[Q] Writing NV Items - Droid RAZR M Q&A, Help & Troubleshooting

Hello,
How do I write to NV items on the Razr M? I've tried DFS and QPST, but it never sticks. I think it's read-only.
I'm specifically looking to write HA/AAA keys. On my HTC, there was the "open sesame door" trick to unlock the nvm directory in EFS explorer. Anything like this for the Razr M? Will unlocking the bootloader help with this by any chance?
Thanks.

Related

Unlock t mobile galaxy vibrant sgh-t959

CAN ANYONE HELP ME UNLOCK MY T MOBILE GALAXY FOR THE NETWORK PASS CODE KEY TO USE WITH DIFFERENT SERVICE.....MAYBE WITH THE USB CORD WAY 1ST
helroz said:
keep the backup is a safety
If you have froyo on your phone, only solution: (or samsung for repair)
http://perso.numericable.fr/helroz/Perso/repair_nv_data.zip
this method give informations in your bad nv_data.bin (imei, Model, product code) and insert this in a new nv_data.bin (sim unlocked).
After this new nv_data.bin (sim unlocked with your informations) is inserted in your phone, at restart, your phone create nv_data.bin.md5 and batch file create .nv_data.bak and .nv_data.bak.md5 and save your new efs folder.
Your phone is unlocked
It's possible to made this on froyo but not advised and not really tested (I repair codes at the same time but at the first start froyo change codes by FFFFFFFF)
Thanks to Mikiya on Frandroid to made "Reparation_nv_data.jar" at my demand
Thanks to vnamee for detailled instructions:
Just did this on my phone and it works great. The SGS unlock tool gave me a number that did not work no matter what firmware I used. Here are the steps to perform the unlock.
You will need root and busybox and something to edit the root, such as Root Explorer or ADB. You will need Java on your PC as well.
1) Copy the EFS folder with Root Explorer or ADB to back up
2) In /efs, delete:
nv_data.bin.md5
.nv_data.bak
.nv_data.bak.md5
nv_data.JPC (you may not have this)
nv_data.JPC.md5 (you may not have this)
.nv2.bak
.nv2.bak.md5
3) Reboot your phone and navigate to /efs to see if nv_data.bin.md5 is created. If it is, you are good to go. If you go there right after the phone boots, it may not have been created yet.
4) Put your phone in USB debug mode and connect via USB to computer.
5) Run step 2.bat (this will extract nv_data.bin to your computer)
6) Run reparation_nv_data.jar (I guess you just enter any 8 digit number in the boxes that will be your unlock code. I had entered '00000000' and SGS unlock couldn't find anything afterward, so I'm not sure if this number will be needed at any point in the future. This will edit the nv_data.bin).
7) Run Step 4.bat (this will upload the files to your phone. Make sure the phone is on and when you run it, make sure to keep pressing 'allow' so the program has root access to push the files to your root).
8) After this is done, you can answer 'n' if there were no errors and it should reboot your phone. Phone should be unlocked.
Phone must have nv_data in /efs folder, with all firmware, if at start you don't have nv_data, phone create it, but generic with no imei.
Click to expand...
Click to collapse
here is the thread for that, http://forum.xda-developers.com/showthread.php?t=822008
Or the simple way, use this app to unlock
https://market.android.com/details?id=com.helroz.galaxysunlock&feature=search_result
Make sure you read through the instructions.
check here
u should check here it helped me unlock my phone last week
http://forum.xda-developers.com/showthread.php?t=761045
it was confusing at first for me but it was pretty simple all the instructions are there if u have any problems u can leave a post and some will help out
I just used this application, worked fine. I rooted my phone first just to let you know.
https://market.android.com/details?id=com.clarkehackworth.SamsungGalaxySUnlock&feature=search_result
iynfynity said:
here is the thread for that, http://forum.xda-developers.com/showthread.php?t=822008
Click to expand...
Click to collapse
This method helped me unlock my phone when the sgs unlocker failed to extract the unlock code. It kept saying "unlock codek". The above method maybe a lilttle tricky for beginners, first back up your efs folder and try it.
MilkPudding said:
Or the simple way, use this app to unlock
https://market.android.com/details?id=com.helroz.galaxysunlock&feature=search_result
Make sure you read through the instructions.
Click to expand...
Click to collapse
This didn't work for me
m4r10 said:
This didn't work for me
Click to expand...
Click to collapse
Ya it won't work if you didn't read through the instructions.

[Q] Fastboot/Restore Razr Maxx

After looking through the forums for a few days and trying a few different things out, I am still stuck in the same situation that I have yet to come across. For starters, I have a Droid Razr Maxx XT912. I have never rooted the device. It stated to go through a bootloop? (Droid eye never stopped its animation and booted) After about two hours of doing that it finally booted. About two hours later it reset itself and did the same thing but never booted up again.
I don't have USB Debugging on, and I feel like that's half the battle for what I have been trying to do. I tried whipping everything and doing a factory reset, but that didn't work either. I have the drivers for the phone installed. I using the Droid Razr Utilty tools and RSD Lite to restore my phone. I used VRZ_XT912_6.7.2-180_DHD-16_M4-31_1FF.xml.zip and the Flash failed. When I try to use the Droid Razr Utility it says 'fastboot' is not recognized as an internal or external command, operable program or batch file. I'm assuming that may have something to do with debugging and ADB? Currently I am stuck and just don't know what to do or to try. Am I helpless without USB Debugging? Is there a way to turn it on without being able to boot the phone?
Help or advice would be greatly appreciated. And if there is a forum out there with this or a very similar issue, can you point me in the right direction.
Thanks guys,
Frustrated Noob
xxDarkkentxx
xxDarkKentxx said:
When I try to use the Droid Razr Utility it says 'fastboot' is not recognized as an internal or external command, operable program or batch file. I'm assuming that may have something to do with debugging and ADB?
Click to expand...
Click to collapse
Look in the folder that your utility is running from and make sure you have the file "fastboot.exe"
If it's missing for some reason, download the android sdk, unpack it and go into platform-tools, and copy all the files into your utility folder. Considering it isn't working anyway, I would do this even if you see the file, and just overwrite it.
You need the fastboot.exe file to run fastboot commands, and you need to be running command prompt in the folder where fastboot.exe is located. Otherwise, it will give you that error, because fastboot is not a normal windows command.
You could also find a working fastboot.exe and add it to your system variables to make the fastboot command work as a windows command(so you don't need to run it from the same folder that fastboot.exe is in), see this droid forum thread about setting that up. The steps are under the "Making it a little easier" section. The process is outlined for adb.exe, but its exactly the same steps with fastboot.exe. it might be a good idea to add both to system variables.
Thanks, I will give it a try and see if I get any results. I will let you know how that goes!
I hope you tried using the utility for the RAZR Maxx and not the RAZR m they are two different phones
If you used the wrong utility it can mess you up pretty bad
Sent from my XT907 using Tapatalk 2

[GUIDE] VZW Note-4 DE Backup Developer Partitions

GUIDE how to backup Verizon Developer Device aboot Partition​
All Samsung Developer Devices are identical to retail devices with exception of one partition "aboot". What is all this fuss aboot? This partition holds the magic that unlocked your bootloader. It has a signed SHA256 key that a thousand Monkeys could not crack. If this partition is overwritten or corrupt the DE phone could brick, and bootloader will lock. Welcome to retail. This partition is device ID specific and coded to the device with super encryption. If this partition is backed up prior to corruption, it could be possible to restore a locked developer device. Some discussion of DE's aboot here and here
As of this writing several DE owners were smart enough to backup aboot, several were able to restore their unlocked bootloader. They were able to restore with the help of several XDA devleopers that were able to take the pre-saved aboot, and make it into an Odin flashable tar. It was reported that EFS Professional could create an Odin flashable aboot.tar.gz, that doesn't need any prior modifications. This info was incorrect, all backups of aboot will require modification prior to flashing. If you accidentally "Retail" your DE, post to this thread, and myself or one of the other devs will fix your backup. There is risk involved with restore, so please don't perposly flash your device to retail.
(No you can't flash aboot on your retail phone)
There are several ways to backup this unique partition, these procedures are not real difficult, but care should be taken. One method is by using ADB. Big learning curve, but rewarding. install Google SDK and use ABD [ADB Guides] Setup and run ADB, and backup the partition using dd command. This is a computer to Android terminal interface via USB. If you have used Linux scripts, this should easy peasy once ADB is functional. Copy and paste a script to copy aboot to SD, and the rest of the partitions using the ADB Method below.
You could even copy aboot to your phone's SD using your recovery file editor, or use ADB pull (permissions, mount, could make this tough though).
There is a cool program built by XDA contributor @lyriquidperfection, it's called EFS Professional It is a very powerful tool, it runs on windows computers, and uses a GUI, no scripts, just point and, click, click, click Easy Method.
Both interfaces require ROOT, and use Busybox. SuperSU, and busybox must be installed on your device prior, as well as Samsung drivers (Direct link to VZW Note 4 DE )
I like BusyBox Tools by Stephen (Stericson), or try Busybox On Rails
Disclaimer: If you are careful, study a bit, and follow direction closely there isn't much risk. Please be careful, these tools are capable of bricking your phone if you blindly explore other commands. If you run into problems, Post to this thread, someone will help you. If you go poking around the advanced user commands and mess it up, good luck. Don't hate on me if you do something stupid.
1. ADB Method Here is a quick guide that I made while backing up my note-4 DE. I point out the path to the partitions on Note-4. The VZW note-4 aboot partition is mmcblk0p7 This location and partition number are different in other DE models. This backup will need to be made flash-able if it's ever needed.
2. EFS Professional Easy Method (This guide will work for the other developer devices too. Tested on Note-3 & Galaxy S5 Developer Editions)
Download EFS Professional on windows computer, install EFSProfessional. This program has an imbedded version of ADB built in (don't run any other ADB programs at the same time)
Make sure USB debug is checked under phone's setting "Developer options", tick "USB debugging" (might already be ticked) If "developer options" tab is missing from "Settings", go to "Settings", "About phone", then tap, tap, tap, on "Build number" do it spasticly until it unlocks, aboot 7 times. ha ha Canada
(Click on the attached thumbnails to enlarge them to huge)
View attachment 3075958 View attachment 3075959
Hook the phone to USB & computer prior to running EFSPro. Keep an eye on the phones screen when the program starts, a few popups will probably pop up on the phone, allow your computer's RSA key, tic the always remember, and allow access to your computer. SU will pop up on the screen too, grant access. (If it doesn't connect, check phone's drop down for connection options. Worst case, toggle usb debug off/on while attempting connection in efspro).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click on EFS Professional, The only folder you need to use is under the backup tab. Don't mess around under the other tabs, just click on backup.
View attachment 3048807 View attachment 3125707
Under the Backup Tab select "manage" Then select "Create New". Now you will create a PIT file, the map of your DE's system.
View attachment 3075885 View attachment 3075886
Type in the File name, display name, and description. I typed "note-4" in all three boxes.
View attachment 3181033
Click "Read Pit" a popup will nag, just click "OK" and continue, device written, click "OK", Then hit "Save".
View attachment 3075888
You now have your DE's PIT, the road map to your system partition. Ready to backup aboot? Lets go, press "Manage" then "refresh". Now your new pit should be visible under the "manage" drop down.
View attachment 3075899
From the drop down find your device (Note-4), and "select" it.
View attachment 3075900 View attachment 3075901
"Deselect all", then tic aboot only (You don't want to save all in one zip, it's +3GB, and will take forever, and most likely choke on it's self. Later after backing up aboot you can go back, and save the other partitions that aren't backed up by TWRP).
View attachment 3075902 View attachment 3075911
Click "backup". When it's finished you should now have two copies of aboot zipped up in a nice file (Note-4_xxxxxxxx.tar.gz) in EFSProBackup folder on your internal SD (or External SD), and on your computer both locations should contain a TAR of aboot. You can rename it "MyNote4_aboot.tar.gz". Later you should also manually move this to external SD using Root Explorer or ES File explorer
View attachment 3075912
Now is the time to donate to @lyriquidperfection , or a least go back to his OP and hit the thanks button.
View attachment 3075913
If a stock Tar is accidentally flashed, locking the boot loader, the phone won't be able to run EFS Pro because it requires root, and busybox, and may not boot anyway. If you do somehow lock your boot loader. Post your request for help to this thread, someone will PM you asking for your aboot backup, one of the devs here will make your aboot odin flashable, and send it back ready to go.
*Odin can't flash all the partitions, only the ones that are mapped in your PIT file. Please do a second backup, make a combined zip, select the following: aboot.mbn, NON-HLOS.bin, rpm.mbn, sbl1.mbn, sdi.mbn, tz.mbn. This will up your insurance policy to premium
Now that your are "out of the woods", go back into EFSPro and backup all partition blocks, minus a few huge ones that are already backed up by your recovery. I back up all blocks on a fresh DE image, before installing a bunch of apps (recovery, SuperSU, and Busybox). If you have a bunch of stuffs already installed you might want to skip blocks: 25 Cache, and 27 User Data. They are huge, and redundant if you already backed up everything in TWRP. You do have everything backed up in TWRP, right???
Eye glazing stuffs: The backups can be un-zipped to a tar, aboot.mbn.tar. Then unzipped again to reveal the unzipped partitions. These can be selectively modified into an Odin flash-able tar.md5. This part should be done by a developer because some hex editing and special software adds an md5 checksum .
Don't be the one that flashes a stock image tar, or allows a repair kiosk to touch your precious. Hopefully the insurance policy you just made won't ever have to be claimed.
Check back for correction, and updates. Please post your results good, or bad to this thread.
THANKS!
Nice guide I will have to do this
radionerd said:
Samsung Developer Devices are identical to retail devices with exception of one partition "aboot". If this partition is overwritten or corrupt the phone will brick, and bootloader will lock. This partition is device ID specific and coded to the boot partition, and device. If both of these partitions are backed up prior to corruption, it would be possible to restore a locked developer device.
There are several ways to backup these unique partitions, these procedures are not real difficult, but care should be taken. One method is by using ADB. install Google SDK and use ABD [ADB Guides] Setup and run ADB, and backup the partitions using dd command. This is a computer to phone terminal interface via USB. If you have used Linux scripts, this should easy peasy once ADB is functional.
There is a cool program built by XDA contributor lyriquidperfection, it's called EFS Professional It is a very powerful tool that runs on windows computers, and uses a GUI, no scripts, just point and click
Both interfaces use Busybox, so it must be installed on your device prior.
I like BusyBox Tools by Stephen (Stericson), or Busybox On Rails
Disclaimer: If you are careful, study a bit, and follow direction closely there isn't much risk. Please be careful these tools are capable of bricking your phone if you explore other commands. If you run into problems, I will try to help.
1. ADB Method Here is a quick guide that I made while backing up my note-4 DE. The VZW note-4 aboot partition is mmcblk0p7 This location and name are different in other models.
2. EFS Professional Method
Download EFS Professional on windows computer, install it. This program has a imbedded version of ADB built in (don't run any other ADB programs at the same time)
Make sure USB debug is checked under phone's setting, Developer options tick USB debugging (should already be ticked) If developer options is missing, go to settings, About phone, tap tap tap "Build number" spasticly until it unlocks.
Hook the phone to USB prior to running EFSPro. Keep an eye on the phones screen when the program starts, a few popups will probably pop up on the phone, Tic the always remember, and allow access to the computer. SU will pop up on the screen too, grant access.
View attachment 3048807
(Click on the attached photos to enlarge them)
The only folder you need to use is under the backup tab. Don't mess around under the other tabs, just backup.
Under the Backup Tab select "manage" Then select "Create New". Now you will create a PIT file, and grab a map the DE system.
View attachment 3048818
Type in the File name, display name, and description. I typed "note-4".
Then Click "read device", it should look like the picture below. Then hit "Save".
View attachment 3048835
You now have a Note-4 PIT, and map. Ready to backup aboot and boot, just press "Manage" then "refresh". Now your new pit should be visible under "manage drop down".
From the drop down find your device, and "select" it.
View attachment 3048845
"Deselect all", then tic aboot and boot only (You don't want to save all in one zip, it's Gigs, and will take forever, and most likely choke on it's self later you can go back and save the other partitions that aren't backed up by TWRP).
Then click "backup", when it's done you should now have an efsprofessional folder on your internal SD, and on your computer that contains a TAR of aboot and boot.
View attachment 3048866
Now is the time to donate to Liquid Perfection, or a least go back to his OP and hit the thanks button.
This is a ruff work in progress, but it's getting late, so check back for typos, correction, and updates. Please post your results good, or bad to this thread.
THANKS!
Click to expand...
Click to collapse
This is great work. Thanks so much. We've already seen a couple of our fellow Note 4 DE owners need a aboot backup to restore their unlocked bootloader. This is a must for any DE owner. It's like an insurance policy.
How do you restore?
Once you use the dd command in terminal emulator or in adb, or once you have an efs-professional backup of your aboot, so you have an aboot.mbn or aboot.bak, how do you restore it if you have inadvertently, let's say, flashed a retail edition aboot by flashing a retail full tar file from Odin for instance? I bought a Note 3 DE last year, and I made a copy of my aboot as soon as I got it, using the dd command, the file is about 2mb, but so far I don't know how to restore it if it does get the retail aboot installed on it by accident. Could you please shed some light on the restoration procedure as well?
Also, I know if you backup your /efs partition on twrp, it can't be restored if you mess it up, supposedly that's what makes the phone tick and gives it its identity, I have read about a few people on this forum that accidentally deleted their /efs partition and their phone never worked right after that, like their unlock screen wouldn't work and a lot of other stuff was messed up, as they described. If you make a /efs backup with efs-professional, could it be restored correctly if the /efs partition gets corrupted by accident? I don't really know why anyone would need to delete that partition, but I think some rom or modem update procedure did it, but just in case it happens.
Thank you for the great work and tutorial
newuser134 said:
Once you use the dd command in terminal emulator or in adb, or once you have an efs-professional backup of your aboot, so you have an aboot.mbn or aboot.bak, how do you restore it if you have inadvertently, let's say, flashed a retail edition aboot by flashing a retail full tar file from Odin for instance? I bought a Note 3 DE last year, and I made a copy of my aboot as soon as I got it, using the dd command, the file is about 2mb, but so far I don't know how to restore it if it does get the retail aboot installed on it by accident. Could you please shed some light on the restoration procedure as well?
Click to expand...
Click to collapse
Hopefully no one will have to be the Guinea Pig, and restore a corrupted aboot from accidentally flashing a retail TAR on their DE. As far as I know only one guy has tried aboot restore successfully, with big help from a dev who made his prior saved aboot flashable.
As far as I know aboot restore is untested with efsprofessional, I have successfully restored other partitions using efspro on my note-3 DE.
Unfortunately every DE version that has been released has had several folks overwrite aboot; accidentally, or in desperation flash retail Tars, by themselves, by Samsung service center, or at a retail store kiosk, like bestbuy.
Your DE warranty, and insurance is your backups. Samsung won't fix your corrupted system, if they do (only if no knox trip 0x0), you will receive your phone with a retail image put on it. Having an aboot backup could possibly bring it back to DE.
newuser134 said:
Also, I know if you backup your /efs partition on twrp, it can't be restored if you mess it up, supposedly that's what makes the phone tick and gives it its identity, I have read about a few people on this forum that accidentally deleted their /efs partition and their phone never worked right after that, like their unlock screen wouldn't work and a lot of other stuff was messed up, as they described. If you make a /efs backup with efs-professional, could it be restored correctly if the /efs partition gets corrupted by accident? I don't really know why anyone would need to delete that partition, but I think some rom or modem update procedure did it, but just in case it happens.
Click to expand...
Click to collapse
Been there done that, Most of the guys that had efs messed up on Note-3 DE, including myself, we used the first T-mobile TWRP version that didn't backup the right efs partition, upon TWRP restore we had major problems, some of us compounded the problems, me too TWRP was quickly updated, and a few of us figured out ways to rebuilt /efs.
"What I learned was backup your backup, then back that up too" I do complete TWRP backup as soon as rooted, DD of all partitions, then backup all partitions, except a few huge partitions using efspro.
newuser134 said:
Thank you for the great work and tutorial
Click to expand...
Click to collapse
Thanks WIP, hope to add soon "copy and paste" scripts for all the partitions.
Thanks for the instructions. I hope to never need it, but I will follow this procedure just to be on the safe side.
Doesn't TWRP handle this by ticking on the EFS checkbox when making a backup?
solidunit said:
Doesn't TWRP handle this by ticking on the EFS checkbox when making a backup?
Click to expand...
Click to collapse
TWRP does backup EFS, but not aboot, or a handful of other partitions. EFS pro can backup all partitions.
radionerd said:
Type in the File name, display name, and description. I typed "note-4".
Then Click "read device", it should look like the picture below. Then hit "Save".
View attachment 3048835
Click to expand...
Click to collapse
When I get to the "read device" step I get an error saying it cannot find the pit file in the EFS folder. What am I missing? Thanks
tfly212 said:
When I get to the "read device" step I get an error saying it cannot find the pit file in the EFS folder. What am I missing? Thanks
Click to expand...
Click to collapse
Did you click on the Manage box and select "create new"
Then read device
Then name note-4 on device name, display name, and description, then click save
go back to manage, click refresh
Then go to device filters, find your note 4
de-select all, then select aboot
Then click backup.
Now you should have a "double zipped" file of aboot in your computer efsprofessional folder, and on your sdcard.
Attached a few pictures from my note 3
radionerd said:
Did you click on the device filter box "v" and select "create new"
Then read
Click to expand...
Click to collapse
I did not the first time...but once I did it worked perfectly, thank you. I didn't think to click the dropdown as I knew Note 4 wasn't going to be on there. Might want to add that line to the instructions in case anyone else runs into the same issue.
All good now...going to donate to the dev tonight.
tfly212 said:
I did not the first time...but once I did it worked perfectly, thank you. I didn't think to click the dropdown as I knew Note 4 wasn't going to be on there. Might want to add that line to the instructions in case anyone else runs into the same issue.
All good now...going to donate to the dev tonight.
Click to expand...
Click to collapse
Great!
I will go look at the wording of the OP
tfly212 said:
I did not the first time...but once I did it worked perfectly, thank you. I didn't think to click the dropdown as I knew Note 4 wasn't going to be on there. Might want to add that line to the instructions in case anyone else runs into the same issue.
All good now...going to donate to the dev tonight.
Click to expand...
Click to collapse
Buy him some nappies for his kid
Thanks man,
I updated my OP with 27 8"x10" color glossy photos with circles and arrows
radionerd said:
Buy him some nappies for his kid
Thanks man,
I updated my OP with 27 8"x10" color glossy photos with circles and arrows
Click to expand...
Click to collapse
Will do...I have a little one also, and while a beer sounds better, the way they go through diapers is staggering.
How do I find my computers RSA key? I am on windows 8.1?
texasez said:
How do I find my computers RSA key? I am on windows 8.1?
Click to expand...
Click to collapse
You don't need to know the computer's RSA key, The RSA pop-up comes up on your phone when entering ADB mode. The key is in the pop-up, Just grant access.
Is the "sbl1bak" a backup of the "sbl1" ????????
larrycjr said:
Is the "sbl1bak" a backup of the "sbl1" ????????
Click to expand...
Click to collapse
Yup,
However sb1bak is empty on my note 4
Easy look at Note 4 partition Mounts by-name (trltevzw)
aboot -> /dev/block/mmcblk0p7 (2048KB)
apnhlos -> /dev/block/mmcblk0p1
boot -> /dev/block/mmcblk0p17
cache -> /dev/block/mmcblk0p25
carrier -> /dev/block/mmcblk0p26
dbi -> /dev/block/mmcblk0p5
ddr -> /dev/block/mmcblk0p6
efs -> /dev/block/mmcblk0p13
fota -> /dev/block/mmcblk0p19
mdm1m9kefs1 -> /dev/block/mmcblk0p14
mdm1m9kefs2 -> /dev/block/mmcblk0p15
mdm1m9kefs3 -> /dev/block/mmcblk0p10
mdm1m9kefsc -> /dev/block/mmcblk0p16
misc -> /dev/block/mmcblk0p20
modem -> /dev/block/mmcblk0p2
pad -> /dev/block/mmcblk0p11
param -> /dev/block/mmcblk0p12
persdata -> /dev/block/mmcblk0p23
persist -> /dev/block/mmcblk0p22
recovery -> /dev/block/mmcblk0p18
rpm -> /dev/block/mmcblk0p8
sbl1 -> /dev/block/mmcblk0p3
sbl1bak -> /dev/block/mmcblk0p4
ssd -> /dev/block/mmcblk0p21
system -> /dev/block/mmcblk0p24
tz -> /dev/block/mmcblk0p9
userdata -> /dev/block/mmcblk0p27
I finally get past the RSA problem by using installer mode on phone but the phone auto changes back to media device and then efs pro does not recognize the phone. I tried camera (ptp) mode but it will not go past pressing the device info button on efs pro. How do I make the phone stay in installer mode. I keep getting popups wanting me to install the verizon software but I did not install.
How do I keep the installer mode active?
Your obviously on the dev edition?? Correct? If so if it's not to much to ask will you send me a copy of your sbl1. Please.
Sent from my SM-N910V

I need certain partition dumps. #unlockthedroids

Okay, I am attempting to #unlockthedroid, but first I will need dumps from "/dev/block". What I'm trying to do is pull off @CrashXXL methods of rooting with Write Protect=1 but allowing the potential of unlocking bootloader with Sunshine. And I don't want it to be done randomly, so this is what we'll need to do in order to get that dump:
Requirements:
Rooted
Bootloader Unlocked
Firmware to be at 4-21. It's easier for me. Or if you have anything below, it'll probably work too.
Willing to spend time; this'll take a VERY long time. So you'll need to leave your phone overnight or whatever it takes for it to finish copying.
Instructions:
Turn on ADB in settings. (If done already, next step)
Get ADB and Fastboot on your computer. (If done already, next step)
Go to ADB directory
adb shell
Click to expand...
Click to collapse
dd if=/dev/block/mmcblk0p38 of=/(any directory)/(name your file anything - just remember the location combination)
Click to expand...
Click to collapse
When done, exit ADB
adb pull /(directory)/(file name)
Click to expand...
Click to collapse
Submit the file from the ADB folder to your own Google Drive, Mega, or Dropbox. Wherever you wish.
Files we currently need:
Droid Mini mmcblk0p5, 0p13, 0p33
Droid Ultra mmcblk0p5, 0p13, 0p33
Droid Maxx mmcblk0p5, 0p13, 0p33
There is also a certain block I don't know the mmc block number to, so when someone knows where partitions.mbn is then we'll be one step closer to getting my phone flashed and tested.
Thanks in advanced!
P.S.: Staff, please move this somewhere correct if where it is right now it's not.
mr_verystock said:
Okay, I am attempting to #unlockthedroid, but first I will need dumps from "/dev/block". What I'm trying to do is pull off @CrashXXL methods of rooting with Write Protect=1 but allowing the potential of unlocking bootloader with Sunshine. And I don't want it to be done randomly, so this is what we'll need to do in order to get that dump:
Requirements:
Rooted
Bootloader Unlocked
Firmware to be at 4-21. It's easier for me. Or if you have anything below, it'll probably work too.
Willing to spend time; this'll take a VERY long time. So you'll need to leave your phone overnight or whatever it takes for it to finish copying.
Instructions:
Turn on ADB in settings. (If done already, next step)
Get ADB and Fastboot on your computer. (If done already, next step)
Go to ADB directory
When done, exit ADB
Submit the file from the ADB folder to your own Google Drive, Mega, or Dropbox. Wherever you wish.
Files we currently need:
Droid Mini mmcblk0p5, 0p13, 0p33
Droid Ultra mmcblk0p5, 0p13, 0p33
Droid Maxx mmcblk0p5, 0p13, 0p33
There is also a certain block I don't know the mmc block number to, so when someone knows where partitions.mbn is then we'll be one step closer to getting my phone flashed and tested.
Thanks in advanced!
P.S.: Staff, please move this somewhere correct if where it is right now it's not.
Click to expand...
Click to collapse
various dumps https://yadi.sk/d/UnLW2G54f5Gbx
Thanks for the SU6-7 and 5-24 dumps! But just a question: can you dump for earlier versions? I can probably get it to run Sunshine and onto the bootloader unlock. Thanks though!
mr_verystock said:
Thanks for the SU6-7 and 5-24 dumps! But just a question: can you dump for earlier versions? I can probably get it to run Sunshine and onto the bootloader unlock. Thanks though!
Click to expand...
Click to collapse
I do not think that this would work, yes You can flash the 4-21 (all bootloader partitions + kernel + system) in the QLOAD mode, as You have access to the whole flash memory.
But the trusted boot chain will not let you boot earlier bootloader and system when a newer one was already there. Phone needs to be bootloader unlocked, to boot into any version.
It's worth trying. And plus, you never know what you can find if you try...
question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out
mr_verystock said:
It's worth trying. And plus, you never know what you can find if you try...
Click to expand...
Click to collapse
I think You can get all you need from the original FXZ file.
You can get all the bootloader partitions from the motoboot.img, see my post here.
Additionally You can extract the system partition with the simg2img tool from here, but this would be the original, not the rootet image,so You would need to insert the su binary by yourself.
pizmak said:
I think You can get all you need from the original FXZ file.
You can get all the bootloader partitions from the motoboot.img, see my post here.
Additionally You can extract the system partition with the simg2img tool from here, but this would be the original, not the rootet image,so You would need to insert the su binary by yourself.
Click to expand...
Click to collapse
If this is the method it would've been done already... But no, motoboot.img cannot be extracted for all it's worth. It has aboot, gpt, and many other parts we need to create a complete set of unbricking and/or bootloader-necessary files.
happysteve11c said:
question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out
Click to expand...
Click to collapse
Sigh... I wish, my friend. I know what you want, but nobody's willing to provide it because of. @CrashXXL is nice enough to provide the unbricking files but nobody is willing to dump for SU1.
mr_verystock said:
If this is the method it would've been done already... But no, motoboot.img cannot be extracted for all it's worth. It has aboot, gpt, and many other parts we need to create a complete set of unbricking and/or bootloader-necessary files.
Click to expand...
Click to collapse
it actually is as easy as this, the motoboot.img file is just the bootloader partition images put into one file plus a 1024 bytes header. I have extracted these image and compared them with the dumps from my own phone and they are identical, so this motoboot is not compressed or encrypted.
If You still do not believe me just check for yourself, dump for example the aboot partition from your phone and compare it with the motoboot image from the FXZ file for your firmware version, I think you will find the aboot image inside the motoboot image at some 512bytes aligned offset (you can get the offset from the header, see the description in my post linked above)
Edit: I have added my code I wrote to extract the motoboot image to this thread
happysteve11c said:
question is it possible to get a system dump from the following version -4.2.2-SU1-15-3 trying to unbrick my device and i need certain files from that version thanks been trying to do this for a while and no one seems to wanna help out
Click to expand...
Click to collapse
Not sure if you or anyone can do anything with it but I have a twrp backup of the boot and system from su1-15. Let me know if anyone wants it.
Sent from my XT1080 using XDA Free mobile app
@mr_verystock are you still working on this?
Yes, I'm working on it. But I'm dealing with school, along with patching up a broken computer which I am planning to use for my daily driver. So currently I'm installing Linux, to do a mbn split.
Oh, and I kinda messed up my Droid Maxx while doing this... Don't worry, it's a backup, I have a Droid Mini as main.
WOHOO!!!!!!!!!
Is it rooted?
What version of Android are you on?
Ya still working on this?
Hey man. I have a (probably useless) Droid Mini "dev" edition (on su6-7). Today, I will be receiving a droid maxx on 4.4 (idk if its 19.5.3 or 19.6.3 yet) and i will be unlocking it with sunshine. if you still need files/help, i can help. (when you do start work on this again). my sincere hope, aside from a bootloader unlock for the folks on 4.4.4) is that somehow this will help the Turbo folks. (mofo root is good, but bl unlock is better). let me know if and when i can help man.
Hey, yeah, please let me know if you need anything once you get started again. I have a droid ultra that I just bought off groupon for $80.
YYUSSSSSSSSSS!!!!!!!!!!!!!!!!!!!!! Thank you VERY MUCH!!!!
Great thing I have a Droid Mini. Can you dump cid.mbn for 4.4? That's the file I want to mess with currently after you unlocked.
me or him, broheim?
edit: duh, me. ill have it pulled and uploaded tomorrow around noon
Is it uploaded to a hosting site or not?
i never saw any reply dude. i can upload what i have...but my mini is on 4.4.4. i have a maxx on 4.4, but no dice on that build. i thought for a moment i was crazy. if it helps you to have either or both, i will pull them right now and throw up a link to my drive.
Hm... I can't do anything with the 4.4.4 one, I'll take the Maxx on 4.4 cid.mbn. Sorry if there were any confusion!!!

H873 Unlocking Progress

The last few weeks I have been reverse engineering this model in Ghidra looking for hint's on how to unlock the bootloader of this device, I have tried many methods and have come up short. First thing I would like to mention the unlock.bin is most definitely stored in the misc partition after a factory reset, Most interestingly the unlock able variants store the unlock.bin in its complete form ready for unlock once transferred to a new hex document with a length of 0x3FE, In misc this key is stored between 0x6C004 and 0x6C218. That being said on the locked variant it is also recorded to misc only when booting from a us997 aboot but unlike the unlocked variant it is encrypted the cert being written to misc is that of aboot and starts with UNLOCK_RSA_020 which can be extracted from aboot with binwalk. Theoretically by cross flashing images from other devices it is possible to trick it into writing the key to misc. What I need to know is I understand the unlock key is stored in rpmb protected memory only accessible by trustzone, would it be possible to chroot a linux distro on top of system and mount secure world without complete trustzone privilege? I have temp root and it is possible to make it persistent by modifying system but unfortunately system is not referenced in /proc/mounts it is only occasionally mountable in rw for a fraction of a second. This is easily bypassed by passing temp root and starting a system mount app with the am command in root. Also If I were to make a full backup of mmcblk0 would secure world be contained in such a backup or is it accessed via spi? Any help is appreciated thank you in advanced.
SpliffWellington said:
The last few weeks I have been reverse engineering this model in Ghidra looking for hint's on how to unlock the bootloader of this device, I have tried many methods and have come up short. First thing I would like to mention the unlock.bin is most definitely stored in the misc partition after a factory reset, Most interestingly the unlock able variants store the unlock.bin in its complete form ready for unlock once transferred to a new hex document with a length of 0x3FE, In misc this key is stored between 0x6C004 and 0x6C218. That being said on the locked variant it is also recorded to misc only when booting from a us997 aboot but unlike the unlocked variant it is encrypted the cert being written to misc is that of aboot and starts with UNLOCK_RSA_020 which can be extracted from aboot with binwalk. Theoretically by cross flashing images from other devices it is possible to trick it into writing the key to misc. What I need to know is I understand the unlock key is stored in rpmb protected memory only accessible by trustzone, would it be possible to chroot a linux distro on top of system and mount secure world without complete trustzone privilege? I have temp root and it is possible to make it persistent by modifying system but unfortunately system is not referenced in /proc/mounts it is only occasionally mountable in rw for a fraction of a second. This is easily bypassed by passing temp root and starting a system mount app with the am command in root. Also If I were to make a full backup of mmcblk0 would secure world be contained in such a backup or is it accessed via spi? Any help is appreciated thank you in advanced.
Click to expand...
Click to collapse
Hey. While I can't help you, because I don't know about all that, I just wanted to let you know that we're all rooting for you (pun intended). That said, how's progress going? Is it close to completion, or has the project been shut down?
SpliffWellington said:
The last few weeks I have been reverse engineering this model in Ghidra looking for hint's on how to unlock the bootloader of this device, I have tried many methods and have come up short. First thing I would like to mention the unlock.bin is most definitely stored in the misc partition after a factory reset, Most interestingly the unlock able variants store the unlock.bin in its complete form ready for unlock once transferred to a new hex document with a length of 0x3FE, In misc this key is stored between 0x6C004 and 0x6C218. That being said on the locked variant it is also recorded to misc only when booting from a us997 aboot but unlike the unlocked variant it is encrypted the cert being written to misc is that of aboot and starts with UNLOCK_RSA_020 which can be extracted from aboot with binwalk. Theoretically by cross flashing images from other devices it is possible to trick it into writing the key to misc. What I need to know is I understand the unlock key is stored in rpmb protected memory only accessible by trustzone, would it be possible to chroot a linux distro on top of system and mount secure world without complete trustzone privilege? I have temp root and it is possible to make it persistent by modifying system but unfortunately system is not referenced in /proc/mounts it is only occasionally mountable in rw for a fraction of a second. This is easily bypassed by passing temp root and starting a system mount app with the am command in root. Also If I were to make a full backup of mmcblk0 would secure world be contained in such a backup or is it accessed via spi? Any help is appreciated thank you in advanced.
Click to expand...
Click to collapse
Hey! Though you probably already have root, on the off-chance you don't, use this temp root! Hope this helps you out. Just make sure to rollback to Android 8, follow the guide, and read the posts. Should work fine on H873.
https://forum.xda-developers.com/lg...-as993-wip-t3908213/post80908533#post80908533

Categories

Resources