Develop Bugs

How to backup your modem.

There is a modem for the optimus G here:
http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
but it is from firmware 10b. You may want to try if it works better than your firmware. In this case, it is better if you make a backup of your current modem firmware, so you can go back to your version. Here I will write instructions to backup your modem, so you can restore it if you need.
Probably some of you know this already and feel like these are old news, but maybe we can build a modem firmware library.
You need root and a way to make an adb connection to your phone. If you cannot use adb, you can always use a terminal emulator on your phone, but this makes it a bit harder to type the commands. Also, this is for people who understand what they are doing. If after reading the tutorial you don't understand what the commands do, please don't try it. Or at least don't make me responsible if your phone bricks. Here we go.
NON NEEDED STEPS: This steps are here to show why this works.
1-Connect to your phone by adb.
2- On the terminal type :
Code:
mount
You'll see the following (amongst other things):
Code:
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:radio_efs_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
This means that the partition containing the firmware is /dev/block/platform/msm_sdcc.1/by-name/modem and it is mounted at /firmware.
NEEDED STEPS
1- Connect by adb
2- On the terminal type
Code:
su
Check if confirmation is needed on the phone screen. If needed, accept.
3-
On the terminal type:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
4-You will receive the following after some seconds:
Code:
131072+0 records in
131072+0 records out
67108864 bytes transferred in 29.959 secs (2240023 bytes/sec)
5-Type
Code:
exit
exit
adb pull /sdcard/modem.img
6-Now you have your backup.
HOW TO PACK THIS BACKUP FOR FLASH:
1-Download the file: cwm-lgog_e975-europe-10b_modem.zip from http://downloads.codefi.re/houstonn/lgog/modem/E975_E977_E976
2-Open the zip file and replace the existing modem.img with your file
3-Rename the file to something meaningful, like cwm-lgog_e975-europe-10f_modem.zip
After these steps, you should be able to flash any modem, knowing that you can go back to your old version.
You can upload the packed files here, so we can have a library. I will upload the modem from european 10f version here. I tested it and it works correctly, but I won't take any responsibility for what you do with this file.
Good luck.
All this info is obtained from examining the houstonn LGOG modem flasher from team codefire, so all thanks go to them. Thanks.

Very nice tutorial man. It will help newbies like me to back up and restore our modem.img, especially those who have F180* phones that wants or being converted to E975. Nice job. :good:

Nice,i'll add this to the Freaking Annoying Questions.
Sent from Asylum via LG E975/smart phones,dumb people.

Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app

You should be able to backup your e977 modem following this tutorial.
renatonolo said:
Nice job.. Its work in e977 with 10a firmware?
Thx.
Sent from my LG-E975 using xda app-developers app
Click to expand...
Click to collapse

could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.

sonty said:
could you please do the same thing for the misc partition and upload it somewhere?
I saw that freegee is touching this one so please mention if your phone was opened with freegee.
Click to expand...
Click to collapse
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
I can, however, tell you how to backup it:
Code:
dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc.img
Can I ask why you need that?

dapaua said:
I am sorry, I am not going to upload my misc partition, as this partition contains my IMEI.
Can I ask why you need that?
Click to expand...
Click to collapse
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.

Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.

dapaua said:
Ah, OK. Tomorrow I'll check if the misc partition can be mounted, this would make editing it much easier.
Click to expand...
Click to collapse
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version

jumper8 said:
I think it is not possible to mount the misc partition.
“In any case, the misc partition isn't a "filesystem" partition as you are familiar with. It is actually just a simple data structure. In fact, only the system, cache, and userdata partitions are actually filesystem partitions, and the cache partition is only a filesystem partition part of the time -- during radio and spl updates, it also is used as a simple data structure with a header field and a payload field...”
http://forum.xda-developers.com/showpost.php?p=7254425&postcount=3
I was trying to find some additional info about this structure but without success so far.
On may F180K the misc partition has 16 777 216 Bytes. Some interesting offset:
0x8000 – 0x800E IMEI (15Bytes)
0x8800 – 0x8824 Baseband version (37Bytes)
0x9000 – 0x9024 Baseband version (37Bytes)
CyanogenMod display the last one data on the Settings->About phone->Baseband version
Click to expand...
Click to collapse
Thanks.
You are totally right, this partition is not a filesystem. And it is mostly empty, it's all zeros except for some bytes. Most of it are text strings, but there are some small binary parts.
I think the 0x8800 - 0x8824 part is the original firmware version.
I wouldn't touch that partition, seems too dangerous .

dapaua said:
I wouldn't touch that partition, seems too dangerous .
Click to expand...
Click to collapse
freegee touches it. I see it made a backup and the difference is that it changed some bytes to 0 (offsets 0x40-0x52), then wrote ANDROID-BOOT at offset 0x4000. the rest is the same. it seems there's nothing like a crc so basically I could write whatever I want in that version field. the bad part is that as an user you'll never know what modem version you have since its version is not stored on the modem partition. I wonder who came up with this system and what was he thinking.
thanks for the clarification. offtopic over .

sonty said:
I had no idea the IMEI is also there. I asked for it because the baseband version is also stored there and it's kind of odd to know I'm flashing the modem from EU-10f and the displayed version is TW-10a. I'm still hoping to solve that issue.
Click to expand...
Click to collapse
Some time ago I had the same issue. I solved it by modifying binary data on the misc partition. I was done this only on CM10.1 (F180K). I don’t know if it will work on other custom rom especially stock one.
Today I’ve done this one more time for preparation the following procedure. Maybe some one will use it on the future.
STEPS:
0. Backup the misc partition with your recovery. I was used CWM Advance Edition PhilZ Touch 5:
Backup and Restore-> Custom Backup and Restore->Custom Backup Job->Backup misc (*)
I’m not sure if all CWMs version support misc partition backup. TWRP not support it right now.
1. Dump the misc partition to /sdcard.
Code:
adb wait-for-device
adb root
adb shell "dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc_orig.img"
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 6.539 secs (2565715 bytes/sec)
2. Pull the image to your PC
Code:
adb pull /sdcard/misc_orig.img misc_orig.img
3. Edit downloaded image file by your favorite hex editor (e.g. Notepad++ with Hex-Editor plugin)
Find both baseband name strings (mine were on offset 0x8800 and 0x9000) and change them (CM10.1 use the last one to set gsm.version.baseband in file /system/bin/fetch-swv).
REMEMBER:
- Do not use regular text editor (like Notepad or vi) – they can add some extra characters to the file.
- If possible try to modify only bytes responsible for original baseband name. If the new name is shorter, simply put spaces char (0x20) to clear unwanted chars. If you need to put the longer name, be careful. I don’t know the max size for this string. There are dozens of zeros behind the baseband name on my image file. So, for testing I added extra 20 Bytes text. The new baseband name was shown without problem.
4. Push the modified image file to your phone
Code:
adb push misc_orig.img /sdcard/misc_mod.img
Check if size of the original and modified files are equal.
5. Write the modified image to the misc partition
Code:
adb shell "dd if=/sdcard/misc_mod.img of=/dev/block/platform/msm_sdcc.1/by-name/misc "
OUTPUT:
32768+0 records in
32768+0 records out
16777216 bytes transferred in 4.183 secs (4010809 bytes/sec)
6. Reboot your phone
DONE.

Hi all,
I just create a .zip to backup your modem / baseband / radio with your recovery (CWM / TWRP...)

ok as a newbie i cant figure out how to back up modem using adb... but after reading stuff what i did :
downloaded "Android Terminal Emulator" from playstore
open emulator in phone wrote as u mentioned :
su
dd if=/dev/block/platform/msm_sdcc.1/by-name/modem of=/sdcard/modem.img
after some seconds this came out :
131072+0 records in
131072+0 records out
67108864 bytes transferred in 15.229 secs
then :
exit
exit
after that i checked sdcard but there was no img file...
then i open file manager from the phone and there it was my precious :laugh:
size = 64mb... is it normal?
anyway .. made a new folder "modem" copied the img file into modem folder (using file manger) again connected the phone to pc copied the modem folder on my desktop...
hope it will help new guys here like me :good:

after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:

pedro5148 said:
after installing the European kitkat I lost my LGOG E977 modem, anyone have some backup there to help me?
how to fix this?
:crying::crying::crying::crying::crying::crying::crying::crying::crying:
Click to expand...
Click to collapse
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4

akahroba said:
root using towelroot. unlock and install custom recovery using freegee and flash the modem in this post via recovery: http://forum.xda-developers.com/showpost.php?p=54016773&postcount=4
Click to expand...
Click to collapse
I already did that, did not work out ...
any more solution?

pedro5148 said:
I already did that, did not work out ...
any more solution?
Click to expand...
Click to collapse
Get back to JB and wait for your midel update

Back to JB I recovered the IMEI, but I have no carrier signal.
So do the root with towelroot, unlock custom recovery with FreeGee, do I back up EFS, and when I restart the machine it loses the IMEI.
So I install the modem and E97710b.kdz for E97710b model recover EFS and nothing happens, still no sign of the operator ...
---------- Post added at 02:22 PM ---------- Previous post was at 02:22 PM ----------
akahroba said:
Get back to JB and wait for your midel update
Click to expand...
Click to collapse
even going back to JB, I continued without the modem

[Q] Baseband: Unknown, Modem boot timeout, Couldn't find 'rild' socket.

Hello all and a good day.
Device: Samsung Galaxy Note 8.0 GT-N5100 (3G) - XME (Malaysia)
What I did: Nothing unusual! Device mainly used for text reading and some writing. After updated to Android 4.2.2 (PDA: N5100XXCMI1, CSC: N5100OLBCMH2, MODEM: N5100XXCMI1) via ODIN, the symptom # 1 appeared. The firmware for Malaysia was downloaded from the sammobile.com.
Same time I came to know the importance of /efs backup, so rooted (1st time) the device, backed-up /efs via EFS Pro, used Triangle Away, unroot, and flashed the stock. Since the symptom # 1 continued, I did a factory reset, and then all other symptoms appeared.
Symptoms:
1) Tablet doesn’t vibrate.
2) Kies is unable to detect the tablet.
3) SIM Cards are not detected. A prohibition sign is shown at the cell signal (left to the battery indicator) (see image 1).
4) In “Settings > About device”, and in “Settings > About device > Status”, many fields are stated as “Unknown”, e.g.:
Baseband and IMEI (see image 1 and image 2). Incorrect Serial number (/efs has the correct one as in the back cover).
5) Camera view is upside down.
6) Proximity sensor doesn’t work. In the *#0*# Test mode, Proximity value is 1.0. If exit and check again value becomes 0.0.
7) Regardless of Flight mode or not Cell standby drains the battery a lot. Once activated, Flight mode turns grey (see image 3).
8) [SOLVED, see 5th post] Several times (not always), a white screen appeared at the boot screen (model name), and also when plugged to power source while the tablet switched off. I guess something to do with param partition.
9) [SOLVED, see 5th post] "No command" error message in the stock recovery (3e).
9) “Modem boot timeout” and “Couldn't find 'rild' socket” errors in logcat -b radio.
10) When tried to use the tablet as a modem from Windows 7, it gives an Error 692, and the diagnostics states, “Timed out waiting for response from modem”.
Solutions tried (no success): As many, I too tried various /efs based solutions mentioned in XDA, and flashed all the five firmwares available for the device, but the problem stays same. I tried to solve this without troubling others much, but now I am lost.
Help needed: Is this problem can be fixed by me with some guidance, which would be great since to claim warranty the tablet need to be send to another country. Or is it a hardware problem, therefore I should send it straight to Samsung service without wasting more time?
Attached files, if they help:
1) Outputs of the following commands
logcat -b radio
logcat *:E
dmesg
ls -la /efs
ls -la
mount
cbd -t xmm626x -o t
2)
- recovery log from - CivZ_rev1.1-PhilZ 5.1.1 (touch)
- build.prop file
Thank you for reading. Greatly appreciate any help and guidance. Sorry, if I violate any XDA rules in this post. Kind regards!

New Problem: "There is no PIT partition."
Last night managed to fix a part of the problem (customer.xml error in logcat) in the above post thanks to the guidance from civato. In an attempt to fix other problems, last night I had mistakenly executed the following cmd in ADB while in recovery.
Code:
dd if=/data/media/0/efs.img of=/dev/block/[B]mmcblk0[/B]
The correct one should have used is mmcblk0p3 (/efs partition in Note 8.0). At least I managed to do some damage, otherwise all the credit goes to Samsung.
Now I can go to download mode only. A white screen flashes if try recovery mode or normal boot or even connect to a power source to recharge. Since charging or not also unsure (before this happened battery was 100%), I have a limited time to use the device to get it to work properly. Other problem is, if fail, can’t claim warranty as there’s no way to use the Triangle Away in this situation.
Now when try to flash via ODIN:
1) normal way - it failed stating, "There is no PIT partition." (see image 1).
2) with kona3g.pit I have - it failed stating, "Re-partition operation failed." (see image 2).
Even when the device was working properly, 2nd option never worked for me.
My kona3g.pit read well by PIT Magic 1.3.10.
Can anyone provide me a working .pit for Note 8 GT-N5100. Thinking of trying Heimdall Suite 1.4.0 tonight, but need some reading as I never used it and limited battery time for flashing.
Any advice to recover my device is highly welcome.
King regards.

Here you go, unzip it and in Odin select repartition and then Odin a new stock rom. (PDA)
Or look here for the 5110 pit file it should alos work on the 5100 as the modem partition is also created.
reinstall your csc also after rom onstallation
PS try the included Odin

Working kona3g.pit for GT-N5100
civato said:
Here you go, unzip it and in Odin select repartition and then Odin a new stock rom. (PDA)
Or look here for the 5110 pit file it should alos work on the 5100 as the modem partition is also created.
reinstall your csc also after rom onstallation
PS try the included Odin
Click to expand...
Click to collapse
Brilliant and thank you! The Odin3_v3.07.exe you provided missing an Odin3.ini (see image). I used an Odin3.ini (see attached files) that I have (for the same version) together with your Odin3_v3.07.exe and kona3g.pit, and the flashing went perfectly without any errors. So your kona3g.pit is a genuine working one. Thank you
I’ll continue further tonight and post here. My friend share his laptop with me, therefore I have limited time.
EDIT: When looked from the PIT Magic 1.3.10, the GT-N5110.pit is same as the GT-N5100 one (kona3g.pit). But when looked from the HxD - Hexeditor 1.7.7.0, the signatures at the end of the files are different, so it might not work on the sister device. Also, your GT-N5110.pit has trailing zeros after the signature, somewhere I read that these zeros must be deleted from a hexeditor for it to work.
Kind regards!
Image:

Solutions for symptoms 8 & 9
Solution for symptom 8:
Googled for a param.bin for Note 8.0, but only found one for Galaxy S3. Anyway, being fed up with the white screen, I copied S3 param.bin to the mmcblk0p4 partition of Note 8.0, surprise it worked. But the boot screen became S3 . Later among my backups, I found a param backup of mmcblk0p4 that I took via EFS Pro. Unfortunately couldn't restore it via EFS Pro as I had renamed the tar.gz to keep things tidy. So I extracted it to get a file called param. Since this param didn't work after copying, I compared it in the hex editor with the working S3 param, and noticed EFS Pro add some data to the beginning of the file. I removed this begining data and also the trailing zeros, and renamed it to param.bin (to go along with the name in kona3g.pit, perhaps not necessary). Finally, copied it by "dd if=/sdcard/param.bin of=/dev/block/mmcblk0p4" command, after couple of reboots white screen disappeared.
Solution for symptom 9:
Difficult to say this is a solution but it disappeared after this. In order to send for warranty claim, I restored the device to clean stock. First used Triangle Away to reset the counter. Booted and fully unroot via SuperSU. Then flashed the stock rom with the pit file, and without restart option. Shut down the device and boot into the recovery to do a full wipe, and the "No command" error wasn't there.
I must say, since my modem not working, capslock66's Android Reverse Tethering 3.15 saved my day to download the required Triangle Away add-on via laptop's broadband connection.
Since all other symptoms couldn't be solved my me after much effort, I sent the tablet for Samsung service.

[Q] [HELP] N7105T Baseband IMEI Issues

OK. Think my head is completely red from constant facepalming..
So prior to this:
- Previously on CleanACE 4.x before making the mistake (4.2 bootloader?) - long time no flash flash
- Wanted to try Ditto Note 3
- Have a nandroid backup
- Have a backup of EFS *folder only*, from before going to 4.3 (not sure if this is of any use)
Where I screwed it:
- Hadn't read up on 4.3 stuff much
- Haphazardly flashed things thinking there is always a way to revert seeing I have backups, etc.
- Installed some of the following things (been so much stuffing around since the day she died ):
* DN3 Vegeta edition? (have a feeling this is for N7100, can't even find the thing now) - did not boot
* Flashed: MJ5BLPatch.tar.md5 and WiFi patch from here: http://forum.xda-developers.com/showthread.php?t=2500823
* DN3 LTE edition t0lte/N7105
- After that I had working WiFi but "No SIM inserted message", no baseband version, no H/W info, no Phone info, etc. Everything relating to radio seems to be borked - IMEI is null/null also
What I have tried (was sure to remain N7105 / t0lte specific this time around):
- Flashed 4.2 stock ROM
* Flashed old modem
* Removed EFS folder / restored EFS folder
+ Same issues encountered with baseband / SIM /IMEI
- Flashed 4.3 stock ROM
* Re-flashed modem from stock .tar via CWM package and ODIN
* Re-flashed each partition using Heimdall - N7105/t0lte .PIT, Re-Format - all portions of flashing showed OK including modem, boot.img and sboot.bin
* Removed EFS folder / restored EFS folder - checking owner/permissions were set for nv_data.bin as being radio:radio
- Flashing various kernels for N7105 (no issues encountered while flashing)
- Flashing various modems for N7105 (no issues encountered while flashing)
- NAND Erase all option using stock firmware in ODIN
- Review mount points making sure EFS is being mounted - shows a mount point, folder isn't empty, seems legit
- Review EFS file/folder permissions - main concern was nv_data.bin which was root:root, changed to radio:radio
- At some point I had lost my CSC (CSC was correct in /EFS/IMEI/cantrememberfilename - showing as TEL (Telstra/Australia), this was fixed by flashing stock ROM via ODIN using CSC option
- Also tried using tools such as CDMA Workshop, QPST, Samsung Tool
* Set RMNET + DM + MODEM via *#7284#
* Tried connecting using above tools using the COM port shown under Samsung USB Modem in device manager along with all other COM ports , "No response from phone.." in CDMA Workshop / NV-items_reader_writer.exe
* QPST - I could configure the diagnostic port and add it using QPSTConfig but all fields would show as empty / no phone
* Tested Device Manager -> Modem -> Samsung USB Modem, tested connection in device manager dialog - connection failed
* Trying to enter *#9090# shows Service Mode screen but no options at all to select
Where I am at now:
- Stock ROM with WiFi and correct CSC
- No SIM inserted message
- Cannot turn on mobile network
- Developer mode has switched itself on (power button turns phone off directly, black overlaid box showing device info)
* H/W, Phone, Baseband, IMEI are all blank in the overlaid box
What I am thinking:
- I need to restore baseband somehow but stock restores and modem.bin are not doing the trick
Any ideas / input VERY much appreciated - at the moment it is cheap 3g phone -> WiFi hotspot -> Note 2 WiFi only - *facepalm*
Thanks heaps to anyone who may reply!

kptrip said:
- Developer mode has switched itself on (power button turns phone off directly, black overlaid box showing device info)
EDIT: Sorry - meant to say FACTORY MODE was ON
* H/W, Phone, Baseband, IMEI are all blank in the overlaid box
Click to expand...
Click to collapse
Removed factory mode using instructions here: forums.androidcentral.com/samsung-galaxy-note-10-1/243294-how-exit-factory-mode-into-usermode.html
Open terminal emulator and type as ;
su
rm /efs/FactoryApp/keystr
rm /efs/FactoryApp/factorymode
echo -n ON >> /efs/FactoryApp/keystr
echo -n ON >> /efs/FactoryApp/factorymode
chown 1000.1000 /efs/FactoryApp/keystr
chown 1000.1000 /efs/FactoryApp/factorymode
chmod 0744 /efs/FactoryApp/keystr
chmod 0744 /efs/FactoryApp/factorymode
reboot
Click to expand...
Click to collapse

IMEI is actually Unknown, not null/null.
Also, from phone status:
network=unknown
signal strength=-113dBm 0asu
mobile network type=unknown
service state=out of service
mobile network state=disconnected
my phone number=unknown
imei=unknown
imei sv=unknown
device status=custom (stock -> cf_auto -> philz_touch ->su update)
baseband version=unknown
- Noticed some threads refer to nv_data.bin as .nv_data.bin, cp /efs/nv_data.bin /efs/.nv_data and set full permissions for all users
Same same..

you need a patched kernel as well as modem, this is because the upgrade to 4.3 means that the EFS upgrades to EFS v2, you are going to have to patch it every time you install a new kernel or modem( usually every rom). If you have corrupted the IMEI files, I could be able to send you a "recreated" EFS but unfortunately as this is not strictly legal in some countries, I would require also the country you are from as well as a photo with the battery removed of the IMEI number, Phone serial Number, as well as the Mac address and bluetooth address of the phone, do not post it straight on the forums.
Mods:
Please check if this allowed, as IMEI tempering is a grey area

T999L, failed unlock - now no imei, baseband nor nv_data

My tail of woe. From what I have read there is nothing that can be done but I thought I would ask anyhow.
I was overseas with an SGH-T999L, and took it to a man in a market to be unlocked. 2 hours later it was useless. The man said it would be OK once it was back in the US, but it wasn't. Obviously he didn't keep backups.
Dialing *#06# gives me "null/null".
I cannot turn on wifi (I slie the switch and it slides right back) but can turn on bluetooth, gps and nfc.
Baseband version is "Unknown"
Build number is JSS15J.T999LUVUBNC1
It appears that he used vRoot to get root.
According to the "odin screen"
CUSTOM BINARY DOWNLOAD: No
CURENT BINARY: Samsung Official
SYSTEM: STATUS: Custom
QUALCOMM SECUREBOOT: ENABLE
Warranty Bit: 0
BOOTLOADER AP SWREV: 1
I used this article from techglobal101.wordpress.com 2013/05/02/how-to-solve-no-service-on-samsung-galaxy-s3/ following the imei already corrupt steps to generate
the text file with the imei in it. However the NV Reader/writer has problems. Firstly *#7284# only gives me a choice of "Modem" or "PDA". However *#0808# does give me more options including "RMNET + DM + MODEM". The bigger problem is that the SPC code of 000000 is not accepted, so NV reader/writer can not access anything.
Looking in the /efs filesystem (using "adb shell" and "su" and "busybox find /efs -size +1000k" ) does not find any files larger than 1MB (I believe the nv_data.bin should be at least 2MB) so no original ".nv_data" file, no "nv_data.bin" nor "nv_data.bak". There are smaller files, for example there is a file /efs/imei/mps_code.dat, 3 bytes long containing TMB. The /efs partition is 13716 blocks in size and is only 33% full (4556 blocks in use).
I can use adb to install and uninstall packages, and copy files.
Things which look interesting to me in the output of "getprop" are (with a valid sim card installed)
[DEVICE_PROVISIONED]: [1]
[gsm.operator.alpha]: []
[gsm.sim,state]: [NOT_READY]
[gsm.sim.unknownready]: [1]
So far I have not done anything else. In particular I have not tried using ODIN to download a stock image, nor have I tried removing the files which are in /efs.
I also have not tried creating a 2MB file of NUL characters called /efs/nv_data.bin in the hope that that would at least advance the solution.
I would be pleased to get any good advice on what to do next. Please assume I know my way around a unix command prompt, but this is my first venture into the world of Android.

First thing, don't mess with the efs. It's not relevant to the issue at hand and sounds to be just fine. Most of the NV Data is stored on different partitions. Don't assume its the same as on other devices like many others seem to advise.
Second, download your stock firmware (NC1)(root66 firmware is ok), flash via Odin on your computer, and factory reset (will wipe internal sd). This often fixes these problems without having to touch the NV data.
Something tells me that whoever you took it to may have tried to flash the 4.1.1 modem to use our free unlock method. If so, that will cause the exact same thing you are experiencing now.
If after that it is still not fixed, PM me and I will try to help get your imei restored. We are not allowed to post information, tools, links or further discuss that here, so if it comes to that, I can only help you via PM.
Sent from my SAMSUNG-SGH-I747 using Tapatalk

Restoring Serial Number - SN

Please read Bootloader Unlock and Root Instruction to understand how to work with Qfil.exe
1. Download Ftm - partition from phone. You can do it via Qfil.exe or Root
adb shell
su
dd if=/dev/block/bootdevice/by-name/ftm of=/sdcard/ftm.bin
2. You need to know your Serial Number so go imei24.com or imeipro.info and type yours IMEI.
3. Now open Ftm.bin with Hex.exe ( attached )
Then go Navigation -> Go to Offset... and type 73728
Type SN and save changes.
4. Flash it back in phone with Qfil.exe or copy ftm.bin to internal sdcard
adb shell
su
dd if=/sdcard/ftm.bin of=/dev/block/bootdevice/by-name/ftm
reboot
Done!

And if what I lost was my imei, can I recover it with this method?

IMEI recorded here twice: Offset 53248 and 14680132.
For restoring IMEI you need your backup efs

Thanks a lot for your instructions.
I've successfully restored my S/N on the V35AWM.
I updated my V35AWM to V35ULM last November, then I flashed the wrong firmware version in April 2020 when the newest firmware was released. After I resume the device, I found my S/N was lost but had no idea about how to get it restored.
But there was still a most difficult part in this instruction which is how to enter the 9008 mod, this cost me about 2 hours.
So everything is ready now only awaiting for the new Android 10 to release.

do you have video tutorials
do you have video tutorials?
SaiLas said:
Please read Bootloader Unlock and Root Instruction to understand how to work with Qfil.exe
1. Download Ftm - partition from phone. You can do it via Qfil.exe or Root
adb shell
su
dd if=/dev/block/bootdevice/by-name/ftm of=/sdcard/ftm.bin
2. You need to know your Serial Number so go imei24.com or imeipro.info and type yours IMEI.
3. Now open Ftm.bin with Hex.exe ( attached )
Then go Navigation -> Go to Offset... and type 73728
Type SN and save changes.
4. Flash it back in phone with Qfil.exe or copy ftm.bin to internal sdcard
adb shell
su
dd if=/sdcard/ftm.bin of=/dev/block/bootdevice/by-name/ftm
reboot
Done!
Click to expand...
Click to collapse

SaiLas said:
IMEI recorded here twice: Offset 53248 and 14680132.
For restoring IMEI you need your backup efs
Click to expand...
Click to collapse
Hy chazmatt. Is that possible to restore or change imei if forget to backup.

muzammil457 said:
Hy chazmatt. Is that possible to restore or change imei if forget to backup.
Click to expand...
Click to collapse
No, imei is gone. Now your phone is a tablet.

Kyrimeas said:
No, imei is gone. Now your phone is a tablet.
Click to expand...
Click to collapse
But in v30 there is a way to put imei no through service code *#546368#*933#. We can update imei no thorugh this. In v35 is there any option like this

muzammil457 said:
But in v30 there is a way to put imei no through service code *#546368#*933#. We can update imei no thorugh this. In v35 is there any option like this
Click to expand...
Click to collapse
There is. *#546368#*350#. But once you erased imei, this option gets blocked. Always imei will be 0.

Does missing serial number has anything to do with not being able to make phone calls?
I have a V35 unlocked version (pretty sure this is V350ULM), I flashed it with Korean Q and it worked fine while traveling in Korea. After coming back to U.S. I tried ATT based Tracfone SIM and data works fine but when I try to make calls it always immediately shows Call Ended. I notice the serial number is blank.

hp79 said:
Does missing serial number has anything to do with not being able to make phone calls?
I have a V35 unlocked version (pretty sure this is V350ULM), I flashed it with Korean Q and it worked fine while traveling in Korea. After coming back to U.S. I tried ATT based Tracfone SIM and data works fine but when I try to make calls it always immediately shows Call Ended. I notice the serial number is blank.
Click to expand...
Click to collapse
hp79 said:
Does missing serial number has anything to do with not being able to make phone calls?
I have a V35 unlocked version (pretty sure this is V350ULM), I flashed it with Korean Q and it worked fine while traveling in Korea. After coming back to U.S. I tried ATT based Tracfone SIM and data works fine but when I try to make calls it always immediately shows Call Ended. I notice the serial number is blank.
Click to expand...
Click to collapse
I've got a ULM with the A10 Korean rom. I have no issues making or receiving calls without a SN.

cmrntnnr said:
I've got a ULM with the A10 Korean rom. I have no issues making or receiving calls without a SN.
Click to expand...
Click to collapse
Is it possible for you to share some of your system partitions to get mine to work again? I'm not sure which partitions would be needed to get it back to working condition. I can get it to QFIL mode and flash some. I think this may have happened after some more flashing but not sure. My IMEI is still intact, serial number is blank.

It sounds like you are successfully rooted and on a Korean A10 rom. If you are unsure, follow clouds localize guide then flash the partition image in this post:
[Guide] Make the Korean Q Great Again [relocalise, volte, wowifi, debloat and more]
I've completed all the steps (except for lg weather) and I didn't notice anything different in call features until I saw the description of the international roaming setting referenced "outside of US PR etc." instead of "outside of foreign...
forum.xda-developers.com

It sounds like you are successfully rooted and on a Korean A10 rom. If you are unsure, follow clouds localize guide then flash the partition image in this post:
[Guide] Make the Korean Q Great Again [relocalise, volte, wowifi, debloat and more]
I've completed all the steps (except for lg weather) and I didn't notice anything different in call features until I saw the description of the international roaming setting referenced "outside of US PR etc." instead of "outside of foreign...
forum.xda-developers.com