Database Users

[REF] Samsung Galaxy S - Froyo JP6 - SIM UNLOCK -

Hello,
I`ve made my "official" update to Froyo JP6 and I wanted to SIM unlock my phone. Since last unlock application did not worked (basically because SIM lock number was removed from nv_data.bin)
So this is how I did it.
My phone specs:
Model number: GT-I9000
Firmware version: 2.2
Baseband version: I9000XXJPM
Kernel version: 2.6.32.9
Build number: FROYO.XWJP6
Locked network: Orange Romania
Prerequisites:
- phone must be rooted
- adb application (you can find it in "Generate Unlock Windows.zip " from this /showthread.php?t=761045 post)
* first backup your /efs folder
change /efs permisions:
Code:
chmod 775 /efs && chmod 775 /efs/.*
get all files within /efs folder:
Code:
adb pull /efs bk2/
(where bk2 is a folder where adb resides)
* edit nv_data.bin with a hex editor
copy nv_data.bin from your backup folder and open it with a hex editor
move to Offset 18146E and change those 8 Fs(FFFFFFFF) to 00000000 (this should change your SIM unlock code to 00000000)
(I didn't do this step) move to Offset 188021 and change whatever is from that cursor (ex. GT-I9000HKDXEE) to XEF
save your binary file
* clean your /efs partition (you must have some free space for your phone to generate and work with your nv_data.bin file - If you don't have enough space it will write until it gets full and your phone will probably end up not seeing any SIM card (that's what happened to me, /efs was 100% used and I could not use any SIM. message: no sim card. or insert a sim card)
1. connect from your PC to phone's shell
Code:
adb shell
2. obtain root access
Code:
su -
3. list partition usage - it would be most of it used ~ 6Mb
Code:
df /efs
4. list the content of /efs/ filesystem
Code:
ls -l -a /efs/
5. remove most of the content
Code:
rm /efs/nv_data.bin.md5
rm /efs/nv_data.bin
rm /efs/.nv2.bak
rm /efs/.nv2.bak.md5
rm /efs/.nv_data.bak
rm /efs/.nv_data.bak.md5
6. check filesystem usage again. it should be ~ 3Mb
Code:
df /efs/
* copy your altered nv_data.bin file
from another prompt do:
Code:
adb push nv_data.bin /efs
(altered nv_data.bin which was edited in second step)
from your first shell where you connected earlier as root create the md5 file:
Code:
md5sum /efs/nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > /efs/nv_data.bin.md5
change permissions/owner on nv_data files:
Code:
chmod 775 /efs/nv_data.bin && chmod 775 /efs/nv_data.bin.md5
chown radio.radio /efs/nv_data.bin && chown radio.radio /efs/nv_data.bin.md5
* now let`s unlock your phone
disconnect from your adb shell (exit, exit) and remove your USB cable
remove your phone's battery (without powering it off) and put another operator's SIM card
!!! When you'll be asked about unlock code enter: 00000000. It might say its unlocked or it might not. It may hang on searching network provider or it may not. After couple of minutes power off your phone and start it again with that SIM card in it. Pray that it will actually work ( For me it happened not to be able to "slide to unlock". It worked to power off the screen and power on, I could see animation but I could not do anything with my touchscreen)
!!! Your IMEI will be screwed (at least mine was), that's why it will be ok to keep your backup files on your PC so you can restore at any time if you need it
* restore
proceed like in previews mode but now you have to copy ALL your backed up files to your phone and you have to change ownership/rights to all copied files
Code:
adb push bkp_folder/ /efs/
(all files/folders within bkp_folder will be restored on /efs)
!!! pay attention on /efs rights (
Code:
ls -l -d /efs
you may change write permissions to all users
Code:
chmod 777 /efs
I`ve gathered all the info from other posts (mainly from this /showpost.php?p=8681529&postcount=806 one ), i haven't invented the wheel you know..
Please post if it`s working for you...

that's usful, thanks much!
Sent from my GT-I9000 using XDA App

...worked.
Had a friends SGS from 3 - Drei (Austria) here to unlock. Even unlockcode from Samsung did not work.
But now its unlocked.
thx

Dear users
I am in trouble
I am new to this forum, so please forgive me if i don't sound appropriate.
my samsung galaxy s (android) is un-unlockable
its working on the parent network but absolutely un-unlockable
did try to send to some geeks sitting in the market but they couldn't do it.
used also the self extracting code methods but it always says "no codes found"
don't know what to do... please if any one of you had this problem or you know about this problem please share any info you may have on this issue.
many many thanks
asim

Yes!
It worked for me too but now I have a wrong IMEI 004999010640000. I'm still like that because I don't think that a problem for my operator FR SFR
The first time I had boot, it told me no SIM no network.
I removed the battery for a couple of minute and the next time it works!
For your info, I also moved to Offset 188021 and changed whatever is from that cursor to XEF
When I did this tips few days ago, i used the same SIM card (from a other country CH Swisscom) but in a place where I can't connect to the original carrier of this SIM. And it did'nt work. Maybe that can explain...
I tried SGS Unlock many times but always code not found
GT-I9000/2.2/I9000XXJPM-Tayutama Edition v1.0.0-LagFix Voodoo 5 Pre6
Thx

Find this strange.
If you imei number is wrong then you have Some trouble.
And you could easy just deleted all files in the efs folder and you could use any simcard you want.
This would generate a new imei number. But it will be useless for you if you want to use it either keis or Samsung stuff. And you can't sent it for reparation before you will restoring the imei number.
Sent from GT-I9000 Jpm OS kernel with z4mod

For the moment I had no problems and my phone is unlocked. My Kies works perfectly.
IMEI number is good in efs folder but not when I check on the phone.
But it's clear that I must restore the files if I want to send it to Samsung.
With all tools and post at xda, I don't need Samsung support...
GT-I9000/2.2/I9000XXJPM-Tayutama Edition v1.0.0-LagFix Voodoo 5 Pre6

Worked for me aswell.. Great work

asim_121 said:
Dear users
I am in trouble
I am new to this forum, so please forgive me if i don't sound appropriate.
my samsung galaxy s (android) is un-unlockable
its working on the parent network but absolutely un-unlockable
did try to send to some geeks sitting in the market but they couldn't do it.
used also the self extracting code methods but it always says "no codes found"
don't know what to do... please if any one of you had this problem or you know about this problem please share any info you may have on this issue.
many many thanks
asim
Click to expand...
Click to collapse
Had the same problem on my friends phone (no codes found, Samsung unlockcode not working).
Phone is unlocked now and IMEI did not change.

Hello,
I followed this procedure and aftewards I have a different IMEI number.
Does anybody know which file is responsible the IMEI ?
I have all the original files saved to a backup folder on my pc.
I connected to kies mini after and it says my phone is not registered! My IMEI number is wrong.
Anyone know which file will restore my IMEI?

froyo sim unlock
Does anyone know if this method can work for captivate or it's only for i9000. And can i update to i9000 rom then do this method.
thank-you

will this solution work for android 2.1?

My EFS folder and the nv_data are deleted and I didn't made a back up.
what can i do to get them back??

md5sum /efs/nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > /efs/nv_data.bin.md5
thats not working
it says
md5sum: not found
tr: not found
sed: not found
maybe this is why imei is corrupted (changed), cause md5 sum not match.
tried with md5summer and it's not working either

this line:
md5sum /efs/nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > /efs/nv_data.bin.md5
Create a bad md5.
on my nv_data.bin:
Original md5: c5c3593b6e280a97d04205ae5b6043ba
Created md5 with this line: 449136859ae1319e2ee3cbef1c87f9eb
"Missmatch"
Only reboot create a good md5.
Modify your tutorial please.

That works!!!
Thanks so very much!!!
Only commends:
md5sum /efs/nv_data.bin | tr '\n' 'X' | sed 's/ .*//' > /efs/nv_data.bin.md5
I've made as:
md5sum.exe nv_data.bin | tr.exe '\n' 'X' | sed.exe 's/ .*//' > nv_data.bin.md5
in my Windows folder, runing it from cygwin shell and next I moved
nv_data.bin.md5
on the phone to /efs/ folder

When i double click adb.exe it just popup and closes!?!?! I am on windows 7, how to enter this?

Worked for me, but the weirdest thing happened, I put in a Cosmote RO sim card, after following the guide from this thread and it didn't even ask me for the unlock code, it accepted it and it worked perfectly fine, even tho the phone was blocked on Orange RO, I know this for sure cause few days ago I tried the sim card that is working now and it didnt work before... Thanks.

My data_nv.bin does not contain offset 18146E...
Docomo Galaxy
PDA: SC02BOMJJ1
Phone: SC02BOMJJ1
CSC: SC02BDCMJJ1
Bild Info 2010.10

Works perfect for me on Gingerbread 2.2.3 Darky ROM v10 RC3 All I did was hex edit the nv_data afrom phone memory and write back. Unlock code was 00000000. Thanks very much becuase before this my phone wouldnt detect network following SGS unlock

[Q] Nexus 7 stuck on Google logo

Hi everyone,
my N7 (unlocked, stock, latest OTA, maybe was rooted) is not booting past the Google logo. I can access bootloader and recovery and through custom recoveries adb shell sbin/dmesg. also in stock adb sideload works. but when it is stuck in google logo it is detected as nexus 7 but I can't access it through adb (no devices listed).
What I did already:
stock recovery: factory reset
cwm recovery: wipe dalvik cache, fix permissions
reflashed factory image JZO54K and JOP40D
formatted /system and reflashed
fastboot oem lock & fastboot oem unlock: after this it will show the boot animation for ~7s and reboot
also i waited 20mins after flashing factory images - enough so it at least can show the boot animation
this is what fastboot currently shows:
FASTBOOT MODE
product name - grouper
variant - grouper
hw version - ER3
bootloader version - 4.13
baseband version - n/a
serial number - 015d2109f31c0415
signing - not defined yet
LOCK STATE - UNLOCKED
here are two dmesgs: http://pastebin.com/T8pexUa3 and http://pastebin.com/y2sXSC5n
and here's the video of a startup after fastboot oem lock + unlock: http://www.youtube.com/watch?v=Sj3E3Emkz2U
and here's a log of one flash: http://pastebin.com/z5Bue4jL where everything seems perfectly fine
Some more symptoms: non of openrecovery-twrp-{2.3.3.0, 2.4.0.0, 2.4.1.0}-grouper.img are properly booting (only splash screen is displayed) and when I try to do some tasks like mount /system with cwm 6.0.1.0 or factory reset with twrp 2.2.1 (part of galaxy nexus 7 toolkit) the recovery will freeze so I have to reboot. also cwm gets awfully slow after some tasks.
I am out of my wits, can anyone help? If you give me instructions I can provide more dmesgs.

hi aha27,
Sorry about your problem. You are to be commended though, for the preparation and detail you provided in describing your situation - too bad most are not that thorough.
That video is an unusual bootloop. With "normal" bootloops the kernel stays up and the android layer cycles endlessly in it's startup checks - but your video looks much more like a kernel panic occurs, as the screen goes back to a bootloader display.
I looked briefly through one of your dmesg boot logs, and didn't spot anything unusual. The facts that:
(a) you can successfully re-flash stock roms, including file system re-creation
(b) you can run adb shell commands interactively
is evidence that the kernel has no difficulty booting and that perhaps the flash filesystems are all OK too.
What sticks out is your report that the recoveries also do not proceed completely to show their touchscreen interfaces.
Here is something to try
(1) perform soft-boots of the recovery with fastboot, for example:
fastboot boot openrecovery-twrp-2.3.3.0-grouper.img
As this requires no writing nor reading of the eMMC Flash memory, if it fails to setup the display correctly, perhaps you have a hardware problem that is unrelated to flash memory. (As you tried multiple recoveries, you may have already done this - it wasn't evident whether you flashed your different recoveries or soft-booted them)
Note also that you can run several adb sessions simultaneously, so in separate windows with the recovery running you can certainly be doing
C:\fubar> adb shell logcat > logcat_output.txt
and
C:\fubar> adb shell cat /proc/kmsg > kernel_log_output.txt
[ If you are using cygwin or linux you can spice this up a little, e.g.
$ adb shell logcat 2>&1 | tee logcat_output.txt
$ adb shell cat /proc/kmsg 2>&1 | tee kernel_log_output.txt
... as both of these block waiting for more output, in the latter case you get to see things happening in real time as well as capturing the output for later analysis ]
(2) see if anything is leftover in /proc/last_kmsg on the boot cycle immediately following the "bootloop". It might be possible to jump the device into fastboot mode by pressing Vol-Down the moment the Google logo first reappears. From there, soft-boot a recovery and capture the output of
adb shell cat /proc/last_kmsg
(3) Start your adb server on the PC and launch the "bootloop" and see if you can get a shell before the crash occurs. If you can get one before the crash occurs maybe you will be lucky enough to catch a problem via
adb shell cat /proc/kmsg
or
adb logcat -v threadtime
Note that if you have installed a fresh ROM, you can toggle ADB debugging on by mounting /data and
# mkdir /data/property
# chmod 700 /data/property
# echo -n 'mtp,adb' > /data/property/persist.sys.usb.config
# chmod 600 /data/property/persist.sys.usb.config
(4) I also noted your comment about "freezing if I mount /system". Note that when you flash the factory image, /data and /cache are handled differently than /system, even though all 3 are ext4 filesystems. For the first two, the process is "erase, mkfs, write", whereas for /system all you get is a "erase, write". So here is the deal - if a mke2fs filesystem is created, that means for /data and /cache that the bootloader is actually mounting those partitions (as ext4 filesystems) and restoring into them file by file. Otherwise, a "blob"-type write would just overwrite the newly created ext4 filesystem metadata.
/system is handled differently though - notice in the factory install logs there is no detail about filesystem creation for the /system partition? That's because Google is using a "sparse ext4 image" format for the system.img file, and it can actually write this to the /system partition as a binary blob.
So, on the chance that there is something wrong with the system partition, why don't you manually create the /system filesystem by hand to see if any errors occur? e.g.
mke2fs -T ext4 -m 0 /dev/block/mmcblk0p3
If this proceeds without error, try installing a dev ROM (not a factory ROM) and see if you can get further along.
The one thing which is fortunate about your situation is that you can return your device through flashing to complete factory stock, including locking the bootloader... if returning the device (via a warranty return/RMA) process is an option for you.
Whew that was a lot of typing. I think I am done for the day.
bftb0

bftb0 said:
That video is an unusual bootloop. With "normal" bootloops the kernel stays up and the android layer cycles endlessly in it's startup checks - but your video looks much more like a kernel panic occurs, as the screen goes back to a bootloader display.
Click to expand...
Click to collapse
This is the bootloop occurring once after doing fastboot oem lock / fastboot oem unlock - after the next reboot it stays at the Google logo without rebooting again.
(1) perform soft-boots of the recovery with fastboot, ... As this requires no writing nor reading of the eMMC Flash memory, if it fails to setup the display correctly, perhaps you have a hardware problem that is unrelated to flash memory. (As you tried multiple recoveries, you may have already done this - it wasn't evident whether you flashed your different recoveries or soft-booted them)
Click to expand...
Click to collapse
some were soft-boots some were with flashing of recovery, but CWM recovery hangs in either boot type after mount /sdcard or mount /user and mount /system.
I also tried some different versions of openrecovery-twrp-XXXX-grouper.img and none of it would start up.
Note also that you can run several adb sessions simultaneously, so in separate windows with the recovery running you can certainly be doing
C:\fubar> adb shell logcat > logcat_output.txt
and
C:\fubar> adb shell cat /proc/kmsg > kernel_log_output.txt
Click to expand...
Click to collapse
Ok, when I am in recovery I can mount /system and use /system/bin/logcat but there are only three lines with "scanline" something (do you need this?)
(2) see if anything is leftover in /proc/last_kmsg on the boot cycle immediately following the "bootloop". It might be possible to jump the device into fastboot mode by pressing Vol-Down the moment the Google logo first reappears. From there, soft-boot a recovery and capture the output of
adb shell cat /proc/last_kmsg
Click to expand...
Click to collapse
I couldn't go to fastboot when the Google logo appears but last_kmsg is this -> http://pastebin.com/VkmNdM5d
After oem lock / oem unlock and the reboot (like in the video) I managed to get into fastboot and recovery, here is the last_kmsg -> http://pastebin.com/wR1yptWr
(3) Start your adb server on the PC and launch the "bootloop" and see if you can get a shell before the crash occurs. If you can get one before the crash occurs maybe you will be lucky enough to catch a problem via
adb shell cat /proc/kmsg or adb logcat -v threadtime
Click to expand...
Click to collapse
nope. wasn't able to get a shell although I activated debugging with your procedure:
Note that if you have installed a fresh ROM, you can toggle ADB debugging on by mounting /data and
# mkdir /data/property
# chmod 700 /data/property
# echo -n 'mtp,adb' > /data/property/persist.sys.usb.config
# chmod 600 /data/property/persist.sys.usb.config
Click to expand...
Click to collapse
Still no adb while stuck at Google logo
/system is handled differently though - notice in the factory install logs there is no detail about filesystem creation for the /system partition? That's because Google is using a "sparse ext4 image" format for the system.img file, and it can actually write this to the /system partition as a binary blob.
So, on the chance that there is something wrong with the system partition, why don't you manually create the /system filesystem by hand to see if any errors occur? e.g.
mke2fs -T ext4 -m 0 /dev/block/mmcblk0p3
If this proceeds without error, try installing a dev ROM (not a factory ROM) and see if you can get further along.
Click to expand...
Click to collapse
wow - why would they do that? Anyway, I flashed recovery-clockwork-6.0.2.3-grouper.img and was able to format:
Code:
~ # mke2fs -T ext4 -m 0 /dev/block/mmcblk0p3
mke2fs -T ext4 -m 0 /dev/block/mmcblk0p3
mke2fs 1.41.11 (14-Mar-2010)
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
41664 inodes, 166400 blocks
0 blocks (0.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=171966464
6 block groups
32768 blocks per group, 32768 fragments per group
6944 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
This filesystem will be automatically checked every 39 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
and with adb sideload tried to install pa_grouper-3.00-09FEB2013-203806.zip. But it stopped at "Installing update..." (the cat /proc/kmsg is here: http://pastebin.com/rjd3b1iZ). I tried it again and again it stopped at Installing update, and here is the last_kmsg and the kmsg again: http://pastebin.com/gPBe7JFD and http://pastebin.com/uXHbX3we.
The one thing which is fortunate about your situation is that you can return your device through flashing to complete factory stock, including locking the bootloader... if returning the device (via a warranty return/RMA) process is an option for you.
Click to expand...
Click to collapse
Since everything failed I guess that's my only option, unless there is something in the logs ... maybe you could take another look?
Whew that was a lot of typing. I think I am done for the day.
Click to expand...
Click to collapse
And I am very thankful for your help!

aha,
I am travelling now, so there is a bunch of stuff I can't do easily right now... but I will have a look at the pastebins to see if anything jumps out at me.
Stay tuned.

aha27,
I looked at your pastebins. The only thing that seemed odd was the complaints about the cache partition (mmcblk0p4) in the kmsg logs. But it only appeared one time - hardly compelling.
The only other thing I could suggest is perhaps look in the recovery logs ( /cache/recovery/recovery.log or /tmp/recovery.log) for the recoveries that hang (but you can still communicate with). Maybe there are some crumbs in there that will put you on the correct trail.
FWIW, when I boot my N7 (JOP40D), it does take quite a bit of time for adb to come up - so if the initial OS boot was getting wedged before that happened maybe that explains why you are not seeing it even though you diddled with /data/property/persist....
I haven't looked into this, but is it possible to modify default.prop in the ramdisk so that the adb service gets started earlier? You would have to unpack & repack a boot image to do this. Actually, now that I think of it, you could just modify the "adbd" service definition in the /init.rc file in the ramdisk so that adb is not contingent on a getvar/setvar variable. Perhaps that would get adb running earlier in the OS boots that are hanging, and you might have a chance of observing more things.
I seem to be running out of ideas. With a lot more work, you could implement all sorts of unattended/blind captures though. For instance, a "one-shot" service definition can call a script that starts yet another script - but puts the 2nd one into the background. That way the oneshot service does not block init - and the second script can do strange things such as periodically record dmesg output or logcat output into files in /tmp and then copy them to the /sdcard once it is mounted. This would give you a way to observe stuff going on in the Android boot (after the fact) even if you can't gain realtime access via adb. But, this does require that you unpack, modify, and re-pack boot images.
Well, there's a few ideas. They seem to require progressively more work, though.
Good luck with your tab.

Thanks thanks thanks, but ...
Thank you very very much for the time you invested in my problem, :good:
but this:
bftb0 said:
aha27,
I haven't looked into this, but is it possible to modify default.prop in the ramdisk so that the adb service gets started earlier? You would have to unpack & repack a boot image to do this. Actually, now that I think of it, you could just modify the "adbd" service definition in the /init.rc file in the ramdisk so that adb is not contingent on a getvar/setvar variable. Perhaps that would get adb running earlier in the OS boots that are hanging, and you might have a chance of observing more things.
I seem to be running out of ideas. With a lot more work, you could implement all sorts of unattended/blind captures though. For instance, a "one-shot" service definition can call a script that starts yet another script - but puts the 2nd one into the background. That way the oneshot service does not block init - and the second script can do strange things such as periodically record dmesg output or logcat output into files in /tmp and then copy them to the /sdcard once it is mounted. This would give you a way to observe stuff going on in the Android boot (after the fact) even if you can't gain realtime access via adb. But, this does require that you unpack, modify, and re-pack boot images.
Click to expand...
Click to collapse
is too time consuming for me and as the tab is not too old, I will reflash it with stock, lock it and send it back. Initially I thought it could be solved, then I hoped that you could help me proving it is a hardware problem, so I'd have no problem getting it replaced, but let's see what Google tells me.
Good luck with your tab.
Click to expand...
Click to collapse
Thank you. Although it is off-topic: I talked to Google support (Germany) and they were absolutely not helpful. On the contrary, after I told them that I unlocked it to flash the previous image they told me, that as I have voided my waranty the could not guarantee that the tab will be replaced. And: they won't tell me (even after I asked twice), which options I'll have and what they will costcost, if it's a problem due to unlocking thus not covered by guarantee. That was no nice exceperience so far.

Well, if it turns out that Google/Asus refuses to do anything for you (seems hard to imagine, but I suppose all things are possible) and they return the tablet to you in the same condition, send me a PM or come back to this thread.
best

bftb0 said:
Well, if it turns out that Google/Asus refuses to do anything for you (seems hard to imagine, but I suppose all things are possible) and they return the tablet to you in the same condition, send me a PM or come back to this thread.
best
Click to expand...
Click to collapse
Hi I have almost the same problem, the thing is I'm using Mac and i don't have pc.
And my mac can't recognize my n7. I have installed TWRP v2.4.3.0
Please advice me.
Thank you

coszy said:
Hi I have almost the same problem, the thing is I'm using Mac and i don't have pc.
And my mac can't recognize my n7. I have installed TWRP v2.4.3.0
Please advice me.
Thank you
Click to expand...
Click to collapse
fastboot and adb work perfectly on the Mac.
http://developer.android.com/sdk/index.html
In fact, of the three platforms (Windows, Linux, Mac) setting up fastboot/adb on the Mac requires the least effort.

stuck on google logo after factory reset
My Nexus 7 locked up, got it to the recovery screen and did a factory reset. now I am stuck in a loop... it opens to the black screen with GOOGLE and stays there. I can get it to the bootloader screen but nothing more. Help please... I am NOT tech saavy!

mac20132 said:
My Nexus 7 locked up, got it to the recovery screen and did a factory reset. now I am stuck in a loop... it opens to the black screen with GOOGLE and stays there. I can get it to the bootloader screen but nothing more. Help please... I am NOT tech saavy!
Click to expand...
Click to collapse
I sent mine to Google and got a new one ...

[SOLVED] Using Terminal Emulator to write to system

Not sure if this will help anyone else, but I searched forever trying to figure out how to write into the system folder using Terminal Emulator on the Note 3 to no avail. I found a slew of posts that said to type "mount -o rw,remount /system" to achieve this. When I used this command it didn't return any errors so I assumed it worked, however no files ended up being copied and pasted to the location I wanted. I found numerous other examples that were supposed to enable writing to the system as well, but none of them worked. I finally figured out how to get it to work on my Note 3 by typing "mount" in terminal emulator and noticing that at the very beginning of the string that was returned was "rootfs". So if you are wanting write to your system using Terminal Emulator on the VZW Note 3 here is what ended up working for me:
Code:
mount -o remount,rw rootfs
to return to read only enter:
Code:
mount -o remount,ro rootfs
I wanted to figure this out because a bug in TWRP v2.6.3.0 maimed my efs partition and bricklooped my phone. Even flashing the Stock Developer tar by Beans wouldn't bring it out of the brickloop. I was able to get out of the brickloop by following this thread, but even though my phone booted up and the IMEI # was correct, my /efs folder was missing in action. This caused odd things to happen like my lock screen not functioning and the power button instantly turning the phone off instead of bringing up the power menu. I discovered this was because the phone was placed into something called "factory mode" and that to fix it you needed to edit some files in the efs folder, which were completely missing on my device. Member js0uth graciously sent me his efs folder from his Developer Note 3 and when I copied it to my phone it began to function normally again (big shout out to js0uth!). However, this folder was completely deleted once again after a reboot. So now you can see why I was looking for a way to copy these files using Terminal Emulator. I ended up making a Tasker profile with the Secure Settings plugin that automatically copies the files from my ext SD card to my system folder on boot of the device. In order to mount, copy/paste the files while retaining the correct permissions from the folder that js0uth sent me, and unmount the system I had the set up my Secure Settings command as follows:
Code:
mount -o remount,rw rootfs;cp -Rpf /storage/extSdCard/efs/* /efs/;mount -o remount,ro rootfs
So now I have a livable workaround for my problem until I can discover a way for the phone to rebuild my own /efs folder.
Edit: See radionerd's post for a permanent fix to this issue and be sure to hit thanks under his name if it helps you.

I did the same to my DE. Corrupted EFS about a month ago after a few flashes using TWRP 2.6.3.0. Boot loops for 28 hours of hell until I followed your tracks to the trick that deleted my corrupted EFS folder, and created a new empty folder. I guess this would wipe out IMEI, Mac, and more in models that store phone specific data in EFS. We lucked out I've read that our phones have that info in a few other folder not EFS
Since wiping EFS I have run stock ROM, CM11, and now bean V6. I didn't see the factory mode popup until recently. I noticed that the screen will flash when leaving or entering cell service.
My corrupted EFS was 3MB. I'm curious what's the size of the EFS folder from js0uth?
Were you able to enter the factory mode on string? something like this?
Code:
# echo -n ON > /efs/FactoryApp/factorymode
this is from an S3
Thanks for documenting your steps to recovery.
radionerd

radionerd said:
My corrupted EFS was 3MB. I'm curious what's the size of the EFS folder from js0uth?
Click to expand...
Click to collapse
It's 1.04 MB. Sorry for taking so long to respond. I thought I had it set up to send instant emails for replies to this thread, but apparently I didn't.
radionerd said:
Were you able to enter the factory mode on string? something like this?
Code:
# echo -n ON > /efs/FactoryApp/factorymode
this is from an S3
Click to expand...
Click to collapse
Setting the Factorymode folder to ON is actually what disables that mode. Seems backwards I know, but when it's set to OFF (or if the folder is completely missing as in my case) that warning message will display. If that folder is intact on your phone then you should be able to use a string to disable or enable Factorymode.

It got worse before it got better
bodieism said:
It's 1.04 MB. Sorry for taking so long to respond. I thought I had it set up to send instant emails for replies to this thread, but apparently I didn't.
No worries, I went from an annoyance of no lock screen to bricked for over 6 weeks. This happened after trying to do an EFS backup.
I've learned a lot since back then, My DE is back 100%, EFS is repaired. I think we ran the same script which actually points to the wrong mount in our phones. It brought us out of bootloops, but efs was pointed to block12. Qualcom snapdragon Note-3's use mmblk0p11 to load /efs.
If you still have to load the tasker script, I think I figured out an easy fix to rebuild your original efs folder.
I would backup mounts first, delete /efs folder. Then run the original script, but this time change from 12 to 11.
Code:
adb shell
su
mke2fs /dev/block/mmcblk0p11
mkdir /efs
mount -t ext4 /dev/block/mmcblk0p11 /efs
Bet that would do the trick
Here is my thread
Click to expand...
Click to collapse

^ That did do the trick! :good:
Phone is back to 100% working order :highfive:

[Q] efs folder empty, 'E: unable to mount /efs' error (still have IMEI)

Hi all
I still have IMEI, I'm able to make phone calls and everything else. But my phone is in this Factory Mode and my EFS folder can not be mounted and it empty.
I have EFS back up.
when i flash somthing i see 'E: unable to mount /efs' error'
I have tried to search for sulotion without succes and i tried to flash stock rom and other roms and still same problem.
what sould i do?

up

eden66 said:
Hi all
I still have IMEI, I'm able to make phone calls and everything else. But my phone is in this Factory Mode and my EFS folder can not be mounted and it empty.
I have EFS back up.
when i flash somthing i see 'E: unable to mount /efs' error'
I have tried to search for sulotion without succes and i tried to flash stock rom and other roms and still same problem.
what sould i do?
Click to expand...
Click to collapse
That's a weird problem.
It sounds like the EFS is working properly but the phone can't mount the partition properly. (Which is weird by itself)
You might try using Odin to flash back to bone stock to see if that repairs the partition. But that might be risky if the EFS is damaged because any further damage might totally kill the EFS.
When you say you have the IMEI do you know that because you can make calls? Or do you know that because you have looked in settings and it tells you what your IMEI is?

Skipjacks said:
That's a weird problem.
It sounds like the EFS is working properly but the phone can't mount the partition properly. (Which is weird by itself)
You might try using Odin to flash back to bone stock to see if that repairs the partition. But that might be risky if the EFS is damaged because any further damage might totally kill the EFS.
When you say you have the IMEI do you know that because you can make calls? Or do you know that because you have looked in settings and it tells you what your IMEI is?
Click to expand...
Click to collapse
I tired back to stock but same probelm.
And i see the IMEI in the settings and when I dail *#06#. The IMEI is ok like it As appears behind the battery.
its very wierd

eden66 said:
Hi all
I still have IMEI, I'm able to make phone calls and everything else. But my phone is in this Factory Mode and my EFS folder can not be mounted and it empty.
I have EFS back up.
when i flash somthing i see 'E: unable to mount /efs' error'
I have tried to search for sulotion without succes and i tried to flash stock rom and other roms and still same problem.
what sould i do?
Click to expand...
Click to collapse
Hi mate ,
try this maybe folder are not mounted correctly
1- Install / use Terminal Emulator
2- mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10
3- mke2fs /dev/block/mmcblk0p10
4- mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10 /efs
5- Reboot
Anyhow check this thread also
http://forum.xda-developers.com/showthread.php?t=2392632

[Q] HELP... NOTHING will work

so i have an S4 GT-I9505 originally on H3G. i live in the UK
i was given the phone as a non starter, i have managed to flash Cyanomodgen 11.0 however ....
it has a sim card in yet it states:
Network - Unknown
Signal Strength - 0
Mobile Network Type - Unknown
Service status - Out of Service
Roaming - Not roaming
Mobile Network State - disconnected
My Phone number - unknown
IMEI - Unknown
IMEI SV - Unknown
Baseband version - Unknown
i have tried using Odin to flash the original O/S but odin gets stuck on 'getting PIT'
i have tried using Odin to flash a new radio again it sticks at 'getting pit'
I have tried EFS recovery but the EFS file is practically empty and wont restore and doesn't have the relevant files in for a restore...
really really stuck with this, at this moment in time i have a tablet not a phone.
I just want this back to stock working as a phone....
HELP

piratesteve84 said:
so i have an S4 GT-I9505 originally on H3G. i live in the UK
i was given the phone as a non starter, i have managed to flash Cyanomodgen 11.0 however ....
it has a sim card in yet it states:
Network - Unknown
Signal Strength - 0
Mobile Network Type - Unknown
Service status - Out of Service
Roaming - Not roaming
Mobile Network State - disconnected
My Phone number - unknown
IMEI - Unknown
IMEI SV - Unknown
Baseband version - Unknown
i have tried using Odin to flash the original O/S but odin gets stuck on 'getting PIT'
i have tried using Odin to flash a new radio again it sticks at 'getting pit'
I have tried EFS recovery but the EFS file is practically empty and wont restore and doesn't have the relevant files in for a restore...
really really stuck with this, at this moment in time i have a tablet not a phone.
I just want this back to stock working as a phone....
HELP
Click to expand...
Click to collapse
Hi mate ,
Do you have an EFS backup? restore it
Check if the EFS folder is mounted correctly
Install / use Terminal Emulator
mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10
mke2fs /dev/block/mmcblk0p10
mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10 /efs
Reboot
After that check :
With a root explorer go to EFS/factoryApp/factorymode and open it if it says off change it to on
If you decide to go back to stoc check here , great thread , it shows you how to use the PIT file

EFS and Terminal
Thanks for your reply,
since my post i have managed to flash a stock rom (4.4.2), however when i use root browser to look in the EFS folder it is empty
so i downloaded terminal emulater.. when i opened terminal it went like this
[email protected]:/ $
i then typed in what you said...
[email protected]:/ $ mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10
it then read
mount: invalid option -- -
mount: invalid option --
so i tried
mke2fs /dev/block/mmcblk0p10
nothing happened
so then i tried
mount -r -w -o remount,rw -t ext4 /dev/block/mmcblk0p10 /efs
it then showed
mount[ -r option] [ -w option] [-o option] remount,rw -t ext4 /dev/block/mmcblk0p10 /efs
so i reset the device and went looking for the EFS file..... again empty.
sorry for the long winded reply but its all about the detail.

piratesteve84 said:
so i have an S4 GT-I9505 originally on H3G. i live in the UK
i was given the phone as a non starter, i have managed to flash Cyanomodgen 11.0 however ....
it has a sim card in yet it states:
Network - Unknown
Signal Strength - 0
Mobile Network Type - Unknown
Service status - Out of Service
Roaming - Not roaming
Mobile Network State - disconnected
My Phone number - unknown
IMEI - Unknown
IMEI SV - Unknown
Baseband version - Unknown
i have tried using Odin to flash the original O/S but odin gets stuck on 'getting PIT'
i have tried using Odin to flash a new radio again it sticks at 'getting pit'
I have tried EFS recovery but the EFS file is practically empty and wont restore and doesn't have the relevant files in for a restore...
really really stuck with this, at this moment in time i have a tablet not a phone.
I just want this back to stock working as a phone....
HELP
Click to expand...
Click to collapse
It looks to me like You have lost Your EFS partition data.
This is bad if You don't have EFS backup done.
Only way to restore Your EFS data without backup is either returning to return to full stock plus Triangle Away wipe flash counter and sending phone to warranty repair.
Or if You are not under warranty, find someone with Z3X box.