Related
Here we go!
3 Relevant partitions on the Zune HD:
ZBoot
NK
EXT
(there's actually a 4th partition, but it's a recovery partition for NK to facilitate fail-safe updating)
Enjoy
(a note: some files appear to be damaged, its my first time dumping a CE 7/Zune HD ROM )
(another note: thanks to nd4spd for getting the rom update to me, i don't have a zune hd )
wow I'll take a look.
Anything usable?
These executables are designed for CE 7 and more than likely will not work at all on CE 5 (although things coded for .NET might)
Really, you tell me, though, I haven't actually tried
Awesome! Subscribed...
Wait...so you're telling me it might be possible to create custom roms on the zune hd?!?! i need them to come out with a 128 gb model asap then...
WOW....they were trying to dump a zune rom for years.... so this means the protection on the zune HD is not nearly as strong as the regular zune...this is good news indeed...Mine is on backorder still =x
Another quick Q, did you dump that yourself or find it somewhere?
been trying to find this for a few weeks
looking forward to see what can be done!
are the keyboard files in a format that we can use on windows mobile phones?
votum said:
Another quick Q, did you dump that yourself or find it somewhere?
Click to expand...
Click to collapse
Actually, all I did was reset my Zune HD in recovery mode and plugged it in. When the Zune Software detected it, it downloaded the ROM from MS. When I was defragging my computer a few days earlier, I happened to find the folder where it saved all of the Firmware Updates. So I just looked in that folder and found the FirmwareUpdate.cab that had the .bin files in it.
after messing around with it, looks like nothing can really be recmoded to make dll files. it may need another way to rec mod than in the vk.
So does this mean that the Zune HD will be unlocked shortly?!
Blackwheel said:
So does this mean that the Zune HD will be unlocked shortly?!
Click to expand...
Click to collapse
and does this mean that we will have Zune GUI on winmo devices ?
benko286 said:
and does this mean that we will have Zune GUI on winmo devices ?
Click to expand...
Click to collapse
That could take some time, but once we are able to read the files, i will try to work on a keyboard
setix said:
That could take some time, but once we are able to read the files, i will try to work on a keyboard
Click to expand...
Click to collapse
How about unlocking the Zune HD? Or is that a completely different animal?
Somebody please sticky this thread immediately. This can only lead to great things!
Blackwheel said:
How about unlocking the Zune HD? Or is that a completely different animal?
Somebody please sticky this thread immediately. This can only lead to great things!
Click to expand...
Click to collapse
Err.. forgive my ignorance.. but is Zune HD locked?
In what way?
I think what he means by unlocking is to unlock for ROM modification and development.
ND4SPD said:
When I was defragging my computer a few days earlier, I happened to find the folder where it saved all of the Firmware Updates. So I just looked in that folder and found the FirmwareUpdate.cab that had the .bin files in it.
Click to expand...
Click to collapse
The ROM is saved in a .cab file to %HOMEPATH%\AppData\Local\Microsoft\Zune\Firmware Updates
7-Zip or another unzipping software can extract it out into the 4 .bin files, ext.bin, nk.bin, recovery.bin, and zboot.bin.
I have not yet succeeded to breaking it down into DLLs, it seems like there are multiple DLLs compiled into one .bin file.
Interestingly enough, some of the plaintext I saw in the recovery file was associated with camera/photography code (do a ctrl-f for "autofocus" or "lens" in the recovery.bin file in wordpad). However, I'm guessing it is the remnants of WinCE code, not for the Zune HD (or a successor?). It still begs the question of why it would be included in the recovery code though...
Hope that someone can use this for something...
hairchrm said:
The ROM is saved in a .cab file to %HOMEPATH%\AppData\Local\Microsoft\Zune\Firmware Updates
7-Zip or another unzipping software can extract it out into the 4 .bin files, ext.bin, nk.bin, recovery.bin, and zboot.bin.
I have not yet succeeded to breaking it down into DLLs, it seems like there are multiple DLLs compiled into one .bin file.
Interestingly enough, some of the plaintext I saw in the recovery file was associated with camera/photography code (do a ctrl-f for "autofocus" or "lens" in the recovery.bin file in wordpad). However, I'm guessing it is the remnants of WinCE code, not for the Zune HD (or a successor?). It still begs the question of why it would be included in the recovery code though...
Hope that someone can use this for something...
Click to expand...
Click to collapse
To break it down, you need to use cvrtbin.exe to convert it to the .nb0 format. Once you have that, as Da_G pointed out to me, you can use Xipport.exe's dump xip function to dump whichever converted file. Unfortunately, xipport has an error on the last file, so I'm going to try to fix that this evening.
You can also view the files in Da_G's first post
ND4SPD said:
To break it down, you need to use cvrtbin.exe to convert it to the .nb0 format. Once you have that, as Da_G pointed out to me, you can use Xipport.exe's dump xip function to dump whichever converted file. Unfortunately, xipport has an error on the last file, so I'm going to try to fix that this evening.
You can also view the files in Da_G's first post
Click to expand...
Click to collapse
Ahh... haha, I thought he linked to the raw .bin files and I figured that it would be easier to grab them from your own computer than download them. Whoooops!
I am curious, has anyone disected the Zune HD Hardware? I wonder what extra hardware got left behind that is not currently activated (and possilby not licensed). The core chipset can handle all of the common peripherals that you might find in a WM7 class phone chasis.
At the very least you should be able to see the sort of antenna and amps in there.
the Imageupdate system clearly works, so one approach to updating it (unlocking and or removing security) is to use the imageupdate system (on device or from your desktop, or possibly OTA). Although you would need to know a good bit about the NK and zloader for wm7. WM7 is a more streamlined, efficifient design, but - unfortunatey - there is a lot more in the kernel which makes updating individual bits more difficult without a full link.
It is a little bit more like the X360 design in this sense.
I believe that imageupdate is only known the to the end users as the engine for Windows Phone Update or -previously - FOTA (firmware over the air)
As Da_g mentioned, this is the first commercial device (to my knowledge) to use WCE7/WM7 (in general, WM is just a big OAK on WCE)
What certs are in the full CAB?
I bought a Samsung Saga i770 from eBay since it also works in GSM network. Sure it was locked to US Verizon Wireless. I discovered that there
is a easy to unlock this phone for free using the same way as unlocking Samsung i780 and Omnia i9xx. I believe it may work for Blackjack and other Samsung smartphones with Windows Mobile OS.
Download and copy attached archive into your smartphone and follow the guide. And if you find this guide useful make a little donation since
I really need a better Windows Mobile smartphone
gintasdx said:
I bought a Samsung Saga i770 from eBay since it also works in GSM network. Sure it was locked to US Verizon Wireless. I discovered that there
is a easy to unlock this phone for free using the same way as unlocking Samsung i780 and Omnia i9xx. I believe it may work for Blackjack and other Samsung smartphones with Windows Mobile OS.
Download and copy attached archive into your smartphone and follow the guide. And if you find this guide useful make a little donation since
I really need a better Windows Mobile smartphone
Click to expand...
Click to collapse
Hi,
I cant use this on the Saga i770 locked to verizon. If click any of the lnk files it gives me an error that the file is not certified or something like that. Can you advise?
Thanks
braindia said:
Hi,
I cant use this on the Saga i770 locked to verizon. If click any of the lnk files it gives me an error that the file is not certified or something like that. Can you advise?
Thanks
Click to expand...
Click to collapse
All you need to is to select Yes when you see a message
"The program is from unknown publisher". It's from Omnia ROM.
gintasdx said:
All you need to is to select Yes when you see a message
"The program is from unknown publisher". It's from Omnia ROM.
Click to expand...
Click to collapse
Hi Thanks a lot for your response. This program actually doesnt work, it throws up a window and says
The file "Personalize" cannot be opened. Either it is not signed with a trusted certificate or one of its components cannot be found. If the problem persists, try reinstallling or restoring this file.
All three lnk files give the same error.
Thanks again
It's weird since you only need to extract the all files and open link files. Those link files are pointing into "Personalize.exe" near the .lnk files.
Try to copy "Personalize.exe" into Windows directory and lunch the .lnk files again.
gintasdx said:
It's weird since you only need to extract the all files and open link files. Those link files are pointing into "Personalize.exe" near the .lnk files.
Try to copy "Personalize.exe" into Windows directory and lunch the .lnk files again.
Click to expand...
Click to collapse
same error for me but last month i did use this method to unlock a phone and it worked fine and not i cant remember how i did get pass the error.
any help any body?
braindia said:
Hi Thanks a lot for your response. This program actually doesnt work, it throws up a window and says
The file "Personalize" cannot be opened. Either it is not signed with a trusted certificate or one of its components cannot be found. If the problem persists, try reinstallling or restoring this file.
All three lnk files give the same error.
Thanks again
Click to expand...
Click to collapse
ok ok i just unlock it again. copy all the files to the windows folder and they will work fine then follow the pdf file. DONE!
Decided to release these as Microsoft still didn't release those emergency files. Feel free to request emergency files on this thread, since I can't know exactly for all all models which don't have any emergency payloads, and wouldn't surprise me if there's more than the Lumia 650 being affected by this.
Quote from the Readme
Here's the Lumia 650 emergency files, which were never publicly released by Microsoft.
Will help anybody which have a 650 stuck in download mode, or may help you in the future.
Nobody knows why MS never released them, but it wasn't for the best for sure.
Have fun!
Click to expand...
Click to collapse
Download link: https://mega.nz/#!vA0B0JoZ!MsMH55zArDATJ-OHPz66ldfofGcqkC_Dl6qWBdaK5tU
Feel free to mirror it, and share it with anybody having problems with their devices in dload.
To delete.
Thanks so much - just one question:
In the zip file there are emergency files for a never released phone RM-1151 - but emergency files for the aussie / kiwi variant RM-1153 are missing. Do you have this, too?
pete_es said:
Thanks so much - just one question:
In the zip file there are emergency files for a never released phone RM-1151 - but emergency files for the aussie / kiwi variant RM-1153 are missing. Do you have this, too?
Click to expand...
Click to collapse
Didn't pay attention, I might have included a prototype payload with the set, anyway all payloads that are in the zip file work on all 650 variants, regardless of the RM, so not really a problem.
DilanChd said:
Thx
Have you .xml config file too? Even if we can create them ourselves.
Click to expand...
Click to collapse
I have no xml file that goes with this, shouldn't be needed since thor handles elf payloads like these just fine without any xml
To delete.
What about l550?
To delete.
DilanChd said:
Emergency files of RM-1127 and RM-1128 are already officially released, go to lumiafirmware.com.
Click to expand...
Click to collapse
Ok, thank you
Thank you
Thank you! I waited for it almost a year, now my 650 DS alive
-mode emergency -hexfile "MPRG8909_fh.ede" -edfile "RM1154_fh.edp" -ffufile "RM-1154\RM1154_1078.0042.10586.13333.15855.035346_retail_prod_signed.ffu"
Click to expand...
Click to collapse
Tried this and my phone is not more zombie. A lot of thanks again
swizzbeats said:
Thank you! I waited for it almost a year, now my 650 DS alive
Tried this and my phone is not more zombie. A lot of thanks again
Click to expand...
Click to collapse
Happy to have helped, even if you sadly had to wait a whole year
DilanChd said:
Sahara protocol had never worked without .xml file for me. E.g, last Friday I had used the emergency mode of Lumia 532. WDRT had downloaded .ede and .edp files for that device. It had downloaded .xml file too. However, it had not used the .xml file, the emergency mode had failed. Then, I had used thor2 to running the cmd using the .xml file, the emergency mode had worked.
Click to expand...
Click to collapse
It really depends on the phones, sometimes you have to hammer it a couple of time for it to work properly, but for elf payloads there's really no need.
What is the use of this files
gus33000 said:
Decided to release these as Microsoft still didn't release those emergency files. Feel free to request emergency files on this thread, since I can't know exactly for all all models which don't have any emergency payloads, and wouldn't surprise me if there's more than the Lumia 650 being affected by this.
Quote from the Readme
Download link: https://mega.nz/#!vA0B0JoZ!MsMH55zArDATJ-OHPz66ldfofGcqkC_Dl6qWBdaK5tU
Feel free to mirror it, and share it with anybody having problems with their devices in dload.
Click to expand...
Click to collapse
What can we do by using this files
To delete.
To delete.
DilanChd said:
@Cholens
Maybe you should add them to lumiafirmware.com ?
Click to expand...
Click to collapse
The best thing would be MS adding them to repair avoidance... But sometimes I also wonder if they lost some stuff for lumias or not internally...
swizzbeats said:
Thank you! I waited for it almost a year, now my 650 DS alive
Tried this and my phone is not more zombie. A lot of thanks again
Click to expand...
Click to collapse
how were you able to use this command? I tried this but it say it has no connection with the phone. the phone was connected well with WDRT but everytime I flash with it and flash was completed, after it restart it doesn;t change the os and firmware is still unknown; same goes with thor2 command line
I was able to dump the RDC that is provisioned to my 640 XL prototype. I dumped it and renamed it with a .bin extension. Have a couple of questions for those that know more about as I currently know little.
1. What is the RDC file, meaning what does it consist of? Or how is it used?
2. Where is it written when writing it from thor2? Or where is it stored on the phone?
3. Can it be re-used or is it good only for the one device it is provisioned to?
So, I am not sure if "dump" is the correct term to use here, as the command from thor2 would include the option -readrdc which sends it to a file that you choose...So it is reading something from the phone and generating a file...
I opened the file in hex editor but see little about its contents. It is small in size, about 804 bytes. I tried to write it to a different device same model but it failed with a specific error "Certificate error 25 (0x19) (0)"
Thanks.
Where to get prototypes phone?
nate0 said:
I was able to dump the RDC that is provisioned to my 640 XL prototype. I dumped it and renamed it with a .bin extension. Have a couple of questions for those that know more about as I currently know little.
1. What is the RDC file, meaning what does it consist of? Or how is it used?
2. Where is it written when writing it from thor2? Or where is it stored on the phone?
3. Can it be re-used or is it good only for the one device it is provisioned to?
So, I am not sure if "dump" is the correct term to use here, as the command from thor2 would include the option -readrdc which sends it to a file that you choose...So it is reading something from the phone and generating a file...
I opened the file in hex editor but see little about its contents. It is small in size, about 804 bytes. I tried to write it to a different device same model but it failed with a specific error "Certificate error 25 (0x19) (0)"
Thanks.
Click to expand...
Click to collapse
A RDC file is a research and development certificate tied to the device hardware it came with, it will only work on the device it was shipped with, having the same IMEI, hardware serial number and everything unique, you can't use them with other devices at all.
@gus33000
I was almost certain it was unique to the device it was installed in. Does it reside on the boot partition? Thanks for sharing.
nate0 said:
@gus33000
I was almost certain it was unique to the device it was installed in. Does it reside on the boot partition? Thanks for sharing.
Click to expand...
Click to collapse
It's in DPP along with all other provisioned data specific to the phone, you won't be able to do anything with it, just abort, you'll loose time and you'll most likely brick devices.
Was only wanting to know more about it. Thanks again.
nate0 said:
Was only wanting to know more about it. Thanks again.
Click to expand...
Click to collapse
Also as a tip, never overwrite MODEM*, SSD, and DPP with the ones from another phone, it will be destructive for prototypes. I advise you make a full backup of the prototype emmc first, before doing anything, (even if it's just reflashing with a ffu, it's very important to back everything up in mass storage using something like Win32 disk imager), if you however for some reason ever end up with wrong MODEM*, DPP and/or SSD, boot to flash app, switch to download mode, send the emergency payloads for that device RM, and write the rdc, writing it without DLOAD won't work.
DPP is the one nice to work with but never copy and replace, delete and eventually copy over onto it
I need this file
Can you help
Kidsnet said:
I need this file
Click to expand...
Click to collapse
I sold this phone along with dozens of other Lumias and Windows Phones over 2 years ago. I do not own the phone anymore, and I unlikely will find that RDC file if I even backed it up. It would be almost to you unless you are the new owner of this exact device that I dumped it from. Are you planning to use the file for any other reason?
I got a refurbished mobile came locked so i have to fl it since its demanding protection key so i need help
nate0 said:
I sold this phone along with dozens of other Lumias and Windows Phones over 2 years ago. I do not own the phone anymore, and I unlikely will find that RDC file if I even backed it up. It would be almost to you unless you are the new owner of this exact device that I dumped it from. Are you planning to use the file for any other reason
Click to expand...
Click to collapse
Kidsnet said:
I got a refurbished mobile came locked so i have to fl it since its demanding protection key so i need help
Click to expand...
Click to collapse
They are coming already locked, or if there's any tool i can download so that it will vo well with m
Sounds like the lock you are seeing is like a safety net lock. Someone must have had windows on it but had logged in with their account in Windows 10 mobile and set up the Reset protection with their Microsoft account. There is a method to remove that but it is quite dangerous and could ruin the phone.
There is a way to by pass it though as a work around so that you can use the phone but every time you hard reset it it will always lock back.
nate0 said:
Sounds like the lock you are seeing is like a safety net lock. Someone must have had windows on it but had logged in with their account in Windows 10 mobile and set up the Reset protection with their Microsoft account. There is a method to remove that but it is quite dangerous and could ruin the phone.
There is a way to by pass it though as a work around so that you can use the phone but every time you hard reset it it will always lock back.
Click to expand...
Click to collapse
@Kidsnet this is especially a problem for a lumia 640/640 xl. Because what happens is that if they upgraded it to Windows 10 mobile and enabled the protection but you reflash it back to Windows phone 8 you will unlikely set yourself up to not even get a workaround to get in the phone. Since the provisioning of W10M and WP8 are completely different.
OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
fastboot erase modem st 1
fastboot erase modem st 2
Click to expand...
Click to collapse
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
BlazingBullets said:
Thank you very much for this, life saver.
My wifi and bluetooth works fine but I cannot get my mobile to power back on. When I go into the menu mobile power is just not there :/
Do you have the global or the cn version?
Click to expand...
Click to collapse
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Greatuser123 said:
Hi bro, Nice to meet you and I did my best to help you out, as I spent some stress on this when I was one of the first people that suffered with this issue. And gladly you solved it, bro you misunderstood badly about I did not want to give you the qcn, I was going to give you my qcn file but first I was asking to you for some proof , photo of same phone as me and the package to know that you are not going to change or edit badly ( doing mischievousness) as you never sent the proof I did not send the qcn file.. you can re check again your messages. Bro
Click to expand...
Click to collapse
No no, please do not think I meant you by that. It was other users (understandably) that questioned my motives before you. I absolutely would have taken you up on your offer if I did not already have the phone on the way Either way, I really appreciate your help during this, and I hope you continue to help other users the same way you did for me.
decrypterfixer said:
This QCN came from a global device, but I imagine this could be used to recover the mobile at least temporary to fully fix the device, no matter the origins.
Sorry for the delay.
Click to expand...
Click to collapse
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
BlazingBullets said:
After a lot of heart ache and even making an EDL cable I could not get cell network back. I"ve sent it into ASUS to get fixed. I have made a few backups and will diff them when I get my device back so hopefully I can see what they have fixed so others don't have to experience this.
Click to expand...
Click to collapse
I can help u
Well done mate you will be a hero someday haha good job ?
Leevii2208 said:
I can help u
Click to expand...
Click to collapse
Please provide your support ouvertly here and not via social media!
I've edited your post; please refer to https://forum.xda-developers.com/oneplus-5t/how-to/telegram-chat-channels-forward-t3765018
not work
ty but not working or i did wrong. i wrote (change my imei, two way u and other program) and post new "good.qcn" (i see finished in QPST Software). i restart phone but nothing change. i think phone in document just "read-only".
I want redmagic 3 qcn file
good job bro
Is it works for rog phone 3?
I can't find that hex
hello friends 08 3A 85 99 99 99 99 99 99 no found please help me
Hi, perfect post friend. Im try backup qcn to my Rog Phone 3, but when try said Satuts: Memory Backup Failer and Errors: Disr Error while write to file, any solution to this? I appreciate your help.
decrypterfixer said:
OOPS!
You were following guides on XDA, and throwing random commands in ADB from the posts under the guides (DON'T DO THIS!) and now your slick new ROG phone 2 doesn't have mobile data, calls, wifi, or bluetooth. You quickly find out that flashing the phone with any firmware old or new, doesn't help you, as this issue is directly linked to your chip in your phone.
I quickly found that I needed a QCN file from someone with a rog 2 phone, however I could not get any help here on XDA except from the user Greatuser123, who did not want to give out his QCN file (understandably), but did send me some notes to try and help with other tools.
With nothing working, and no QCN file, I ordered another ROG 2 and waited for it in the mail. After it got here, I quickly extracted the QCN file, replaced the IMEI's in it, and used QPST to restore my phone.
I am simply writing this guide with the generic QCN file with my info masked out of it, so no one has to go through what I went through.
Common issue
This most commonly happens with ROG 2 Phones from the commands:
DO NOT RUN THESE COMMANDS UNLESS YOU KNOW WHAT YOU ARE DOING!
(spaced command to ensure no one runs this!)
On most phones, on a reboot, these partitions would be restored on reboot, but not on most ROG's.
Prerequisites
Rooted Phone
QPST
Qualcomm USB drivers
IMEI Converter
Platform Tools
The Fix
Follow the above root linked video, or find the root thread for your phone here on XDA, and root your phone. This will not work unless you are rooted, although I do not know how you would get into this mess without having your phone rooted already.
Install QPST tools
Install Qualcomm USB drivers
Download the attached zip "good_qcn.zip" and extract the .QCN file anywhere on your machine
Open the .QCN file with any Hex Editor (I used HxD) and search for the Hex-Values: 08 3A 85 99 99 99 99 99 99
NOTE: There will be TWO locations with this value. This is where your IMEI_1 and IMEI_2 will go. Your IMEI_2 goes into the FIRST occurrence, while your IMEI_1 goes in the second.
Download the IMEI Converter app and type in your IMEI_1 and click "Convert", place the converted hex output into a notepad or similar
Do the same for your IMEI_2 and place it in the same location
Now that you have the HEX version of both your IMEI's, paste your IMEI_2 in the FIRST occurrence of the fake IMEI in the QCN file
Paste your IMEI_1 in the last occurrence of the fake IMEI and now save your new .QCN file.
Ensure your device is in USB Debugging Mode.
Download and extract the Platform Tools if you do not have them already.
Plug your phone into your computer using either port
Navigate to your extracted Platform Tools and in a Command Line type "adb devices" to ensure your device is visible.
Run a shell with "adb shell" and elevate your permission with "su"
Now it is time to enable Diag mode by running "setprop sys.usb.config rndis,diag,adb"
At this time, if you installed the Qualcomm Drivers, your device manager should have a port similar to "Qualcomm HS-USB Diag". If not keeping trying to re-enter diag mode and ensure the drivers are correct.
Open up "QPST Configuration" which was installed earlier. You should see your phone listed under "Active Phones". Click "Start Clients" -> "Software Download"
The Port field of the QPST Software Download should list your phone, if not something is wrong.
Click "Restore", and in the xQCN field, click "Browse", change the file type from XQCN to QCN, and select your newly made QCN file
Click "Start", and once the process is done, restart your phone
Conclusion
If all went well, your phone should now have all its bells and whistles again. Sometimes it may require a Factory Reset, and this should always be the practice anyways. If you have mobile data, but only H+ or EDGE, dial *#*#4636#*#* on your phone and ensure LTE is provisioned.
Good luck guys!
Special thanks to: Greatuser123 for helping when no one else would, and HomerSp for his many useful guides that some tools and knowledge was borrowed from.
Click to expand...
Click to collapse
I tried it till finish, but when I check, I lost my wifi mac address (status unavailable) and my imei still unknown. And now I wanna retry, I stuck at QPST Configuration application at step 17, it sometimes detected the phone, sometimes don't, it make me can't continue to click "star clients", (check in device manager, nothing wrong). can you help me?
sure which device rog 2 or 3?
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
uhhg that's a issue just download visual c++ redistributable 2010 sp1 x86 and it should be fine
gjkhan said:
sure which device rog 2 or 3?
Click to expand...
Click to collapse
Rog2. The port keep blinking when in QPST Tools, sometimes it detected, sometimes don't, so I can't copy the qcn to the phone. And also I don't know what's wrong with the qcn, I had follow the instruction, but it not works
hmmm use another pc or cable.
gjkhan said:
hmmm use another pc or cable.
Click to expand...
Click to collapse
Try itt but problem still persist