Get Started Shall We :highfive:
PREREQUISITES
The ability to follow each step in order :good:
ADB installed ( Android Studio )
Install HTC Sync from the link below. Then uninstall it. This will load and leave the drivers.
Make sure you uninstall it. HTC Sync will interfere.
http://www.htc.com/us/support/software/htc-sync-manager.aspx
STEP 1)
Set Windows 7 or 8 or 10 into TEST MODE ! ( I Am Running Windows 10 )
You can read up on this process here if you have trouble with my instructions.
http://www.drivethelife.com/windows...e-enforcement-on-windows-10-8-7-xp-vista.html
http://www.howtogeek.com/167723/how...8.1-so-that-you-can-install-unsigned-drivers/
You’ll need to run a command from an Administrator Command Prompt to do this. To launch one, right-click the Start button or press Windows+X and select “Command Prompt (Admin)”.
Execute This Command
Code:
bcdedit /set testsigning on
If you did it correct you should see the following.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Reboot your computer.
If you did it correct you should see the following.
STEP 2) Install the Diag Driver in Windows.
Download the DIAG.zip here. It contains all of the files we need to work with at this point.
Code:
http://www.mediafire.com/file/3ta2ua4tkibn3lb/DIAG%282%29.zip
Unzip the file and install the drivers.
There are 2 drivers. 1 for diagnostic mode and one for Emergency Download Mode.
HTC CDMA LTE DIAG Modem Driver v3.0.2.0 (Diagnostic Driver)
Qualcomm_Diag_QD_Loader_2016_driver (Emergency Download Driver)
When you install the Qualcomm_Diag_QD_Loader_2016_driver you will want your screen to look like this.
The Diagnostic Driver install is pretty self explanatory.
I,m going to leave this section for setup details. More could be added later.
In the next post we will install the tools we need and get the phone connected in diagnostic mode.
Also please see here
https://forum.xda-developers.com/desire-626/general/programming-modem-qpst-qxdm-boost-t3488993 @anthonykb deserves the credit for originally leading me to this idea.
We are using the process for different purpose but it all stems from the same idea.
REMEMBER THE DESIRE 526 AND THE DESIRE 626S AND THE DESIRE 530 ALL HAVE THE SAME CHIPSET.
What works for one of these devices should theoretically work on the others.

Checking Drivers + Setup Tools
I think it's time for us to set up some tools and see if our drivers are installed correctly.
There are 3 tools included in the zip.
QPST.2.7.438 ( Just install it. There is nothing special to do )
QXDM Pro 3.14.594 ( Read IMPORTANT text in the patch folder and follow the instructions )
RevSkills V 2.08.6 Pro Edition (Read the readme file)
Install all 3 and proceed to the next step
Set The device into DIAGNOSTIC MODE
My device is already s-off and unlocked. So this might take an extra step for you.
First try this.
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
I tested this on a fully locked 526 so you will get the DIAG Screen.
You should see this screen.
IF ##3424# isn't giving you that screen you will need the extra step
This might not be 100% necessary BUT I RECOMMEND IT
First you will have to get temp root.
Follow here. It will give you root in the shell only. Not root for apps.
https://forum.xda-developers.com/desire-526/general/temp-root100-how-to-temp-root-desire-t3498969
*********************************************************************************************************
ONCE YOU HAVE ROOT ACCESS
Open up a administrator command window.
Execute these commands in the shell.
Code:
adb devices
adb shell
su
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/func_en
*********************************************************************************************************
IF YOU CAN'T GET ROOT THIS SHOULD STILL WORK !!
*********************************************************************************************************
Verify the Diagnostic Port is Available (ALL DRIVERS WORKING)
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
Connect the device to the computer.
Open up windows device manager.
With all nessessary drivers installed this is what you should see. :highfive:
If you didn't install and uninstall HTC Sync it will look like this
Some things work but this isn't right. DONT DO IT
The HTC Drivers and Diag Drivers are missing. REALLY DONT DO THIS

Time to do some Work
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:

Backup the entire nv ram
Ok lets get too it. Here we will backup the entire NV Ram.
After it is dumped to a file I believe the file can be edited.
It is easy to restore the backup to the device.
Lets get started.
#1) Dial ##3424# then send to get to diagnostic mode.
#2) Open QPST Configuration
#3) You Should See This Screen
#4) In QPST Configuration Click START CLIENTS ( EFS EXPLORER)
Select your device under phone selection
#5)EFS EXPLORER Reads the device
#6)The NV Items Look Like This
Notice the red circle ( We cant access those )
But we can fix NVM to get access using open sesame door
#7)Click File Then NEW then Directory
#7)Add open sesame door
Now reboot the device.
Dial ##3424# again.
Then open QPST Configuration and EFS Explorer again.
Make sure you have the open sesame door folder
Notice NVM is no longe a red circle. ITS UNLOCKED.
After reboot and restart qpst it should look like this.
OK were all done with that part. ( OPEN SESAME DOOR )
Lets dump our Embedded File System now.
Close the EFS File Explorer.
Go to the QPST Configuration and Start Clients -->>> Software Download.
Notice the MPSS Version ---->>>> This tells us what version of Source to USE.
#8)Click The BackupTab
On the backup tab where it says xQCNFile select a a location and name for the file.
#9)Click Start To make the backup.
Pay attention to all the files it creates.
Look at the images below.
TO FLASH A BACKUP EFS FILE
#9)Now Go To the Restore Tab
Select the backup file you want to restore.
Make sure Allow phone/file ESN mismatch is NOT Checked.
The backup you flash has to be from the device you created it from.
Or the backup file will need the ESN Edited to match your device. (DANGEROUS)
I need to find a way to use the ESN mismatch but right now it gives error.
Anyway lets flash our backup.
Select the file.
Click Start.
Restoring NV Memory
Restoring NV ITEM FILES
Restoring BREW FILES
Restoring COMPLETE
So there you have it. We can indeed use the QPST / QXDM tools to communicate and flash the device.
THIS BACKUP IS IMPORTANT.
IF YOU BRICK YOUR PHONE. YOU COULD NEED THIS BACKUP TO RESTORE IT COMPLETELY.
WE CAN EDIT THE BACKUP FILE USING A HEX EDITOR OR THE TOOL I WILL TALK ABOUT NEXT.
In light of all this Someone Who Knows What to Changecould help reduce the device security and help us to further customize the device.
Unfortunately this is fairly new to me so I DONT Know the best things to change.
Best I can think of is to compare the backup from my fully unlocked device. ( S-Off / Super CID )
Against the backup from a factory LOCKED State.
Make any necessary changes to the Locked NV Backup.
Know that the wrong mistake here will brick your device for sure.
Feel free to explore the tools and things that can be accomplished with them.
I recommend highly....DONT CHANGE ANYTHING UNLESS YOU KNOW WHAT YOUR DOING.
Hitting some of the buttons in the tools can be dangerous.
Have Fun. The best thing is this device cost only $34.
So it's perfect for learning these tools and testing.
Then when you do this on your expensive device.
You won't brick it.

GREAT!!
Please make a rom to global GSMcard for connection data,

Wow, I am a newbie and when I seen all these instructions I almost gave up before I started. I can proudly say I successfully completed this tutorial. Does this mean my bootloader is now unlocked? What do I need to do next to root this thing. Once again, please forgive my ignorance, like I said this is all new to me.
I just went in to recovery mode and it still says locked. ???

@blahforme
I'm glad everything worked for you.
I try to write my guides so everyone can follow and get good results.
Unfortunately this is not a boot loader unlock.
So you can't root yet.
But you do have a backup of your NV Memory and you learned something.
Plus you have the drivers and whatnot installed.
So it was worth the effort.
I have build a device image that if it can be flashed will allow you to unlock the boot loader.
I'm working on the flashing part.
The rom build is here and you can learn a whole lot about htc devices in this thread.
Really it's not for a new bee so don't be surprised when you see the complexity of things.
https://forum.xda-developers.com/de...-rom-msm8909-service-rom-source-qpst-t3544178
As soon as i have a way to unlock the boot loader you will all know. Hopefully soon.

BigCountry907 said:
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:
Click to expand...
Click to collapse
Hi @BigCountry907,
First and foremost, thank you for all of your hard work on the MSM8909 chipset. I've found your many posts to be extremely enlightening! I plan to attempt building your AOSP kernel at some point soon on my Desire 626s; I just need to setup my Linux dev box. I realize this is now an older device, but I'm enjoying learning & getting close to the metal on this one.
Pertaining to these instructions, I am encountering an issue and wanted to see if you might have any ideas.
Have QXDM drivers properly installed; diag port enabled via adb; QPST recognizes the phone (although ESN is blank). As I attempt RevSkills, HTC Unlock SPC = success "Done sending SuperSPC." As I click "Change SPC", I receive "Error writing NV value". However, after several attempts at it, I finally get success. Send SPC = I get a return "41 01 ¶ A" and after "Send SP" get a return of "46 01 ¶ F". I'm going to assume these are successful.
The issue presents itself when I enter ##3424# (DM Command- after writing SPC). It prompts me to enter the MSL. I attempt 000000 and the phone will either: reboot or will say incorrect MSL (and will not allow me into the menu). I'm unable to access DM Command.
While I've already enabled the diag port, I am interested in sending AT commands and going further into using qcdiag to monitor gsm/3g/lte packets. As I understand it, I need to enable serial com in order to send AT commands to the modem. I'd like to get my KC and use rtl-sdr to sniff and decrypt my own traffic to better understand... Currently, as I attempt Putty on COM3 (valid diag port) unable to connect.
To give some supporting information, I am using a Cricket Wireless Desire 626s device unlocked on Marshmallow 2.27.651.6 T-Mobile network (Sprint debloated ROM as Cricket did not update to MM). However, I've attempted this after using the Cricket RUU as well as a few other custom ROMs w/o success.
I've also looked into QXDM - NV Browser - Item 0085 after a supposedly successful SPC write, and get the return "No DIAG Response Received". I've tried to pack as much pertinent info into these screenshots as possible.
Ultimately, I'm interested in getting to packet level data using qxdm, and am hoping you might help steer me a bit. Osmo-qcdiag has some really cool stuff they are working towards and I'd like to use this device. Also, if you happen to have an idea of the NV values to open up additional 3g & LTE bands- that would be super helpful! (I'm on T-Mobile network currently).
Thank you so very much for all of your hard work on this device.
FYI, unfortunately unable to post my image as I"m a "new" member. However,
imgur . com /a / ZiuXP

Repair IMEI - Diag mode

While trying to install a Custom ROM, all went wrong with a hard bricked Redmi Note 8T as result.
Have been able to revive the phone in EDL mode (Test Points method). Now running again on MIUI Global 12.5.5 (RCXEUXM).
However, the IMEI's are nulled, can't activate a SIM card. Only WiFi works.
A first, essential step in the process to repair the IMEI's, is to open the diag mode. Found a few methods, but none of these methods work.
Not via *#*#717717#*#* (Open diag failed), not via adb devices // adb shell // su // setprop sys.usb.config diag,adb (Permission denied).
The phone is rooted with Magisk; recovery OrangeFox.
Does anyone have a helpful suggestion how to proceed?
Follow-on: Meanwhile, I've been able to open the Diag-mode. Apparently, one or two switches in Magisk had masked the rooting of the phone.
Now on to editing the qcn-file with the correct IMEI's. First,I have to figure out the location of the two IMEI's, and then to correct these into the correct values.
To be continued...

gjongbloed said:
While trying to install a Custom ROM, all went wrong with a hard bricked Redmi Note 8T as result.
Have been able to revive the phone in EDL mode (Test Points method). Now running again on MIUI Global 12.5.5 (RCXEUXM).
However, the IMEI's are nulled, can't activate a SIM card. Only WiFi works.
A first, essential step in the process to repair the IMEI's, is to open the diag mode. Found a few methods, but none of these methods work.
Not via *#*#717717#*#* (Open diag failed), not via adb devices // adb shell // su // setprop sys.usb.config diag,adb (Permission denied).
The phone is rooted with Magisk; recovery OrangeFox.
Does anyone have a helpful suggestion how to proceed?
Follow-on: Meanwhile, I've been able to open the Diag-mode. Apparently, one or two switches in Magisk had masked the rooting of the phone.
Now on to editing the qcn-file with the correct IMEI's. First,I have to figure out the location of the two IMEI's, and then to correct these into the correct values.
To be continued...
Click to expand...
Click to collapse
I have had the same problem with my previous Redmi Note 3. And I tried so may ways to re-write the IMEI number. Finally I found a little software on the net and using my computer I was able to re-write the IMEI number to the phone. I was a long time back, so I dont remember the exact name of the software. It was something like IMEI writer (root). Connected the phone which was also rooted. Then opened the software on my PC and the software asked for superuser access, which I granted on the phone. Then there from the pc using the software I entered the IMEI numbers for both sim1 & 2, and applied then reboot phone. After reboot, the phone then detected the simcards and the imei were back.

chris5k said:
I have had the same problem with my previous Redmi Note 3. And I tried so may ways to re-write the IMEI number. Finally I found a little software on the net and using my computer I was able to re-write the IMEI number to the phone. I was a long time back, so I dont remember the exact name of the software. It was something like IMEI writer (root). Connected the phone which was also rooted. Then opened the software on my PC and the software asked for superuser access, which I granted on the phone. Then there from the pc using the software I entered the IMEI numbers for both sim1 & 2, and applied then reboot phone. After reboot, the phone then detected the simcards and the imei were back.
Click to expand...
Click to collapse
My current problem: I can find a .qcn file and have to edit it with the proper IMEI's. Found a Qualcomm IMEI Rebuilder tool, but that tool doesn't work. With a Hex-editor it is difficult to find the proper location. Found the location of one IMEI and then saved the file with a different name. Loading that file into the Rebuilder tool indeed shows (one) correct IMEI. Have installed that file with QFIL, but when I check with *#06#, it shows a completely different IMEI...
Meanwhile, I've searched for IMEI write (root). Found IMEI Tools (ROOT)_1.4_apkcombo.com.apk.
Prooved incompatible for my phone.
Then found qualcomm-smartphone-write-imei-tool-v1.01.apk
Tried that out, but couldn't establish communication with the diag-COMport.
In fact, I can't activate the diag mode any longer... Tried and re-tried, but all in vain.
When I enter the last command ('setprop .... etc.), communication via the USB port is also stopped. Re-establishing that doesn't make a difference. No COMport appearing in device manager or in QFIL...

You need special tools like UMT or Hydra to write Note 8 imei

engage4 said:
You need special tools like UMT or Hydra to write Note 8 imei
Click to expand...
Click to collapse
UMT works with dongle? Price?
I tried Hydra, but got a Trojan Horse warning, and therefore broke off installation.

Umt needs dongle.

First restore original qcn(unedited) then try flashing ENG firmware.
!! Iam not responisble if anything wrong happens with your phone.