Develop Bugs

[For Dev] /dev/block/mmcblk0p5 reverse engineered, boot images customizable

I'll start this thread by posting the IDA .idb file and a linux shell script that dumps out the stock images.
To use:
adb shell
dd if=/dev/block/mmcblk0p5 of=/mnt/sdcard/something
exit
adb pull /mnt/sdcard/something
run the script with: ./get_images.sh something
Anyone want to make some new custom themed ones?
It was only 1 day's work to disassemble the partition. (Example, Exhibit II disassembled here) If you have other dumps made with dd you want me to take a look at, I might be able to help you.

For example, here's a sample of what the original image looked like, and what the new one looks like when my phone boots.

Huh, I did this the first day I got the phone over 2 months ago. It's no hocus pocus.

soo the boot logo cant be change arcoo???

It can be changed yes.

what are the disadvantages arco? and how are youuu legend? xD
Sent from my GT-I8150 using XDA App

arco68 said:
Huh, I did this the first day I got the phone over 2 months ago. It's no hocus pocus.
Click to expand...
Click to collapse
Please post your .idb file so I can take a look.

Oops, sorry. I thought you were talking about the boot partition. My bad.

arco68 said:
Oops, sorry. I thought you were talking about the boot partition. My bad.
Click to expand...
Click to collapse
No worries.
I like reading any & all .idb's; I'll share any I can get my hands on or generate.

After completing my analysis, the only way to get added functions from odin mode (on this phone) would be to exploit it.
It stores the URB on the stack - so sending shellcode should be possible. If you're interested, please reply with your favorite IRC channel. If your name is Mr. Jongshik, you're the author of the code - mind posting the source?
What added functions? Things like diagnostic & debugging tools. The current stuff is very limited.

More EMMCBOOT versions
I have a different EMMCBOOT version on my phone — images are at some different offsets.
I have attached a file with dumps of partitions 5 and 21 (p21 looks like a boot backup, seems to be called /boot/appsbl_bkp in some places). The backup version in p21 looks like yours (at least image offsets are the same); also the md5sum of the first 1554432 bytes of it is 28ebdcd5ba941c1b9b9cd9ad6f6929f5, and exactly this value is in the table at the start of partition 1 — probably this is the version from factory, and the version which is now in p5 came with FOTA updates (initial version was I8150XXKJ1, updated with FOTA first to I8150XXKJ6, then to I8150XXLA2).

Would it be possible to root my sg2 USCC version of Epic4gtouch.

I was looking at the auto root for FB15 and was wanting to know if it would work for my phone, Android version: 2.3.6, Baseband: S:R760.01 K.FB14. Any help is greatly appreciated.
Sent from my SCH-R760 using Tapatalk

^^ Second this. Just got SCH-R760 (SGS II) from USCC, there is currently ZERO support. Thanks!

I've tried the ek02 autoroot three times and it's not able to push the files. SuperOneClick didn't work either.
Sent from my SCH-R760 using xda premium

themac79 said:
I was looking at the auto root for FB15 and was wanting to know if it would work for my phone, Android version: 2.3.6, Baseband: S:R760.01 K.FB14. Any help is greatly appreciated.
Sent from my SCH-R760 using Tapatalk
Click to expand...
Click to collapse
The fb15 on this phone is ics so not going to work on your GB ROM .....maybe steady Hawkin can make you a kernel to root it with Odin ....all you have to do is ask him he may do it
He may port cwm for you too don't hurt to ask
Sent from my SPH-D710 using xda premium

Epix4G said:
The fb15 on this phone is ics so not going to work on your GB ROM .....maybe steady Hawkin can make you a kernel to root it with Odin ....all you have to do is ask him he may do it
He may port cwm for you too don't hurt to ask
Sent from my SPH-D710 using xda premium
Click to expand...
Click to collapse
That would be great! Thanks for the advice, really appreciate it.

not working
from what I hear zergrush no longer works in 2.3.6. I tried manually installing but it fails on the USCC GS2 (SCH-R760)
[+] Found a GingerBread ! 0x00000118
[+] Found a Samsung, running Samsung mode
[*] Scooting ...
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 149 zerglings ...
[*] Sleeping a bit (~40s)...
[*] Waking !
[*] Sending 189 zerglings ...
[-] Hellions with BLUE flames !

mostly working
So I tried it with my SCH-R760 SGS2 I was able to get root boot recovery. Having the FB14 kernel would make this a snap however the Epic 4g Touch is so close it mostly worked. I seem to have intermittent wifi problems but everything else appears to work without issue.
I got the kernel from step two WISHLINK:wiki.rootzwiki.com/index.php/Samsung_Epic_4G_Touch or directly WISHLINK:goo-inside.me/epic4gtouch/kernel/acs-eb30-clockwork-epic-touch-4g-sep-20-4-00-pm.tar
I tried sweet talking USCC, evidently I'm not as charming as I think I am they told me I'm screwed and don't yet have the re-image. However, the above has the phone working and rooted minus a few problems with wifi.
Good luck.

Margey said:
So I tried it with my SCH-R760 SGS2 I was able to get root boot recovery. Having the FB14 kernel would make this a snap however the Epic 4g Touch is so close it mostly worked. I seem to have intermittent wifi problems but everything else appears to work without issue.
I got the kernel from step two WISHLINK:wiki.rootzwiki.com/index.php/Samsung_Epic_4G_Touch or directly WISHLINK:goo-inside.me/epic4gtouch/kernel/acs-eb30-clockwork-epic-touch-4g-sep-20-4-00-pm.tar
I tried sweet talking USCC, evidently I'm not as charming as I think I am they told me I'm screwed and don't yet have the re-image. However, the above has the phone working and rooted minus a few problems with wifi.
Good luck.
Click to expand...
Click to collapse
If you can get the E4GT kernel to boot on your phone then just use it to install su onto your ROM (/system), then put back your original USCC kernel and you'll be rooted with everything working.
So basically if your adb shell has a "#" prompt, you can just use Auto Root Option A on your phone and install root onto your phone's ROM. Just ignore the zergrush status, even though it fails, the script is still smart enough to install root onto your rom in your situation.
Then to get your original kernel back, figure out which partition has the recovery.bin, which is an unused mirror of your original kernel/zImage.
In the case of E4GT, this is partition /dev/block/mmcblk0p6
To get the mirror of your zImage type the following in adb shell
Code:
cd /sdcard
dd if=/dev/block/mmcblk0p6 of=zImage bs=256 count=32765
Now it is very important that the partition you chose above is really the recovery.bin partition, otherwise the file you just created will essentially be junk and won't allow you to boot your phone (ie *IF* you installed it, your phone *would not boot*)
Assuming you had the correct partition, to install it as your running kernel, you can do
Code:
cd /sdcard
dd if=zImage of=/dev/block/mmcblk0p5 bs=256 count=32765
Please don't go jumping into this unless you fully understand what I suggested.
YOU CAN MAKE YOUR PHONE UNBOOTABLE IF YOU DO THINGS WRONG.
I don't have your phone and the partitions could be different, so I'm depending on you to figure out if things don't make sense.
If you are unsure, ask questions before doing anything.

While I'm just understanding partitions and the like I'm able to follow your instructions but the *IF* parts I'd like to question.
I have:
/dev/block/mmcblk0p6
and
/dev/block/mmcblk0p5
I'm not sure how this correlates to the recovery.bin unless it is apart of one of those files. So for the SCH-R760 with FB14 I'd be looking for how to verify this. I can easily run the suggested lines and looks like everything is there. However to get this far it's been several hours and I'm a bit gun shy as I have to work tomorrow and actually need my phone. Again thank you for the suggestions and help. I'm very close. Everything but wifi is working and very well.

did anyone try flashing the cwm from the touch. it should work because the mount points line up the same. if so i can finish the ics rom and give it to who ever is willing to try
---------- Post added at 09:13 PM ---------- Previous post was at 08:56 PM ----------
sfhub said:
If you can get the E4GT kernel to boot on your phone then just use it to install su onto your ROM (/system), then put back your original USCC kernel and you'll be rooted with everything working.
So basically if your adb shell has a "#" prompt, you can just use Auto Root Option A on your phone and install root onto your phone's ROM. Just ignore the zergrush status, even though it fails, the script is still smart enough to install root onto your rom in your situation.
Then to get your original kernel back, figure out which partition has the recovery.bin, which is an unused mirror of your original kernel/zImage.
In the case of E4GT, this is partition /dev/block/mmcblk0p6
To get the mirror of your zImage type the following in adb shell
Code:
cd /sdcard
dd if=/dev/block/mmcblk0p6 of=zImage bs=256 count=32765
Now it is very important that the partition you chose above is really the recovery.bin partition, otherwise the file you just created will essentially be junk and won't allow you to boot your phone (ie *IF* you installed it, your phone *would not boot*)
Assuming you had the correct partition, to install it as your running kernel, you can do
Code:
cd /sdcard
dd if=zImage of=/dev/block/mmcblk0p5 bs=256 count=32765
Please don't go jumping into this unless you fully understand what I suggested.
YOU CAN MAKE YOUR PHONE UNBOOTABLE IF YOU DO THINGS WRONG.
I don't have your phone and the partitions could be different, so I'm depending on you to figure out if things don't make sense.
If you are unsure, ask questions before doing anything.
Click to expand...
Click to collapse
Here is a mount print out of the sgs2 from uscc that i had someone give me.
http://pastebin.com/k0nXEcKt
---------- Post added at 09:19 PM ---------- Previous post was at 09:13 PM ----------
Can't they just odin flash or heimdall flash the kernel/recovery in, that would be easier, then they truly don't have to root the rom first.

ironfisted said:
Can't they just odin flash or heimdall flash the kernel/recovery in, that would be easier, then they truly don't have to root the rom first.
Click to expand...
Click to collapse
They already did that. That is why they have rooted adb through the kernel. The issue is they are using an Epic 4G Touch kernel which causes some things to not work on their phone. I am suggesting they install their root functionality in the ROM and restore their original USCC kernel/zImage.
Since (according to them) they don't have a package to return to stock, basically they don't have a kernel/zImage to flash in ODIN because it was never provided to them.
Their original kernel/zImage is gone because they flashed over it (presumably before backing it up). That is why I gave them instructions to pull the backup kernel/zImage. Once they do that, whether they install that zImage within Android or through ODIN is not really important. The important part is they get the correct partition to use to pull the backup from so that they have a valid kernel/zImage to flash.
---------- Post added at 09:55 PM ---------- Previous post was at 09:42 PM ----------
Margey said:
While I'm just understanding partitions and the like I'm able to follow your instructions but the *IF* parts I'd like to question.
I have:
/dev/block/mmcblk0p6
and
/dev/block/mmcblk0p5
I'm not sure how this correlates to the recovery.bin unless it is apart of one of those files. So for the SCH-R760 with FB14 I'd be looking for how to verify this. I can easily run the suggested lines and looks like everything is there. However to get this far it's been several hours and I'm a bit gun shy as I have to work tomorrow and actually need my phone. Again thank you for the suggestions and help. I'm very close. Everything but wifi is working and very well.
Click to expand...
Click to collapse
Based on the previous pastebin that was posted it looks like the partitions on the USCC GS2 line up with the Sprint E4GT so it should be safe to run what I suggested.
Both /dev/block/mmcblk0p5 and /dev/block/mmcblk0p6 are linux device files that map to partitions in your phone's EMMC memory.
mmcblk0p5 is labeled zImage (on Sprint) and mmcblk0p6 is labeled recovery.bin (on Sprint). They have the exact same contents. zImage is the kernel and recovery for your phone.
recovery.bin is not being used (on Sprint) so it basically ends up being a backup of your zImage/kernel. Since you overwrote your USCC zImage with the Sprint E4GT zImage (presumably before backing it up) you cannot recover the original from your phone using the partition assigned to zImage.
I am suggesting you retrieve your original zImage from what is essentially a backup in the partition labeled recovery.bin (mmcblk0p6). This can then be installed in your zImage partition (mmcblk0p5) either directly through Android or through ODIN.
Once you create the zImage file as above, keep a copy off your phone on your PC just in case.
The whole purpose of putting back your original USCC zImage/kernel is so all the features work again, but since your root was achieved through the kernel, putting back the original zImage/kernel would cause you to lose root. That is why I suggested, prior to putting back the original USCC kernel, you install persistent root inside your ROM (ie /system)
You can do that by running Auto Root - Option A and ignoring the Blue Hellions error. If your adb is rooted as you described above, Auto Root will still install persistent root in your ROM despite the failure of the zergrush exploit. Once you install the persistent root in your ROM, you can restore the original USCC kernel/zImage and still have root for your applications. You can confirm that Auto Root - Option A did its job by typing:
Code:
ls -l /system/xbin/su
and verifying su is there and it has the proper permissions. If you are unsure, post the output and I can confirm.

What didn't work? maybe its a matter of the rom difference that makes stuff not work. Just an idea. I was thinking of porting the ics rom over to the sgs2 for them.

ironfisted said:
What didn't work? maybe its a matter of the rom difference that makes stuff not work. Just an idea. I was thinking of porting the ics rom over to the sgs2 for them.
Click to expand...
Click to collapse
As mentioned by Margey's post, the wifi wasn't working well. wifi drivers are in the kernel. Margey installed just the kernel/recovery, not the ROM.

sfhub said:
As mentioned by Margey's post, the wifi wasn't working well. wifi drivers are in the kernel.
Click to expand...
Click to collapse
hmmm, so ics is still doable then. hmmmmmm

I just wanted to thank everyone for their help it is very much appreciated. I'm going to try what sfhub posted. I still have my stock kernel since I've been working and haven't had time to do anything. I will try and make a copy of my stock kernel. Can I push superuser into my rom using adb or do I need to flash the Epic 4G's kernel then push superuser and then flash my stock kernel back.
Sent from my SCH-R760 using xda premium

eureka
sfhub said:
They already did that. That is why they have rooted adb through the kernel. The issue is they are using an Epic 4G Touch kernel which causes some things to not work on their phone. I am suggesting they install their root functionality in the ROM and restore their original USCC kernel/zImage.
Since (according to them) they don't have a package to return to stock, basically they don't have a kernel/zImage to flash in ODIN because it was never provided to them.
Their original kernel/zImage is gone because they flashed over it (presumably before backing it up). That is why I gave them instructions to pull the backup kernel/zImage. Once they do that, whether they install that zImage within Android or through ODIN is not really important. The important part is they get the correct partition to use to pull the backup from so that they have a valid kernel/zImage to flash.
---------- Post added at 09:55 PM ---------- Previous post was at 09:42 PM ----------
Based on the previous pastebin that was posted it looks like the partitions on the USCC GS2 line up with the Sprint E4GT so it should be safe to run what I suggested.
Both /dev/block/mmcblk0p5 and /dev/block/mmcblk0p6 are linux device files that map to partitions in your phone's EMMC memory.
mmcblk0p5 is labeled zImage (on Sprint) and mmcblk0p6 is labeled recovery.bin (on Sprint). They have the exact same contents. zImage is the kernel and recovery for your phone.
recovery.bin is not being used (on Sprint) so it basically ends up being a backup of your zImage/kernel. Since you overwrote your USCC zImage with the Sprint E4GT zImage (presumably before backing it up) you cannot recover the original from your phone using the partition assigned to zImage.
I am suggesting you retrieve your original zImage from what is essentially a backup in the partition labeled recovery.bin (mmcblk0p6). This can then be installed in your zImage partition (mmcblk0p5) either directly through Android or through ODIN.
Once you create the zImage file as above, keep a copy off your phone on your PC just in case.
The whole purpose of putting back your original USCC zImage/kernel is so all the features work again, but since your root was achieved through the kernel, putting back the original zImage/kernel would cause you to lose root. That is why I suggested, prior to putting back the original USCC kernel, you install persistent root inside your ROM (ie /system)
You can do that by running Auto Root - Option A and ignoring the Blue Hellions error. If your adb is rooted as you described above, Auto Root will still install persistent root in your ROM despite the failure of the zergrush exploit. Once you install the persistent root in your ROM, you can restore the original USCC kernel/zImage and still have root for your applications. You can confirm that Auto Root - Option A did its job by typing:
Code:
ls -l /system/xbin/su
and verifying su is there and it has the proper permissions. If you are unsure, post the output and I can confirm.
Click to expand...
Click to collapse
I doubled checked su, good. Re-ran the image per your suggestion, all good. I have wifi, I have 3G, I have phone and I have root and CWM.
Thank you.

I have been trying to use the auto-root method after installing the recovery kernel and it keeps saying waiting for device to connect? How can I get it to see my device?

themac79 said:
I have been trying to use the auto-root method after installing the recovery kernel and it keeps saying waiting for device to connect? How can I get it to see my device?
Click to expand...
Click to collapse
You can actually just copy the files to your sdcard and run the script by hand, but the specific reason it is waiting for your phone is because ADB cannot see your phone.
That might be because you haven't enabled USB debugging. It might be because of driver problem. It could be because your ##8778# setting is incorrect.
Have you ever been able to use "adb" with your phone?

sfhub said:
You can actually just copy the files to your sdcard and run the script by hand, but the specific reason it is waiting for your phone is because ADB cannot see your phone.
That might be because you haven't enabled USB debugging. It might be because of driver problem. It could be because your ##8778# setting is incorrect.
Have you ever been able to use "adb" with your phone?
Click to expand...
Click to collapse
I finally got it, the problem was I was missing a driver for my phone. Now I'm trying to make a copy of my stock kernel using your instructions but for some reason when I type cd /sdcard it says it can't find the path specified. It shows my device listed, I don't know what I'm doing wrong? Wait..do you mean to use my phone to make a copy?

themac79 said:
I finally got it, the problem was I was missing a driver for my phone. Now I'm trying to make a copy of my stock kernel using your instructions but for some reason when I type cd /sdcard it says it can't find the path specified. It shows my device listed, I don't know what I'm doing wrong?
Click to expand...
Click to collapse
Are you doing that from an "adb shell"?
You can replace with "cd /data/local/tmp", it can really be any directory where you have write permissions.
If you want to be more bold, you can skip the step of creating a zImage file and write directly from the recovery.bin partition into the zImage partition. The zImage file is nice because if you screw things up and your phone won't boot, you can still use ODIN to flash the zImage (assuming you moved it to your PC)
Code:
dd if=/dev/block/mmcblk0p6 of=/dev/block/mmcblk0p5 bs=256 count=32765

How to backup your modem.

There is a modem for the optimus G here:
http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
but it is from firmware 10b. You may want to try if it works better than your firmware. In this case, it is better if you make a backup of your current modem firmware, so you can go back to your version. Here I will write instructions to backup your modem, so you can restore it if you need.
Probably some of you know this already and feel like these are old news, but maybe we can build a modem firmware library.
You need root and a way to make an adb connection to your phone. If you cannot use adb, you can always use a terminal emulator on your phone, but this makes it a bit harder to type the commands. Also, this is for people who understand what they are doing. If after reading the tutorial you don't understand what the commands do, please don't try it. Or at least don't make me responsible if your phone bricks. Here we go.
NON NEEDED STEPS: This steps are here to show why this works.
1-Connect to your phone by adb.
2- On the terminal type :
Code:
mount
You'll see the following (amongst other things):
Code:
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:radio_efs_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
This means that the partition containing the firmware is /dev/block/platform/msm_sdcc.1/by-name/modem and it is mounted at /firmware.
NEEDED STEPS
1- Connect by adb
2- On the terminal type
Code:
su
Check if confirmation is needed on the phone screen. If needed, accept.
3-
On the terminal type:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
4-You will receive the following after some seconds:
Code:
131072+0 records in
131072+0 records out
67108864 bytes transferred in 29.959 secs (2240023 bytes/sec)
5-Type
Code:
exit
exit
adb pull /sdcard/modem.img
6-Now you have your backup.
HOW TO PACK THIS BACKUP FOR FLASH:
1-Download the file: cwm-lgog_e975-europe-10b_modem.zip from http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
2-Open the zip file and replace the existing modem.img with your file
3-Rename the file to something meaningful, like cwm-lgog_e975-europe-10f_modem.zip
After these steps, you should be able to flash any modem, knowing that you can go back to your old version.
You can upload the packed files here, so we can have a library. I will upload the modem from european 10f version here. I tested it and it works correctly, but I won't take any responsibility for what you do with this file.
Good luck.
All this info is obtained from examining the houstonn LGOG modem flasher from team codefire, so all thanks go to them. Thanks.

Very nice tutorial man. It will help newbies like me to back up and restore our modem.img, especially those who have F180* phones that wants or being converted to E975. Nice job. :good:

Nice,i'll add this to the Freaking Annoying Questions.
Sent from Asylum via LG E975/smart phones,dumb people.

Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app

You should be able to backup your e977 modem following this tutorial.
renatonolo said:
Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app
Click to expand...
Click to collapse

could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.

sonty said:
could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.
Click to expand...
Click to collapse
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
I can, however, tell you how to backup it:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc.img
Can I ask why you need that?

dapaua said:
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
Can I ask why you need that?
Click to expand...
Click to collapse
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.

Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.

dapaua said:
Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.
Click to expand...
Click to collapse
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version

jumper8 said:
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version
Click to expand...
Click to collapse
Thanks.
You are totally right, this partition is not a filesystem. And it is mostly empty, it's all zeros except for some bytes. Most of it are text strings, but there are some small binary parts.
I think the 0x8800 - 0x8824 part is the original firmware version.
I wouldn't touch that partition, seems too dangerous .

dapaua said:
I wouldn't touch that partition, seems too dangerous .
Click to expand...
Click to collapse
freegee touches it. I see it made a backup and the difference is that it changed some bytes to 0 (offsets 0x40-0x52), then wrote ANDROID-BOOT at offset 0x4000. the rest is the same. it seems there's nothing like a crc so basically I could write whatever I want in that version field. the bad part is that as an user you'll never know what modem version you have since its version is not stored on the modem partition. I wonder who came up with this system and what was he thinking.
thanks for the clarification. offtopic over .

sonty said:
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.
Click to expand...
Click to collapse
Some time ago I had the same issue. I solved it by modifying binary data on the misc partition. I was done this only on CM10.1 (F180K). I don’t know if it will work on other custom rom especially stock one.
Today I’ve done this one more time for preparation the following procedure. Maybe some one will use it on the future.
STEPS:
0. Backup the misc partition with your recovery. I was used CWM Advance Edition PhilZ Touch 5:
Backup and Restore-> Custom Backup and Restore->Custom Backup Job->Backup misc (*)
I’m not sure if all CWMs version support misc partition backup. TWRP not support it right now.
1. Dump the misc partition to /sdcard.
Code:
adb wait-for-device
adb root
adb shell "dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc_orig.img"
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 6.539 secs (2565715 bytes/sec)
2. Pull the image to your PC
Code:
adb pull /sdcard/misc_orig.img misc_orig.img
3. Edit downloaded image file by your favorite hex editor (e.g. Notepad++ with Hex-Editor plugin)
Find both baseband name strings (mine were on offset 0x8800 and 0x9000) and change them (CM10.1 use the last one to set gsm.version.baseband in file /system/bin/fetch-swv).
REMEMBER:
- Do not use regular text editor (like Notepad or vi) – they can add some extra characters to the file.
- If possible try to modify only bytes responsible for original baseband name. If the new name is shorter, simply put spaces char (0x20) to clear unwanted chars. If you need to put the longer name, be careful. I don’t know the max size for this string. There are dozens of zeros behind the baseband name on my image file. So, for testing I added extra 20 Bytes text. The new baseband name was shown without problem.
4. Push the modified image file to your phone
Code:
adb push misc_orig.img /sdcard/misc_mod.img
Check if size of the original and modified files are equal.
5. Write the modified image to the misc partition
Code:
adb shell "dd if=/sdcard/misc_mod.img of=/dev/block/platform/msm_sdcc.1/by-name/misc "
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 4.183 secs (4010809 bytes/sec)
6. Reboot your phone
DONE.

Hi all,
I just create a .zip to backup your modem / baseband / radio with your recovery (CWM / TWRP...)

ok as a newbie i cant figure out how to back up modem using adb... but after reading stuff what i did :
downloaded "Android Terminal Emulator" from playstore
open emulator in phone wrote as u mentioned :
su
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
after some seconds this came out :
131072+0 records in
131072+0 records out
67108864 bytes transferred in 15.229 secs
then :
exit
exit
after that i checked sdcard but there was no img file...
then i open file manager from the phone and there it was my precious :laugh:
size = 64mb... is it normal?
anyway .. made a new folder "modem" copied the img file into modem folder (using file manger) again connected the phone to pc copied the modem folder on my desktop...
hope it will help new guys here like me :good:

after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:

pedro5148 said:
after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:
Click to expand...
Click to collapse
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4

akahroba said:
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4
Click to expand...
Click to collapse
I already did that, did not work out ...
any more solution?

pedro5148 said:
I already did that, did not work out ...
any more solution?
Click to expand...
Click to collapse
Get back to JB and wait for your midel update

Back to JB I recovered the IMEI, but I have no carrier signal.
So do the root with towelroot, unlock custom recovery with FreeGee, do I back up EFS, and when I restart the machine it loses the IMEI.
So I install the modem and E97710b.kdz for E97710b model recover EFS and nothing happens, still no sign of the operator ...
---------- Post added at 02:22 PM ---------- Previous post was at 02:22 PM ----------
akahroba said:
Get back to JB and wait for your midel update
Click to expand...
Click to collapse
even going back to JB, I continued without the modem

Sucessfully flashed 98.18.78 recovery into Locked 98.30.1

I understand it is currently not possible to unlock a Razr M with 98.18.94 or 98.30.1 OTA. Never the less, I had been trying to restore a previous VooDoo root that I deleted before the last OTA. Through the experimenting, I screwed up the flash on my phone, and recovering it, I found something that might be interesting.
As others pointed out, downgrading does not work. Flashboot gives various errors. When I screwed up my file system, I was able to flash from 98.18.94 (which I had) to 98.30.1 (which was the only download I could find) using RSD Lite. I was lucky it worked. And since I have been able to experiment and keep flashing 98.30.1 over and over.
I would like to report that in my experiments, I noticed an interesting fact about the recovery.img:
I am able to flash stock 98.18.78 recovery to my phone running 98.30.1.
I have verified the recovery.img contents are not the same, according to a WinMerge file compare, they are ~10% the same
When I try to flash twrp or cwm recovery, the only fastboot error is to the effect "wrong partition size".
The size of .78 and 98.30.1 recovery are the same, 10,485,760 bytes
On the other hand, if I try to flash the .78 system.img fastboot, or use RSD lite to flash .78, I see different security related errors on the phone's fastboot screen- none of which mention partition size. Of course, this is related to the Locked Bootloader I have.
What I wonder is, since the error for the recovery.img is not a security related one, but one of size, and the fact that it took recovery from .78- I wonder if a cwm or twrp made to be the same size as stock Moto recovery, would it be able to sneak in?
Right now my Razr M has gone from 98.18.94 to 98.30.1 with a 98.18.78 recovery. And I'm working ok.
I am not a professional Android Dev. But I am going to do the research and try to modify a cwm type recovery to match the size of a Moto recovery, and see what happens.
I invite anyone with real experience to contribute.
Bryan

bryanwieg said:
What did you say?
Click to expand...
Click to collapse
Well I hope you have something here!
We need someone like jbaumert or Phil3759 to chime in here.

aviwdoowks said:
Well I hope you have something here!
We need someone like jbaumert or Phil3759 to chime in here.
Click to expand...
Click to collapse
I have already found that if I take the OTA recovery and unpackbootimg and then mkbootimg without changing anything.. it recompiles down to aprox 5mb, which is different than the size it started from Moto.
So I am looking at if the size is set in how the img is compiled.

30.1 and .94 are the same updates, just different system versions. As for the other stuff, I'm not even sure what to say. I'm with Avi on this, I definitely would like to see what a dev has to say.

New Philz coming BTW.
http://forum.xda-developers.com/showpost.php?p=48881182&postcount=2003
Others could ask for the padded up Philz or at least Quote my post.
http://forum.xda-developers.com/showpost.php?p=48886733&postcount=2004

aviwdoowks said:
New Philz coming BTW.
http://forum.xda-developers.com/showpost.php?p=48881182&postcount=2003
Others could ask for the padded up Philz or at least Quote my post.
http://forum.xda-developers.com/showpost.php?p=48886733&postcount=2004
Click to expand...
Click to collapse
I found out via a hex editor, both files have empty data insert after the same point, with certificate data at the end, and it winds up making each file the same size. The data before the 'empty data' in each file is mostly different bits.
My current problem is that when I decompile an img, and recompile it, it's bigger, meaning that I cannot insert the 'empty data' at the same point they did.

bryanwieg said:
I found out via a hex editor, both files have empty data insert after the same point, with certificate data at the end, and it winds up making each file the same size. The data before the 'empty data' in each file is mostly different bits.
My current problem is that when I decompile an img, and recompile it, it's bigger, meaning that I cannot insert the 'empty data' at the same point they did.
Click to expand...
Click to collapse
They are both signed with the 128, or more, bit code. Which is what makes this a such a Loooooong shot.

aviwdoowks said:
They are both signed with the 128, or more, bit code. Which is what makes this a such a Loooooong shot.
Click to expand...
Click to collapse
Well, you'r right on the money. I appended data to a CWM recovery the same as Moto did to thiers, including the certificate at the end.
I didn't get a partition size error this time, but I did get a 'Failed to hab check for recovery'.
Granted, I didn't manage to place the 'empty data' at the same point in the file as the stock roms did. Other than that, it must be the certificate.

bryanwieg said:
What I wonder is, since the error for the recovery.img is not a security related one, but one of size, and the fact that it took recovery from .78- I wonder if a cwm or twrp made to be the same size as stock Moto recovery, would it be able to sneak in?
Click to expand...
Click to collapse
No, because it first checks the size (or whether it's a valid image at all) and if the size is correct, it checks the signature.

I found that I can put recovery all the way back to 98.15.66. I haven't tried further back due to kernel version.
I tried to then apply an update ZIP to something pre 98.30.1, and it passed validation (woohoo), but if failed an assert that checked the version in the props. (cry)
I wish there was something in the older recoveies we could exploit.

Really glad to see someone is still trying to find some sort of exploit for this device in it's updated state, it seemed like everyone had completely given up on it. My girlfriend recently grabbed a used Razr M to use for a while but it's fully updated, and I would love to be able to root it for her. I'll be following this thread to see if anything comes of this recovery downgrading

I'm pretty sure you can edit the props from what I can remember.
Sent from my XT907 using xda app-developers app

bryanwieg said:
I found that I can put recovery all the way back to 98.15.66. I haven't tried further back due to kernel version.
I tried to then apply an update ZIP to something pre 98.30.1, and it passed validation (woohoo), but if failed an assert that checked the version in the props. (cry)
I wish there was something in the older recoveies we could exploit.
Click to expand...
Click to collapse
You can use root eplorer free to extract the single img from the 404 or 411 xml.zips
---------- Post added at 10:44 AM ---------- Previous post was at 10:39 AM ----------
Here http://sbf.droid-developers.org/phone.php?device=8
---------- Post added at 10:48 AM ---------- Previous post was at 10:44 AM ----------
The razr hd (2), atrix hd, photon Q all use a recovery w/ same key. Git to work man!

Re:
So, it is RSD that is keeping it from flashing, would the bootloader(locked) boot a recovery partition that isn't signed? Has anybody tried to dd the recovery partition? I will grab a TWRP dd recovery image if you guys have an interest in trying that.
It would still require root and either a terminal emulator or adb shell.

815turbo said:
So, it is RSD that is keeping it from flashing, would the bootloader(locked) boot a recovery partition that isn't signed? Has anybody tried to dd the recovery partition? I will grab a TWRP dd recovery image if you guys have an interest in trying that.
It would still require root and either a terminal emulator or adb shell.
Click to expand...
Click to collapse
Am I alone here now?
Does anyone with a locked boot loader want to try this? I could create a windows shell script to make it easier if that's the worry.

I am willing to try it out. Win 7 64bit... pass me needed staf to flash it
Sent from my XT907 using xda app-developers app

please do
815turbo said:
Am I alone here now?
Does anyone with a locked boot loader want to try this? I could create a windows shell script to make it easier if that's the worry.
Click to expand...
Click to collapse
sure do, i'm on win8, but also had win xp, how can i do it? what to download, what to execute? i can adb shell i think. i've survived from bricked before the screen said "flash failure".

benya274 said:
sure do, i'm on win8, but also had win xp, how can i do it? what to download, what to execute? i can adb shell i think. i've survived from bricked before the screen said "flash failure".
Click to expand...
Click to collapse
I'll post it in just a few minutes. I will also post the required commands and we'll be backing up current recovery. If it fails, it should be no problem to restore your backed up recovery.
Download TWRP image on your phone from: titanroms.com/upload/rec.img
Please get to an adb prompt and run these commands:
su
cd /sdcard
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/recbak1.img
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=/sdcard/recbak2.img
Please ensure that both copies are 10MB. The dd command should end by saying "10485760 Bytes Copied" on all of the "dd" commands.
Now, you should have two backups of the recovery partition and the TWRP Image you downloaded from here all on your sdcard.
You can follow with these commands AFTER your backup has completed.
cp /sdcard/Download/rec.img /sdcard/rec.img
dd if=/sdcard/rec.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/dev/block/platform/msm_sdcc.1/by-name/recovery of=twrprecbak.img
mount -o remount,rw /system
mv /system/etc/install-recovery.sh /system/etc/install-recovery.bak
mv /system/recovery-from-boot.p /system/recovery-from-boot.bak
reboot recovery
In the event of a failed attempt at this you can run the following from adb:
su
cd /sdcard/
dd if=/sdcard/recbak1.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
Give me a holler if you don't understand this well. Good luck, guys.

I am gonna try it out tomorrow,i dont have time to do it tonight cause i need to go to work. My pc on work does not have internet connection I will keep u guys posted on any progress.
Sent from my XT907 using xda app-developers app

Just wanted to say I flashed the old ICS recovery to mine using fastboot commands but it didn't get me very far though.if I then try and flash the corresponding blur zip from recovery it just says invalid signature. Was trying to find a way to downgrade so I could get rooted..
Sent from my XT907 using Tapatalk

H810 Frankenstein with no sound

Phone stopped making any sounds.
what works: bluetooth, wifi, sim card (data + receiving texts, calls not tested)
what doesn't: sensors (rotating), camera, sound
dmesg https://pastebin.com/gY1pgn96
What was flashed that I can find/remember in no particular order
H810_UsU_unlock.zip
h810_21y_modem.zip
H810_UsU_baseband_flash-in-twrp.zip
G4_29a_N_modem_UsU.zip
LG-G4_VideoLag-Fix_EXTRACTME-AND-READ-THE-README.7z
h810_10o_UsU_bootloader_ARB2.zip
lineage-15.1-20190121-UNOFFICIAL-h810_usu.zip
lineage-15.1-20190409-UNOFFICIAL-h810_usu.zip
lineage-16.0-20190512-UNOFFICIAL-h810_usu.zip
and magisk + gapps
zip of sbl1 rpm tz pmic partitions attached.
On a side note I see h810_10o_UsU_bootloader_ARB2.zip that I forgot about earlier. Explains the ARB2 that the phone is at now. Looking back through my bash history I was having these issues before I flashed this.
@steadfasterX per request

You flashed so much stuff steadfaster can't even help you

baconbacon said:
Phone stopped making any sounds.
what works: bluetooth, wifi, sim card (data + receiving texts, calls not tested)
what doesn't: sensors (rotating), camera, sound
dmesg https://pastebin.com/gY1pgn96
What was flashed that I can find/remember in no particular order
H810_UsU_unlock.zip
h810_21y_modem.zip
H810_UsU_baseband_flash-in-twrp.zip
G4_29a_N_modem_UsU.zip
LG-G4_VideoLag-Fix_EXTRACTME-AND-READ-THE-README.7z
h810_10o_UsU_bootloader_ARB2.zip
lineage-15.1-20190121-UNOFFICIAL-h810_usu.zip
lineage-15.1-20190409-UNOFFICIAL-h810_usu.zip
lineage-16.0-20190512-UNOFFICIAL-h810_usu.zip
and magisk + gapps
zip of sbl1 rpm tz pmic partitions attached.
On a side note I see h810_10o_UsU_bootloader_ARB2.zip that I forgot about earlier. Explains the ARB2 that the phone is at now. Looking back through my bash history I was having these issues before I flashed this.
@steadfasterX per request
Click to expand...
Click to collapse
Perfect thx that explains a lot..
As you mentioned already the bootloader stack thing but also another one you flashed 21y modem .. I will need some time to investigate both things and come back to you asap
Update:
ok so the worst thing you had done was flashing the 21y modem. The problem with that one is that it is ARB 3 (see known ARB) and so blown fuses (in areas not related to the bootloader ARB but for firmware).
Anyways that will refuse using several parts of your firmware now.
There is no guarantee if the following would make things even more worse but that's what I would try:
extract the system and the modem partition of the 21y kdz
grab the "etc/firmware/venus.*" files from the extracted system partition and copy them to system/etc/firmware/ (mount "system" in TWRP before)
grab the "image/a2dsp.*" files from the extracted modem partition and copy them to /firmware/image (mount "Firmware" in TWRP before)
boot again and grab the dmesg as soon as possible
again that can make things even more worse so you do this on ur own risk.
Sent from my OnePlus 6T using XDA Labs

Before I do this, because hell why not , is the 21y here https://storagecow.eu/index.php?dir=Xda/LG+G4/H810/AT&T/ what I am looking for? Want to be sure before I make matters worse for myself.

baconbacon said:
Before I do this, because hell why not , is the 21y here https://storagecow.eu/index.php?dir=Xda/LG+G4/H810/AT&T/ what I am looking for? Want to be sure before I make matters worse for myself.
Click to expand...
Click to collapse
Yes the rar file. It will contain a TOT file (so you cannot use SALT to extract) .
TOTs require the windows software :
https://forum.xda-developers.com/showthread.php?t=2600575
Sent from my OnePlus 6T using XDA Labs

How do I grab the files out of system.img . I had to use WindowsLGFirmwareExtract-1.2.1.0-Release as the newest one would dump 20G+ junk files.
Code:
$ file system_691200.bin
system_691200.bin: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
I can't mount the file, after making it the size it wants with "truncate -s $((1159168*4096)) system_691200.bin" it will mount but then is completely empty. Repairing with fsck annihilates everything. What is the trick to dumping/mounting this?
modem.img mounted fine.

baconbacon said:
How do I grab the files out of system.img . I had to use WindowsLGFirmwareExtract-1.2.1.0-Release as the newest one would dump 20G+ junk files.
I can't mount the file, after making it the size it wants with "truncate -s $((1159168*4096)) system_691200.bin" it will mount but then is completely empty. Repairing with fsck annihilates everything. What is the trick to dumping/mounting this?
modem.img mounted fine.
Click to expand...
Click to collapse
The latest should work fine but you have to merge (!) the files once extracted which is a separate option in that tool. For mounting you could then use SALT (advanced menu) if you like
Sent from my OnePlus 6T using XDA Labs

It only extracts one system file, system_691200.bin, there is nothing to merge. That's with 1.2.6.1, I tried several different versions and all of them only list/extract one file. The tot I used is not corrupt (i believe), downloaded 3 more and they all had the same md5.
Do you know offhand if I would be able to push the system_691200.bin onto the phone and mount it just to grab those files?

baconbacon said:
It only extracts one system file, system_691200.bin, there is nothing to merge. That's with 1.2.6.1, I tried several different versions and all of them only list/extract one file. The tot I used is not corrupt (i believe), downloaded 3 more and they all had the same md5.
Do you know offhand if I would be able to push the system_691200.bin onto the phone and mount it just to grab those files?
Click to expand...
Click to collapse
ok when it lists only 1 file there it is only 1. Lemme check if I can do that today.
EDIT:
ah yea another reason why I hate that windows tool.. it extracts bull****.. trying to fix that but that can take some secs
EDIT2:
wow thats is really a stubborn crap.. Cannot mount, resize, fsck, fix, testdisk/photorec , ... (and yea I used DD to get the correct size, offset ...)
EDIT3: @baconbacon
no one is as stubborn as me lol..
ok I have not figured out why that crappy windows software does not extract it correctly but I searched and found another extractor here. (whoa.. that way I could make TOT files support available in SALT...)
compiled. ran. mounted. simply works..
so here you go: http://leech.binbash.it:8008/stock/LG/h810/21y_arb3
you just need: h810_21y_ARB3_system-etc-firmware.tgz
download that one.
extract it and follow the prev post here
jfi:
I am currently uploading the full system image and other stuff of that firmware as well (should be fully uploaded in 40 min or so)
.-

That fixed it completely! Sound works, rotation works, camera works. Installed the newest rom and the phone is quite snappy now. As a bonus it also fixed the video lag.
Thank you very much, you went above and beyond to help me fix this. Is that bitcoin address on your profile accurate?

baconbacon said:
That fixed it completely! Sound works, rotation works, camera works. Installed the newest rom and the phone is quite snappy now. As a bonus it also fixed the video lag.
Thank you very much, you went above and beyond to help me fix this. Is that bitcoin address on your profile accurate?
Click to expand...
Click to collapse
GREAT ! Glad we solved it.
I really hoped it will fix it and yea that's again a proof of fusing in modem and firmware files (due to flashing the 21y modem).. I will remove that one from the list so no one will go for the same journey.
yea my BTC is fine but given some thx click on any of my posts is fine too
have fun!
.-