Hi there
I bought a Mi locked Xiaomi Redmi 8 pro from a legal source (can explain and proof via pm if you want,).
I was aware that its locked but I like the challenge
Till now I was able to flash official stock Rom with Sp Flash and also to format the partition with the Mi account authentication files. After that I am able to go through the setup but the moment I connect it to the internet, it will lock again, After you skip the w-lan connection setup the setup will somewhen give out something like "you did not set up a google account, so you have to do the setup again" - so no way so far to start without connecting to internet, no chance to get root access..
Tried this without any internet connection or sim card inserted.
Next thing I thought about was to install a custom Rom with Sp Flash, but could not find a Rom with scatter file yet. No clue if that would help either to avoid the Mi Account request.
I was also thinking to install TRWP to make flashing and so on a bit easier. Can't unlock bootloader, nor root the phone and I am pretty much a noob. Is it even possible (maybe with Bluestacks and Sp Flash ? Yet I wasn't even able to read out the IMEI ...
Would be happy for any help or even solutions. I'd be fine if it would run on somewhat working Linux or custom rom. Keen to try whats possible
Thanks in advance for youre help.
Thought to myself it might be possible to flash a Chinese Rom (without Gapps) and setup without internet connection just to get root access
M1k3.7 said:
Thought to myself it might be possible to flash a Chinese Rom (without Gapps) and setup without internet connection just to get root access
Click to expand...
Click to collapse
It appears I'm talking to myself here ;D
I managed to flash the Chinese stock ROM on the phone. Was same as flashing the global one. After the flash it started up but prompted the same screen where it says the device is Mi account locked. At least i guess it said the same as it was in Chinese
I have to do what i did before - format the partition with the Mi Account on the phone with Sp Flash.
Unfortunately for some reason Sp Flash doesn't want to work anymore. It gives out an error code which apparently says that the USB output power is too low, although i haven't connected the phone nor anything else via USB on the laptop... . Downloaded Sp Flash again, tried the scatter file from the global version, different download manager files and authentication files from different sources.
Every time i get the same error message within a couple seconds after i press "start" after i copy in the start partition and length of the authentication files . Did look up if its the same partition in the Chinese ROM scatter file and it is. Did also try to connect the phone within the time but doesn't work either.
Yeah, that's it for today. Surely a problem with Sp Flash or Windows or the hardware around and not with the phone. Might try it with the other Linux laptop I have but I'm not really good with Linux.
I'm on it and I think if i could just delete the Mi Account partition once more, I could root the phone and install TWRP bootloader to make it a bit easier.
Yeah !
I did use a different windows laptop. Installed Sp Flash, downloaded the Chinese Stock Rom again, libusb devel driver, Python, ...
It worked ! I was able to format the partition wit the Mi Authentication code and setup the phone. As the Chinese Version comes without Gapps (but with english language package) I was able to finish the setup.
Opened developer options, USB debugging mode on, Bootloader unlocked (that's what it says in the settings, buy it's not) ! Way to go
In fact I could install a VPN App via USB right know and trick the Mi Account verification. Could install Gapps (no, I tried and could not) and that's it if the phone is not Google locked as well.
But I will try to install TWRP and a custom ROM first as I don't like bloatware. Still got no answer if custom Rom's do come with Mi Account request
Any help would still be well appreciated
Hi again in my "only me" thread
Had no luck so far to unlock the bootloader. Did install a VPN via usb to use the imternet. Works fine.
Tried to install Google Apps Installer from the Chinese App Store. Hangs on 3% without message.
Right now I'm downloading an older Chinese Stock Rom and will try to downgrade the phone with it. Might help or not, who knows
Would be interesting if it's Google locked as well.
Anyway, I'm not giving up yet. If I'm not able to bring it further, I will use the phone like it is with drony anyway. Won't resell it.
I'll keep trying
M1k3.7 said:
Hi again in my "only me" thread
Had no luck so far to unlock the bootloader. Did install a VPN via usb to use the imternet. Works fine.
Tried to install Google Apps Installer from the Chinese App Store. Hangs on 3% without message.
Right know I'm downloading an older Chinese Stock Rom and will try to downgrade the phone with it. Might help or not, who knows
Would be interesting if it's Google locked as well.
Anyway, I'm not giving up yet. If I'm not able to bring it further, I will use the phone like it is with drony anyway. Won't resell it.
I'll keep trying
Click to expand...
Click to collapse
Update:
After downloading the older Stock Rom (from 2019) I chose the scatter file and connected the phone via bypass tool as usual. Sp Flash won't find the phone ...
Did install the phone with USB devel driver to another USB Port, bypass works --> SP Flash still won't find it.
It seems SP Flash saves Scatter (or ROM) files somehow linked to the driver. When I loaded the old scatter file, SP Flash could find the Phone again. That was probably the problem on the other Laptop too.
I do have a third laptop (kids in school and "bring you're own device ) but that's the Linux one. I also have a Windows PC ...
That would allow me to do the same procedure with two other Rom's, I guess
Don't really wanna try that as it's most likely one or two nasty rules in the windows registry. Again, I'd really appreciate help
That means I will try to solve the problem with what I have now. The working Phone with latest Chinese Stock Rom and Drony but without Gapps.
Will try to block the connection to Mi Cloud and updates on my wifi router.
This should allow me to install a gloabl Stock Rom again which comes with Google Apps. If the device is no Google locked, I could have at least a working phone with Drony always on
Success !
I was able to block the Mi Account checkups in the router and flash my phone back to the newest global Rom !
First i added Url Filters in my Router. I checked the blocked URL's in the Drony App on my Chinese Rom phone. My Router blocks the following Url's:
find.api.micloud.xiaomi.net
data.mistat.xiaomi.com
update.miui.com
i.mi.com
After that i tried to flash the latest Global Stock Rom from the official Xiaomi page and failed first. Got the same error message as i got when i wanted to flash the older Chinese Rom. I figured out that you have to deactivate "Tracing" in the Sp Flash Settings.
It would be probably enough to delete every saved folder in the log file path which is "C:\ProgramData\SP_FT_Logs". ProgramData is hidden, so i choose to try just deactivate tracing at all and it worked for me.
After the flash I had still a couple Chinese and other (Drony, Miracle, UC Browcer, ... ) apps with setings installed. Somehow it saved the Apps and Settings. Most of the Chinese apps where gone though and i was able to go through the Setup with giving it a Gmail account and so on. Google Apps working fine.
After couple minutes I got a message that an android app doesnt work. Couldn't stop it.
At this point I did a "random" factory reset --> with no sim card (mobile data) installed.
This deleted all settings and again, the setup worked just fine.
Right after the Setup i installed the Drony App again and blocked the necessary Apps. Use YouTube or Google to find the right Drony Settings. When Drony is running you can insert you're SIM card and use mobile data
Thats it so far. I have a phone with up to date Firmware but disabled firmware updates, can install practically every App from Google App Store and connect to the Internet with Drony App in between. Activated Developer Mode and USB Debugging (nor necessary).
In fact, with mobile Data off and connected to my home Wifi i could use the phone without VPN App (Drony}.
-------------+++++++++------------
What would I try if I would buy another phone like this ?
I'm just a random guy who bought a locked phone. If you try any of the following on your phone I do not take any responsibility !
1) block the URL's which you can find above
2) https://forum.xda-developers.com/t/...d-flash-in-edl-with-no-auth-for-free.4229679/
At point 9 it says: "Connect powered off phone with volume- button to boot in EDL mode"
You are probably not even able to power off youre phone and you DO NOT need to open your phone to disconnect the battery.
When the phone is on (your'e phone is locked screen or so), press and hold the power button and volume up button, until the phone shuts off. At this very second let the power button go and just keep the volume up button pressed and connect the USB C cable to your phone . That's it.
The libusb filter driver window should find the mtk device. Klick on it quickly and install. It should prompt driver successful installed. No problem if you're not fast enough. Just try again. Even if your device disappears from the list meanwhile - it is installed after this message.
Keep the buttons and the procedure in mind as you will need it later on when you do the bootloader bypass itself with the bypass.bat. Try it again and again till it says "driver installed" when it comes to the "how to install" message at #10 --- and the "protection disabled" at "how to bypass" #3 part.
------------------------------------------------------------
Furthermore you probably don't need to flash (Sp Flash -> download) your device at all. It might be enough if you choose the scatter file of your downloaded Rom , the mtk all in one Download agent and the auth_sv5.auth authentication file.
Then go to "Format" in Sp Flash Tool. Tick "manual format flash" and give begin address
0xe188000 and format length 0x4678000 . After this your phone will boot into setup mode.
DO NOT DO THIS IF YOU ARE NOT SURE YOU HAVE THE RIGHT PHONE, SCATTER FILE, STOCK ROM AND THE RIGHT FIRMWARE ON YOUR PHONE !
The phone is working fine so far. I still want to unlock the bootloader and finally install TWRP and a custom ROM.
Can't say when this will happen, as it's my daughter's phone now
I might also try to deactivate or manipulate the apps which took up the IMEI on the MI account servers. Given that I have developer settings and USB debugging activated I can practically delete or change every single file on the phone but the bootloader.
Maybe I can get rid of the Drony App this way.
It's fun to read your journal.
But unfortunately, unlocking bootloader needs to bind your phone to a mi account. And you have an account lock problem. I guess it won't happen until you solve that.
There is mi account unblocking service out there if you will to spare bucks, but I haven't tried any of it, and as promoting such service is against xda rule, I can't tell you any name here.
Personally, I will keep my hands away from something with account problem. My best experience is buying a bricked phones (redmi note 5 pro, redmi note 8 pro).
kekesed97 said:
It's fun to read your journal.
But unfortunately, unlocking bootloader needs to bind your phone to a mi account. And you have an account lock problem. I guess it won't happen until you solve that.
There is mi account unblocking service out there if you will to spare bucks, but I haven't tried any of it, and as promoting such service is against xda rule, I can't tell you any name here.
Personally, I will keep my hands away from something with account problem. My best experience is buying a bricked phones (redmi note 5 pro, redmi note 8 pro).
Click to expand...
Click to collapse
Thank you for you're reply.
When I bought the phone I actually wasn't aware that the bootloader could be locked. As I said I've not much of an idea and thought I could at least flash a custom ROM on that phone. I know nothing and knew even less a couple weeks ago
I'm aware that there are unlocking services you can pay for. Did not really look into that yet.
I have still a couple options. The guy I bought the phone from does know the name and email of the other guy who but in the mi Account in the first place. That guy is willing to remove the Mi lock if I'd bring the phone to him. He's rather far away though and a flight-ticket is not really worth it
The other option is to pay for it - as you said - but I doubt there is a store nearby me and I don't want to pay a random online based service from I-don't-know-where as the phone works fine like it is now and my daughter is happy.
Another option would probably be to buy another phone with broken screen (but not locked) or so or maybe just the motherboard. I'm not sure though if it's enough to exchange the motherboard or not
Or I could just leave it for now and wait if someone programs a working bootloader key generator or unlocking tool for the phone. That's maybe already out somewhere or it will be next week or in 5 years - who knows
If nothing works, it's fine too as long as it runs like it does now with the VPN.
M1k3.7 said:
Thank you for you're reply.
When I bought the phone I actually wasn't aware that the bootloader could be locked. As I said I've not much of an idea and thought I could at least flash a custom ROM on that phone. I know nothing and knew even less a couple weeks ago
I'm aware that there are unlocking services you can pay for. Did not really look into that yet.
I have still a couple options. The guy I bought the phone from does know the name and email of the other guy who but in the mi Account in the first place. That guy is willing to remove the Mi lock if I'd bring the phone to him. He's rather far away though and a flight-ticket is not really worth it
The other option is to pay for it - as you said - but I doubt there is a store nearby me and I don't want to pay a random online based service from I-don't-know-where as the phone works fine like it is now and my daughter is happy.
Another option would probably be to buy another phone with broken screen (but not locked) or so or maybe just the motherboard. I'm not sure though if it's enough to exchange the motherboard or not
Or I could just leave it for now and wait if someone programs a working bootloader key generator or unlocking tool for the phone. That's maybe already out somewhere or it will be next week or in 5 years - who knows
If nothing works, it's fine too as long as it runs like it does now with the VPN.
Click to expand...
Click to collapse
You can ask him to unregister your phone from his account. It's the best bet.
Wait, I will test it to my old redmi note 5.
Just tested with my redmi note 5 pro. Apparently you can unlock it if you have access to your mi account. I'm sure you don't have google frp lock there so I logged out from my google account before testing.
How did I do that?
1. I did a backup on /data partition using OrangeFox
2. I erased my google account and leaving mi account intact
3. I did a factory reset by le old 3 wipe (data, cache, dalvik-cache), leaving emulated storage intact
4. I rebooted my phone
5. Upon welcome screen, I connected to mobile data and welcomed by "Login to your MI account" screen. I connect to a wifi network here
6. I went to i.mi.com, and login to my account.
7. I clicked on "Find device", and deactivated find device there
8. I clicked on my profile logo -> Devices and storage
9. I clicked on my test device
10. I clicked on "Erase device" and agreed to the next dialog box
11. My device was removed from my account
12. I restarted my device and that annoying lockout screen is gone
13. I skipped everything on welcome screen and checked wether my files are intact or not. It is
14. Test finished. Now restoring my old data
Hello
The seccfg partition unlocks the device.
You must initially unlock the bootloader through the MiUnlock application, then recover (save) the seccfg partition (which contains the bootloader unlock information). But, it is easier to get rid of the requirement of the MiUnlock app.
1) Recover your "seccfg" partition:
* the phone in normal mode =
- We launch the command prompt and we write
adb shell
ls -al /dev/block/by-name
or
adb shell
ls -al /dev/block/platform/bootdevice/by-name
- Output (looking for "seccfg") =
lrwxrwxrwx 1 root root 16 2021-03-06 23:25 seccfg -> /dev/block/sdc13
- We get "seccfg" on the internal memory =
dd if =/dev/block/sdc13 of =/sdcard/Partition_seccfg
(I named "Partition_seccfg", but you give the name you want)
- You save "Partition_seccfg" on your PC
* We can recover the "seccfg" partition by SPFlashTool
- Edit your "MT6785_Android_scatter.txt" from a stock ROM (with Notepad or other)
- We are looking for "seccfg" =
partition_index: SYS14
partition_name: seccfg
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x13800000
physical_start_addr: 0x13800000
partition_size: 0x800000
- We turn off the phone
- we switch to EDL mode with the python script "bypass_utility-v.1.4.2" (see on the web for installation and other information, among other things to unbrick the phone)
- we do a "readback of the" seccfg "partition with SPFlashTool using linear_start_addr: 0x13800000 and partition_size: 0x800000 (check the location on the PC, where the "seccfg" partition will be saved with the name you have chosen)
2) Modify your "seccfg" partition:
* We edit the "seccfg" partition with a hexadecimal editor (Notepad or other)
- Total size 000000000 to 007ffff0 (000000040 to 007ffff0 : zero bytes = 00)
- Address 000000000 to 00000003f, we find :
0000000 to 000000f
4d 4d 4d 4d 04 00 00 00 3c 00 00 00 02 00 00 00
0000010 to 000001f
00 00 00 00 00 00 00 00 45 45 45 45 3d aa 79 3b
0000020 to 000002f
eb b0 56 bd 53 48 d3 6e 7d 54 a0 41 0c 2d 1a 90
0000030 to 000003f
58 1a 9c 5f ab 90 cc 0f 5c 11 63 a2 00 00 00 00
(The bootloader is locked!)
- We modify with our hexadecimal editor (Address 000000000 to 000000030) :
0000000 to 000000f
4d 4d 4d 4d 04 00 00 00 3c 00 00 00 03 00 00 00
0000010 to 000001f
00 00 00 00 00 00 00 00 45 45 45 45 57 b3 59 5d
0000020 to 000002f
9e bc 3d 02 33 91 84 9a 42 59 54 8e 07 aa 0f 34
0000030 to 000003f
f1 bb 1e 47 ea 8e cf 76 fb de 79 7b 00 00 00 00
(The bootloader is unlocked!)
- We save our changes
3) Write your "seccfg" partition on the phone:
* We flash the "seccfg" partition
- fastboot flash seccfg "path on your PC"\"name of your saved seccfg partition" (E:\MyFolder\Partition_seccfg for example), in fastboot mode,
- SPFlashTool using EDL mode with the python script "bypass_utility-v.1.4.2 "and by flashing your rom by not checking that the partition "seccfg",
- in adb mode, with the opposite operation, after having copied your partion "seccfg" on the internal memory of the telephone (name "Partition_seccfg" that I gave and that you choose) :
adb shell dd if=/sdcard/Partition_seccfg of=/dev/block/sdc13
- We restart the phone and the bootloader is unlocked without intervention from Xiaomi or other!
4) Warning :
Once all this information is published, subsequent MIUI updates may destroy our efforts by scheduling the bootloader release in a more complicated way!
If I manage to re-enable telephony after changing the IMEIs and serial number of the phone, I will let you know. If anyone knows how to reactivate telephony after making these changes, let us know.
Hi. See you soon.
Related
Featuring the Master of WM6 ROMs, Mr. Schaps himself, I decided to publish this little recipe, how to patch the Schaps 3.5x ROMS to make them suitable for BB Connect.
WARNINGs:
You do, what you do at your own risk!
I will not maintain or Babysit this thread. It works for me, it may not for others!
I will not upload any patched ROMS or maintain these, because I have no time.
I provide this recipe to others, who need like me a BBconnect for job on a WM6 ROM and since Schaps ROMS seems to become a standard, here it is:
This is a recipe for users, who had BBconnect running before and have some experience. If you never run BBconnect on a WM device before, this is probably not for you to start here! Get it to work on a true Blackberry, then move to WM 5 device with a proven config; after that you might try this one.
BBconnect checks the OS version and the Device ID. In addition you need to have a Blackberry subscription, and your Provider must support BBc and your SIM card must be BB enabled. It works with a wide range of Radio Stacks. The radio stack is also NOT relevant for the BB OS check algorithm.
This patch is ONLY to 'correct' the OS version checking; it will not help for other incompatibilities!
My patch works for the HERMES 100.
I tested on Schaps 3.57a and 3.54b
I used BBconnect 4.0.0.67
To do the patch, you need:
Schaps ROM
an Archiver like WinRar or Powerarchive (tm)
A HexEditor
A Registry Editor
a cab file BBconnect 4.0.0.67
Active Synch BB connect Desktop SW 4.0.0.17
You don't need a Rom Kitchen environment; it's just adding a little bit of cracked Pepper to the perfect dishes the cook has cooked in the kitchen.
How to:
Open Schaps ROM with the Archiver (do not double click); Schaps ROM is a self extracting and running archive.
You will find 2 files in it:
Ruu_Signed.nbh
Ruuwrapper.exe
Extract Ruu_signed.nbh (leave the archiver open)
run HexEdit
Open Ruu_Signed in the HexEditor
Search the following Hex String:
30 40 2D E9 59 3E A0 E3 0D 30 83 E3 45 2F A0 E3 05 10 A0 E3 02
You should find it EXACTLY 2 times in the .nbh file. If you don't find it, or only once or more than 2 times, you can abort the process here, because something is wrong! On the other hand, if you find it also exactly 2 times in the 3.6 beta ROM, you can almost be sure that it will work as well there, but I have not tested it.
If you found it 2 times, search again from the top.
At the first occurence change the following bytes in BOLD:
30 40 2D E9 59 3E A0 E3 0D 30 83 E3 45 2F A0 E3 05 10 A0 E3 02
as following
45 change to C3
2F change to 30
02 change to 01
Search for the 2nd occurence and change the same bytes to the same values as above.
save (overwrite) Ruu_signed.nbh and quit Hexedit
Now replace the Ruu_signed.nbh file in the archive with the modified Ruu_signed.nbh in your directory. It may be good to check the time stamps of the files to be really sure that you will have the modified file in the archive.
Save (overwrite) Schaps ROM.exe and leave the archiver.
You can now flash your device, by double clicking on the modified Schaps Rom.exe. Follow the instructions there. I have encountered an error message at the end of the flash process, but this has no effect, the device will boot properly.
After you have configured your Hermes, check on the Start|settigns|system|about screen the version.
You should see: 5.1.195...
If you dont see that, or if you see 5.2.... you did something wrong in the patch process. In that case, flash again with a ROM of your choice and forget BBconnect.
Load and execute the Registry editor onto your device.
Modify the HKLM/system/Version key
from .0.3.2 to .2.3.0 (don't forget the leading .)
Go again to the Start|settings|system|about screen.
You should see now: CE OS 5.1.195(build 17944.2.3.0)
If you don't, abort the process and re-flash with a ROM of your choice.
If you see EXACTLY this, you have successfully patched the OS to run w/ BBconnect 4.0.0.67
Load the BBC.cab to your device and install.
You'll find 2 new icons
1) in Start|settings|system BlackBerry
2) Start|settings|personal BlackBerry-Security
Run Start|settings|system BlackBerry and follw the instructions (prepare for 1st use). When it asks you, which info to synchronise from PIM, leave all boxes UNchecked. Just let's try to get mail working first; you can later change to synch your cal, contacts etc.
After reset, you'll find the BB symbol :x in the tray. After a few seconds it will change to : and start to try to connect via the radio. Something should move in the Start screen top line above the Radio Strength icon.
After a while you should see the BB icon as :: Click on the symbol and go to the Identity tab. You should see there a PIN (starting amongst others w/ 6...) and more over a valid IP adress. This adress is given to you from the provider network. If you don't have a PIN or IP address, it won't work for you.
If you have a PIN and an IP address, there is hope, but no confirmation, yet.
Make sure, you have MS ActiveSynch 4.5 properly partnered. UNcheck under Options all synch items, like mail, calendar etc.
Disconnect the Device from the Desktop after synchronisation completed.
Install the BBconnect Desktop Software and connect the device, when told so.
Follow the procedure or configuration. Eventually you will see a pop up window saying "Sending provisioning data to Handheld". After that, "Handheld configured successfully". Give it time!
Disconnect the device and it should now connect over the air interface, as following:
The device will lock and prompt you for a new passwd. (The BB security passwd). After that
you'll find the BB symbol :x in the tray. After a few seconds it will change to : and start to try to connect via the radio. Something should move in the Start screen top line above the Radio Strength icon.
After a while you should see the BB icon as :: Click on the symbol and go to the Identity tab. You should see there a PIN (starting amongst others w/ 6...) and more over a valid IP adress.
Go to the e-mail tab and you should see your e-mail adress as provisioned by the Desktop Program.
The typical behavior, if your connection is REJECTED is as follwing:
Click on the BBc symbol in the tray; open the Status Tab.
Stop the service
start the service again.
you'll find the BB symbol :! in the tray. After a few seconds it will change to : and start to try to connect via the radio. Something should move in the Start screen top line above the Radio Strength icon. The status line says:
Network available
Datec Tunnel Available (a fraction of a second only)
and then, instead of going to 'connected' it goes to Not Connected AND THE IDENTITY TAB SHOWS NO IP ADDRESS
In that case, your connection is refused and you can forget about it.
If connected, you are done, read the BBc manual and configure your device as needed.
BBconnect is a complex program, which needs a lot of CPU power and server/network communication. BE PATIENT! In case, wait a few seconds longer, rather than confusing everything!
Good Luck
alternatively you could just try the new BBConnect release from HTC that was posted a couple of days back on this forum
Would you please be so kind and direct me to the thread?
I was searching the forums up&down and couldn't find anything.
tonyb15re said:
alternatively you could just try the new BBConnect release from HTC that was posted a couple of days back on this forum
Click to expand...
Click to collapse
Yes, please use the new cab file and save yourself some work.
BBC 4.0.0.90
http://www.sendspace.com/file/38eex2
Here we go, this is my first post to XDA, yeah ! First, I would like to apologize for my following English. I'm a frenchie from Canada
I have a hard time to network unlock a Virgin Mobile Gio 5660M. Here is what I did :
1- Depacking the brand new GIO, insert the sdcard and the battery only (no sim card at this time)
2- Charge the battery to 100% with a wall charger
3- Fire up the gio
4- Connect the wifi, setting up a google account in the market
5- Installed the terminal emulator from the market
6- Copy the root zip file on the sdcard
7- Reboot the gio in the stock recovery and install the root zip file, restart
8- Follow succesfuly the S.Chan method to get the unlock code from bml5.
9- Fire up the gio again but with a foreing sim card (Rogers).
10- Network Lock screen appear, put the unlock code and bang : Network Lock unsuccessful.
I tried it another time to be sure, same result. I tried another time with another simcard (Fido), again the same Network Lock unsuccessful message.
So ... I'm sure that the unlock code is ok, what I'm doing wrong ? I'm at the 3 or 4 unlock attempts and freak about trying other things. Any advices ?
Thanks a lot guys
Are you sure you have the right code?
Try searching for 302610, which is the MCC MNC pair for Bell Canada. The next eight digit number will be the code. (It might be quite a bit further into the file, about 5k for my Gio's bml5.)
I could also try making a modified CSC file to lock your phone to Rogers instead.
Hey man,
Upload your bml5.img here
I'll find the code for ya
ADB Method (Make sure you are rooted!!):
Code:
adb shell
su
cat /dev/block/bml5>/sdcard/bml5.img
exit
exit
adb pull /sdcard/bml5.img
Terminal Emulator Method (Make sure you are rooted!!):
Code:
su
cat /dev/block/bml5>/sdcard/bml5.img
exit
exit
Universal GingerBread Root (Click Me!)
Hi ! Here is my bml5 file. I'm sure that the unlock code is 72618358. Let me know if it's not the case.
I think I dump by catting /dev/bml5, any differences with /dev/block/bml5 ? Thanks a lot !
Yeah man! I got the same code: 72618358
Did you make sure you typed it correctly?
Wheres the tutorial to do this??
Sent from my GT-S5660 using xda premium
voetbalremco said:
Wheres the tutorial to do this??
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=1335548
Hope this helps!
Peteragent5 said:
http://forum.xda-developers.com/showthread.php?t=1335548
Hope this helps!
Click to expand...
Click to collapse
Can you get my code if I can give you my file??
Sent from my GT-S5660 using xda premium
voetbalremco said:
Can you get my code if I can give you my file??
Click to expand...
Click to collapse
Yeah man. But right now I gotta go to the Doctor with my parents. So just upload it here or give me link to mediafire.
Peteragent5 said:
Yeah man! I got the same code: 72618358
Did you make sure you typed it correctly?
Click to expand...
Click to collapse
Yeah sure. It's the reason why I'm posting here. I'm like what the **** I'l probably give up, it's a friend gio and he will probably return it to the store. Just another question, do you know if there a countdown of attempts of unlock ? May I freeze the phone by trying it multiple time ? Maybe I could try to unlock it with the special code #7465625*638*CODE# with no simcard in but like I said, I'l do it only if there is no countdown of attempts of unlock because I don't want to freeze the phone hehe
Salocink said:
Yeah sure. It's the reason why I'm posting here. I'm like what the **** I'l probably give up, it's a friend gio and he will probably return it to the store. Just another question, do you know if there a countdown of attempts of unlock ? May I freeze the phone by trying it multiple time ? Maybe I could try to unlock it with the special code #7465625*638*CODE# with no simcard in but like I said, I'l do it only if there is no countdown of attempts of unlock because I don't want to freeze the phone hehe
Click to expand...
Click to collapse
There is a limited number of tries. I think 3 or 5.
Three is no "CODE" to unlock your phone but a code to tell you if your phone is locked or not.
You must insert a different sim card for this to work.
You must be on Stock Rom.
One more thing you could try, if you're interested:
If you haven't already, install CWM on the phone.
Boot to recovery, fire up adb shell and mount stl5.
Yes, stl5, the dreaded partition known to brick phones the world over. The difference is that we're in recovery here, and should be safe.
ADB pull /efs/mits/perso.txt from the phone.
Open the txt file in a hex editor.
Replace the first 30 bytes from:
Code:
01 00 00 00 00 01 33 30 32 36 31 30 32 30 34 30 34 23 30 30 31 30 31 23 39 39 39 39 39 23
To this:
Code:
00 00 00 00 00 01 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
adb push the file back into place.
Unmount the stl5 partition
Reboot phone. Make sure IMEI is still intact. (If not: sorry...)
Turn off the phone, attempt to use it with a "foreign" SIM card.
Let us know how that goes,
Darkshado
Lol! STL5 is quite risky..
Hee Remco. Just follow the tutorial you can easily do it yourself it's very easy. I followed the second method and unlocked my phone with ease. I if I can do it everyone can. Haha.
Thanks for you helps. If it was my GIO, I'l probably test other things but my friend will get it back to the store for an exchange or something else, I don't know. Maybe newer GIO's got some new security.
Peteragent5 said:
There is a limited number of tries. I think 3 or 5.
Three is no "CODE" to unlock your phone but a code to tell you if your phone is locked or not.
You must insert a different sim card for this to work.
You must be on Stock Rom.
Click to expand...
Click to collapse
Hi all, bumping this thread.
Have a question, I put CM9 beta on my phone and haven't unlocked it. I want to unlock because I want to switch from Bell to Wind.
Will this not work with CM9?
Thanks in advance.
St1ck33 said:
Hi all, bumping this thread.
Have a question, I put CM9 beta on my phone and haven't unlocked it. I want to unlock because I want to switch from Bell to Wind.
Will this not work with CM9?
Thanks in advance.
Click to expand...
Click to collapse
problably not, you can try..
but to do it via stock:
backup via recovery, flash stock, instert the foreign simcard, enter the code, and restore cm9
voetbalremco said:
problably not, you can try..
but to do it via stock:
backup via recovery, flash stock, instert the foreign simcard, enter the code, and restore cm9
Click to expand...
Click to collapse
Thanks. I tried putting in another sim just to see if I get a pop up to input the code, but no such screen came up.
I might try using these from the other thread:
*7465625*638*Code# = Enables Network lock
#7465625*638*Code# = Disables Network lock
*7465625*782*Code# = Enables Subset lock
#7465625*782*Code# = Disables Subset lock
*7465625*77*Code# = Enables SP lock
#7465625*77*Code# = Disables SP lock
*7465625*27*Code# = Enables CP lock
#7465625*27*Code# = Disables CP lock
*7465625*746*Code# = Enables SIM lock
#7465625*746*Code# = Disables SIM lock
source: twilightwap .com /mobile/secrets.asp?phone=Samsung3 (sorry can't post links yet)
Click to expand...
Click to collapse
St1ck33: Unlocking your Gio will only help you selling it. Wind uses the AWS band, which the Gio 5660M (or any other known model of it, for that matter) does not support.
I am not aware of *any* device being able to prompt for a SIM unlock code from when running AOSP or CM.
Darkshado said:
St1ck33: Unlocking your Gio will only help you selling it. Wind uses the AWS band, which the Gio 5660M (or any other known model of it, for that matter) does not support.
I am not aware of *any* device being able to prompt for a SIM unlock code from when running AOSP or CM.
Click to expand...
Click to collapse
Thanks Darkshado - for some reason I thought the Gio would work on Wind.
Oh well, will ride out the rest of my Bell contract.
Alright let me guess you want to unlock your galaxy right.so you went to the play store and downloaded an app that did not work.if you want to unlock your galaxy phone this is how no bs.
1.download super one click on your computer.newest fw works best.hook your phone to comeputer make sure debuging mode is on wait for it to insall the drivers and crap.when its done doing all that open super one click and click root wait for it to finish.super one click puts superuser on for you.
2.dissconnet your phone go to play store down load hex editer.open it.
3.ok your almost done.now this is the vary inporent part so read it all ok.
?
4.in hex editer go to /efs click it then go to /root then /afs then /settings then /nv_data.bin
DO NOT MESS WITH ANY HEX CODE OTHER THEN WHAT I TELL YOU
5. Go all the way down till you see on the left hand side in white 1468 thats the line you must edit to unlock.
6. It will say ff then 01 click on 01 change it to 00 push save.also push save at the bottem.exit the app.turn off phone put in any sim card.it will not ask for unlock code.
NOW YOUR GALAXY IS UNLOCKED HAVE FUN? ANY QUESTIONS POST BELOW? my psn is stellarock 420 email [email protected] twitter.jamesolaney19
I had to wipe my misc partition, and I've lost the WiFi and Bluetooth MAC addresses. It generates new ones in cache, but every time I wipe cache they're reset. I need a clean file, preferably from a tab running 20B, so I can put my own MACs in it. Without a sample, I don't know the necessary offsets/format. Can anyone get this for me? It zips down to only 16KB.
Thanks in advance.
cpurick said:
I had to wipe my misc partition, and I've lost the WiFi and Bluetooth MAC addresses. It generates new ones in cache, but every time I wipe cache they're reset. I need a clean file, preferably from a tab running 20B, so I can put my own MACs in it. Without a sample, I don't know the necessary offsets/format. Can anyone get this for me? It zips down to only 16KB.
Thanks in advance.
Click to expand...
Click to collapse
Not even going to ask why you needed to blank it... :silly:
This is from 20d.
Wifi is at offset 3000 I marked it by setting it to 12 34 56 78 9A BC enter MAC as it appears in hex
Bluetooth is at offset 4000 I marked it by setting it to 12 34 56 78 9A BC also, enter MAC as it appears in hex
The tablet serial is at offset A800 I marked it by setting to 12 34 56 78 9A BC DE F1 23 45 67 89 AB CD, enter it as text as it appears on back of tablet
The tablet CSN is at offset F000. I marked it by 00 the last 7 numbers. Enter as text in format LG0000600000000. No idea where to get for yours.
Wonder what offset 2000 is? looks like CB51S131024000XXX
Thanks, can't tell you how grateful I am.
I was applying various updates to rooted v20B when the tab dropped out to TWRP and would not boot system. Autoprime felt that it was trying to apply OTA, and suggested wiping misc and fota. That recovered the tab, but we didn't count on these other problems. It now comes up after every reboot with new S/N, MAC and Bluetooth addresses.
Hopefully you've given me just enough to get it back online. Again, thank you!
Update: CSN is on the package, a second bar code above the SN. Thankfully I still have my box.
Yours has something about blown qfuse. Since you have 20d and mine's been working okay without that string, I took it out.
That value at offset 2000, CB51S131024000XXX, is actually in there twice. It's also at the end of the large block that begins at 10000.
The device is booting and the addresses are holding. Serial number not displaying correctly in the device, but looks right in the editor. Don't know if there's something else in the file that's supposed to match it.
Do you figure any of these values are part of DRM?
Yeah, DRM is toast. Can't play the preload 4K vids anymore. Oh well.
I know that many people are having this problem and I hope we can find a solution here together.
I've already tried many things to restore my IMEI, a little background:
- Lost my IMEI when I flashed stock rom to unroot the phone.
- Tried flashing different firmwares (LATAM, RETBR, I think they are the same).
- I don't have an EFS Backup.
When I dial *#06#* my IMEI is shown as "0", when I use "mfastboot getvar all" or "mfastboot getvar imei" I can still see my correct IMEI (as shown on the phone box).
On CQATest the only error that I can see is right on the IMEI tab:
Phone ICCID Compare with SIM ICCID: ERROR
Anyone can suggest something that might correct this problem? I don't think anything could make it worse and I'm willing to try everything...
EDIT: Obviously, I can't connect to my mobile network.
This is why I didn't even unlock mine so far.seems many have had this issue
I've seen some people saying that this can occur after flashing fsg and modem plus erasing modemst1 and modemst2.
If I knew that before I could have flashed the stock rom without touching on this images, I don't think it would make any difference.
rfameli said:
I've seen some people saying that this can occur after flashing fsg and modem plus erasing modemst1 and modemst2.
If I knew that before I could have flashed the stock rom without touching on this images, I don't think it would make any difference.
Click to expand...
Click to collapse
From my past moto experience always avoid flashing bootloaders & modems, system files can be flashed without any issues in most circumstances. The only change would be if there's a major update that requires bootloaders and modem images.
As a rule, wait before flashing firmware on a moto phone, I've witnessed people hard bricking their devices flashing bootloaders, downgrading from a updated bootloader is playing with fire in my past experience.
Sent from my XT1635-02 using XDA-Developers Legacy app
flashallthetime said:
From my past moto experience always avoid flashing bootloaders & modems, system files can be flashed without any issues in most circumstances. The only change would be if there's a major update that requires bootloaders and modem images.
As a rule, wait before flashing firmware on a moto phone, I've witnessed people hard bricking their devices flashing bootloaders, downgrading from a updated bootloader is playing with fire in my past experience.
Sent from my XT1635-02 using XDA-Developers Legacy app
Click to expand...
Click to collapse
I've flashed the entire room including the bootloader and modems more than a hundred times (no joke here) trying to fix my problem, only to realize I had lost my IMEI.
What make me think that I can still recover my lost IMEI is that on the fastboot if I write "mfastboot getvar imei" it's still there with the same number that came on the box.
rfameli said:
I've flashed the entire room including the bootloader and modems more than a hundred times (no joke here) trying to fix my problem, only to realize I had lost my IMEI.
What make me think that I can still recover my lost IMEI is that on the fastboot if I write "mfastboot getvar imei" it's still there with the same number that came on the box.
Click to expand...
Click to collapse
Obviously something went wrong, my past experience with flashing the full firmware package you are playing with fire.
Sent from my XT1635-02 using XDA-Developers Legacy app
Did you fix it?
IMEI 0
My phone also stucked at imei 0, wat to do is there any solution
Solution for IMEI 0 caused by broken efs partition is easy: Restore your backup of efs partition.
For the case not the efs partition is damaged but the reading process does not get the efs contents right, do a backup of current efs before any further action if there is any small chance the contents is not damaged.
If you don't have a backup of efs and it is still empty/broken after flashing a standard stock rom, you can contact Lenovo for help. May get expensive, they usually replace the mainboard. They should have the possibility to generate a new key for the efs partition, but my guess is that they are afraid doing so may harm security of that key. It probably is cheaper to replace the mainboard than buying a new device, but not by much. You may consider using the device with IMEI 0 as mediaplayer/small tablet without mobile functionality, and buy a new one.
Are you aware of any change you did to the efs partition?
My imei is 0 but still i can connect to mobile data. Hmmm i dont know what is happening here
Same problem here!
Any solution?
I think without the EFS Backup the only way to restore is send to authorized assitance to change the mother board. Sorry for bad news
I have been doing some research lately and discovered some interesting things that may help you in a way or another, the imei value state is written at efs partition, value which can be located from RV_NV_Manager tool (this one is part from QPST suite from Qualcomm), since this tool is known for having the IMEI changing property, i can't post the link, but Google maybe is a good place to start looking for it.
Here are the steps you can do to recover your imei:
-Write down your imei.
-Start some computer with internet, using windows.
-Find, download and install QPST and Qualcomm HS-USB Drivers.
-Once installed, you must turn off your phone and restart it in the bootloader
-Select QCOM tab and select, then wait until it boots completely, then plug your phone at your computer, some drivers must be starting to install, let it finish (it isn't necessary to reboot after this).
-Open QPST Configuration and go to Ports > Add new port...
-Open Device Manager and look for Qualcomm COM ports connected, then in QPST Ports screen write the COMXX in both fields and close, you should see a connected unknown phone and some ? At some fields, that's just normal.
-Open RV_NV_Manager without closing QPST Configuration, some downloading bar should appear with a screen, just let it finish, and then head down to line number 5xx, it says some IMEI_NV or something like that, if you press 9 text fields in boxes should appear at right hand, select hex values at some checkbox there.
-Look to where you written the imei and now it's the tricky part:
Your imei looks like 874356324678338 (just an example), then you must split them by pairs in this way:
x8 | 74 | 35 | 63 | 24 | 67 | 83 | 38 (since imei has 15 numbers, the first one will go alone with an unknown value)
Then just switch numbers by pairs:
8x | 47 | 53 | 36 | 42 | 76 | 38 | 83
Then start filling the boxes in this way:
1st.- 8 (always)
Then put the numbers in pairs in order and replace the 'x' with an 'a':
2nd.- 8a
3rd.- 47
4th.- 53
And so on...
I hope this can help you, let me know if you recover your imei.
xaskasdf said:
I have been doing some research lately and discovered some interesting things that may help you in a way or another, the imei value state is written at efs partition, value which can be located from RV_NV_Manager tool (this one is part from QPST suite from Qualcomm), since this tool is known for having the IMEI changing property, i can't post the link, but Google maybe is a good place to start looking for it.
Here are the steps you can do to recover your imei:
-Write down your imei.
-Start some computer with internet, using windows.
-Find, download and install QPST and Qualcomm HS-USB Drivers.
-Once installed, you must turn off your phone and restart it in the bootloader
-Select QCOM tab and select, then wait until it boots completely, then plug your phone at your computer, some drivers must be starting to install, let it finish (it isn't necessary to reboot after this).
-Open QPST Configuration and go to Ports > Add new port...
-Open Device Manager and look for Qualcomm COM ports connected, then in QPST Ports screen write the COMXX in both fields and close, you should see a connected unknown phone and some ? At some fields, that's just normal.
-Open RV_NV_Manager without closing QPST Configuration, some downloading bar should appear with a screen, just let it finish, and then head down to line number 5xx, it says some IMEI_NV or something like that, if you press 9 text fields in boxes should appear at right hand, select hex values at some checkbox there.
-Look to where you written the imei and now it's the tricky part:
Your imei looks like 874356324678338 (just an example), then you must split them by pairs in this way:
x8 | 74 | 35 | 63 | 24 | 67 | 83 | 38 (since imei has 15 numbers, the first one will go alone with an unknown value)
Then just switch numbers by pairs:
8x | 47 | 53 | 36 | 42 | 76 | 38 | 83
Then start filling the boxes in this way:
1st.- 8 (always)
Then put the numbers in pairs in order and replace the 'x' with an 'a':
2nd.- 8a
3rd.- 47
4th.- 53
And so on...
I hope this can help you, let me know if you recover your imei.
Click to expand...
Click to collapse
I have only RF NV [Items only] and COM3 and COM 5 is connected. I select port 5 and read all items but I can't find NV_IMEI only under "read supported RF NV Items" at Number 550 is a NV_UE_IMEI_I ... but is this the right?
Have Moto Z