Sim Unlock Free!! - Desire 626 General

CONFIRMED WORKING
No CDMA like Sprint or Verizon. Feel free to test though
Sprint See here
Hey guys.
See my work for HTC M9 unlock here http://forum.xda-developers.com/one-m9/general/sim-unlock-method-t3143333
Once again I have done it with a similar method to before.....
Anway, to SIM UNLOCK YOUR 626 PLEASE FOLLOW BELOW
First things first:
HTC DEV bootloader unlock
TWRP install
SU
S-Off via Sunshine (optional)
Now for the fun
I then dumped all the partitions.
Here is the list BTW:
Code:
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_config"
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_record"
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01400000 00000200 "fataldevlog"
mmcblk0p51: 01e00000 00000200 "devlog"
mmcblk0p52: 00a00000 00000200 "ramdump"
mmcblk0p53: 00a00000 00000200 "battery"
mmcblk0p54: 01000000 00000200 "absolute"
mmcblk0p55: 023a4800 00000200 "reserve"
mmcblk0p56: 03000000 00000200 "hosd"
mmcblk0p57: 02000000 00000200 "boot"
mmcblk0p58: 02000000 00000200 "recovery"
mmcblk0p59: 10000000 00000200 "cache"
mmcblk0p60: a0000000 00000200 "system"
mmcblk0p61: 12000000 00000200 "apppreload"
mmcblk0p62: 02800000 00000200 "cota"
mmcblk0p63: f0000000 00000200 "userdata"
Something that stood out (just like on the M9) was mmcblk0p36 which is "rfg_8" as the unlock partition on the M9 was also rfg_8.
With the help of @kristid1991 and a remote connection,
I compared the rfg_8 from the 626 and compared it to mine from the M9 and THEY WERE THE SAME.
So I flashed (dd) the 'sim unlock' mmcblk0p36 and it was SIM UNLOCKED again
To Sim unlock your device
Please use the following code:
Code:
adb shell
su
dd if=/dev/block/mmcblk0p36 of=/sdcard/mmcblk0p36old
exit
exit
adb pull /sdcard/mmcblk0p36old
Do the above and save it to you computer. Download my mmcblk0p36-rfg_8-Locked.txt and compare the two files.
You can do this using HxD from here http://mh-nexus.de/en/hxd/
Drag both files (locked partitions) into HxD and press Ctrl + K or go to File > Analysis > File-Compare > Compare....
It will prop up 'both files are identical'
If there is a file difference then STOP
If the file is the same then you can do the following:
Please copy and paste one line at a time
mmcblk0p36-rfg_8-UnLocked.txt must be in your ADB directory OR manually place on the root of internal SD Card and rename to mmcblk0p36new
Code:
adb push mmcblk0p36-rfg_8-UnLocked.txt /sdcard/mmcblk0p36new
adb shell
su
dd if=/sdcard/mmcblk0p36new of=/dev/block/mmcblk0p36
exit
exit
Please use the Poll above and leave a comment
Please don't forget to click the thanks button or donate to me http://forum.xda-developers.com/donatetome.php?u=4428363
This took a lot of time and effort. The (at least) $5 it would have cost you for the unlock code, could be put to better use
Thanks for the support guys
Stifilz
THANKS TO:
@kristid1991 for the remote connection to UNLOCK 626

Missing files??
Sorry but the backups of the mentioned emmc partition are not here i tried the ones from m9 unlock but no dice have you forgot to upload them?
stifilz said:
CONFIRMED WORKING
No CDMA like Sprint or Verizon. Feel free to test though
Sprint See here
Hey guys.
See my work for HTC M9 unlock here http://forum.xda-developers.com/one-m9/general/sim-unlock-method-t3143333
Once again I have done it with a similar method to before.....
Anway, to SIM UNLOCK YOUR 626 PLEASE FOLLOW BELOW
First things first:
HTC DEV bootloader unlock
TWRP install
SU
S-Off via Sunshine (optional)
Now for the fun
I then dumped all the partitions.
Here is the list BTW:
Code:
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_config"
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_record"
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01400000 00000200 "fataldevlog"
mmcblk0p51: 01e00000 00000200 "devlog"
mmcblk0p52: 00a00000 00000200 "ramdump"
mmcblk0p53: 00a00000 00000200 "battery"
mmcblk0p54: 01000000 00000200 "absolute"
mmcblk0p55: 023a4800 00000200 "reserve"
mmcblk0p56: 03000000 00000200 "hosd"
mmcblk0p57: 02000000 00000200 "boot"
mmcblk0p58: 02000000 00000200 "recovery"
mmcblk0p59: 10000000 00000200 "cache"
mmcblk0p60: a0000000 00000200 "system"
mmcblk0p61: 12000000 00000200 "apppreload"
mmcblk0p62: 02800000 00000200 "cota"
mmcblk0p63: f0000000 00000200 "userdata"
Something that stood out (just like on the M9) was mmcblk0p36 which is "rfg_8" as the unlock partition on the M9 was also rfg_8.
With the help of @kristid1991 and a remote connection,
I compared the rfg_8 from the 626 and compared it to mine from the M9 and THEY WERE THE SAME.
So I flashed (dd) the 'sim unlock' mmcblk0p36 and it was SIM UNLOCKED again
To Sim unlock your device
Please use the following code:
Code:
adb shell
su
dd if=/dev/block/mmcblk0p36 of=/sdcard/mmcblk0p36old
exit
exit
adb pull /sdcard/mmcblk0p36old
Do the above and save it to you computer. Download my mmcblk0p36-rfg_8-Locked.txt and compare the two files.
You can do this using HxD from here http://mh-nexus.de/en/hxd/
Drag both files (locked partitions) into HxD and press Ctrl + K or go to File > Analysis > File-Compare > Compare....
It will prop up 'both files are identical'
If there is a file difference then STOP
If the file is the same then you can do the following:
Please copy and paste one line at a time
mmcblk0p36-rfg_8-UnLocked.txt must be in your ADB directory OR manually place on the root of internal SD Card and rename to mmcblk0p36new
Code:
adb push mmcblk0p36-rfg_8-UnLocked.txt /sdcard/mmcblk0p36new
adb shell
su
dd if=/sdcard/mmcblk0p36new of=/dev/block/mmcblk0p36
exit
exit
Please use the Poll above and leave a comment
Please don't forget to click the thanks button or donate to me http://forum.xda-developers.com/donatetome.php?u=4428363
This took a lot of time and effort. The (at least) $5 it would have cost you for the unlock code, could be put to better use
Thanks for the support guys
Stifilz
THANKS TO:
@kristid1991 for the remote connection to UNLOCK 626
Click to expand...
Click to collapse

dbstrand24 said:
Sorry but the backups of the mentioned emmc partition are not here i tried the ones from m9 unlock but no dice have you forgot to upload them?
Click to expand...
Click to collapse
Oops, forgot to upload
Edit: uploaded now. Please post results after. Thanks

Fingers crossed!
I have rebooted after wiping cache and dalvic Hope it works
:good::good::good::good:
stifilz said:
Oops, forgot to upload
Edit: uploaded now. Please post results after. Thanks
Click to expand...
Click to collapse
---------- Post added at 12:15 PM ---------- Previous post was at 12:09 PM ----------
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But my variant MAY be different i have a desire 626s from Metro PCS, so silly im trying to unlock it to use on t-mobile and its a MVNO of t-mobile i shouldnt HAVE to unlock...
emmc partitions
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_conf
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_recor
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01400000 00000200 "fataldevlo
mmcblk0p51: 01e00000 00000200 "devlog"
mmcblk0p52: 00a00000 00000200 "ramdump"
mmcblk0p53: 00a00000 00000200 "battery"
mmcblk0p54: 01000000 00000200 "absolute"
mmcblk0p55: 023a4800 00000200 "reserve"
mmcblk0p56: 03000000 00000200 "hosd"
mmcblk0p57: 02000000 00000200 "boot"
mmcblk0p58: 02000000 00000200 "recovery"
mmcblk0p59: 10000000 00000200 "cache"
mmcblk0p60: a0000000 00000200 "system"
mmcblk0p61: 12000000 00000200 "apppreload
mmcblk0p62: 02800000 00000200 "cota"
mmcblk0p63: f0000000 00000200 "userdata"
Tell me if i can add any more info to help out

dbstrand24 said:
I have rebooted after wiping cache and dalvic Hope it works
:good::good::good::good:
---------- Post added at 12:15 PM ---------- Previous post was at 12:09 PM ----------
But my variant MAY be different i have a desire 626s from Metro PCS, so silly im trying to unlock it to use on t-mobile and its a MVNO of t-mobile i shouldnt HAVE to unlock...
emmc partitions
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_conf
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_recor
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01400000 00000200 "fataldevlo
mmcblk0p51: 01e00000 00000200 "devlog"
mmcblk0p52: 00a00000 00000200 "ramdump"
mmcblk0p53: 00a00000 00000200 "battery"
mmcblk0p54: 01000000 00000200 "absolute"
mmcblk0p55: 023a4800 00000200 "reserve"
mmcblk0p56: 03000000 00000200 "hosd"
mmcblk0p57: 02000000 00000200 "boot"
mmcblk0p58: 02000000 00000200 "recovery"
mmcblk0p59: 10000000 00000200 "cache"
mmcblk0p60: a0000000 00000200 "system"
mmcblk0p61: 12000000 00000200 "apppreload
mmcblk0p62: 02800000 00000200 "cota"
mmcblk0p63: f0000000 00000200 "userdata"
Tell me if i can add any more info to help out
Click to expand...
Click to collapse
Dump your 36 partition and upload it

stifilz said:
Oops, forgot to upload
Edit: uploaded now. Please post results after. Thanks
Click to expand...
Click to collapse
It worked fine on my AT&T 626
thank you

clsA said:
It worked fine on my AT&T 626
thank you
Click to expand...
Click to collapse
Here is my partiotion I tried to flash T-Mobile RUU was unsucsessfull file size errors... I also tried to set SuperCID this also failed i assume i need s-off for this?
http://b34st.mooo.com/mmcblk0p36.txt
---------- Post added at 04:18 AM ---------- Previous post was at 04:17 AM ----------
Please vote yes
clsA said:
It worked fine on my AT&T 626
thank you
Click to expand...
Click to collapse

dbstrand24 said:
Here is my partiotion I tried to flash T-Mobile RUU was unsucsessfull file size errors... I also tried to set SuperCID this also failed i assume i need s-off for this?
http://b34st.mooo.com/mmcblk0p36.txt
---------- Post added at 04:18 AM ---------- Previous post was at 04:17 AM ----------
Please vote yes
Click to expand...
Click to collapse
your file is the same as the locked one... did you follow the instructions correctly ?
I don't have s-off and it worked first try.
Also, where is this t-mobile RUU you mentioned I found it here http://www.htc.com/us/support/rom-downloads.html
both T-Mobile/Metro PCS use the same RUU so what was your error ?

Followed to a T i'm honestly no n00b with this stuff been working with cell phones since 2008 and the ruu i downloaded straight from HTC's support site, the file match error i know for a fact is because the CID is incorrect now.
*** I DO Know for a fact that this sim had a CLONED sim in it when i got it, so it may be on a blacklist...***
When i put the cloned sim in i get "4gLTE" symbol just no connectivity
http://www.htc.com/us/support/rom-downloads.html

RUU Errors
I actually couldn't get the RUU package to run properly on windows 7 so i pulled the rom.zip out and tried to manually flash it after t-mobile failed i pretty much gave up, no further testing was done, though i will get back to it again tonight
ALSO the metro and t-mobile RUU are different sizes so clearly not same RUU
clsA said:
your file is the same as the locked one... did you follow the instructions correctly ?
I don't have s-off and it worked first try.
Also, where is this t-mobile RUU you mentioned I found it here http://www.htc.com/us/support/rom-downloads.html
both T-Mobile/Metro PCS use the same RUU so what was your error ?
Click to expand...
Click to collapse

dbstrand24 said:
I actually couldn't get the RUU package to run properly on windows 7 so i pulled the rom.zip out and tried to manually flash it after t-mobile failed i pretty much gave up, no further testing was done, though i will get back to it again tonight
ALSO the metro and t-mobile RUU are different sizes so clearly not same RUU
Click to expand...
Click to collapse
Not sure it's worth it on this phone, but you could use Sunshine and S-Off the phone and use any RUU you want.
changing the CID and MID is very easy on these HTC Phones with S-Off
Back on Topic, the above instructions work fine to unlock this phone.

stifilz said:
CONFIRMED WORKING
No CDMA like Sprint or Verizon. Feel free to test though
Sprint See here
Hey guys.
See my work for HTC M9 unlock here http://forum.xda-developers.com/one-m9/general/sim-unlock-method-t3143333
Once again I have done it with a similar method to before.....
Anway, to SIM UNLOCK YOUR 626 PLEASE FOLLOW BELOW
First things first:
HTC DEV bootloader unlock
TWRP install
SU
S-Off via Sunshine (optional)
Now for the fun
I then dumped all the partitions.
Here is the list BTW:
Code:
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 01af7c00 00000200 "reserve_1"
mmcblk0p5: 00040000 00000200 "mfg"
mmcblk0p6: 017afc00 00000200 "pg2fs"
mmcblk0p7: 00040000 00000200 "rpm"
mmcblk0p8: 00200000 00000200 "tz"
mmcblk0p9: 00400000 00000200 "aboot"
mmcblk0p10: 00a00000 00000200 "sp1"
mmcblk0p11: 00008000 00000200 "ddr"
mmcblk0p12: 00100000 00000200 "rfg_0"
mmcblk0p13: 00100000 00000200 "rfg_1"
mmcblk0p14: 00100000 00000200 "rfg_2"
mmcblk0p15: 00100000 00000200 "rfg_3"
mmcblk0p16: 00100000 00000200 "rfg_4"
mmcblk0p17: 00100000 00000200 "rfg_5"
mmcblk0p18: 00100000 00000200 "rfg_6"
mmcblk0p19: 00100000 00000200 "rfg_7"
mmcblk0p20: 00180000 00000200 "fsg"
mmcblk0p21: 03b00400 00000200 "radio"
mmcblk0p22: 00a00000 00000200 "tool_diag"
mmcblk0p23: 00500000 00000200 "wcnss"
mmcblk0p24: 00000400 00000200 "limits"
mmcblk0p25: 00447c00 00000200 "reserve_2"
mmcblk0p26: 00100000 00000200 "misc"
mmcblk0p27: 00001000 00000200 "debug_config"
mmcblk0p28: 00180000 00000200 "modem_st1"
mmcblk0p29: 00180000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "pdata"
mmcblk0p31: 01600000 00000200 "persist"
mmcblk0p32: 00004000 00000200 "sec"
mmcblk0p33: 00100000 00000200 "cdma_record"
mmcblk0p34: 00000400 00000200 "fsc"
mmcblk0p35: 00002000 00000200 "ssd"
mmcblk0p36: 00020000 00000200 "rfg_8"
mmcblk0p37: 00020000 00000200 "rfg_9"
mmcblk0p38: 00020000 00000200 "rfg_10"
mmcblk0p39: 00020000 00000200 "rfg_11"
mmcblk0p40: 00020000 00000200 "rfg_12"
mmcblk0p41: 00020000 00000200 "rfg_13"
mmcblk0p42: 00020000 00000200 "rfg_14"
mmcblk0p43: 00020000 00000200 "rfg_15"
mmcblk0p44: 00004000 00000200 "control"
mmcblk0p45: 00010000 00000200 "extra"
mmcblk0p46: 00140400 00000200 "local"
mmcblk0p47: 00040000 00000200 "skylink"
mmcblk0p48: 02800000 00000200 "carrier"
mmcblk0p49: 00080000 00000200 "frp"
mmcblk0p50: 01400000 00000200 "fataldevlog"
mmcblk0p51: 01e00000 00000200 "devlog"
mmcblk0p52: 00a00000 00000200 "ramdump"
mmcblk0p53: 00a00000 00000200 "battery"
mmcblk0p54: 01000000 00000200 "absolute"
mmcblk0p55: 023a4800 00000200 "reserve"
mmcblk0p56: 03000000 00000200 "hosd"
mmcblk0p57: 02000000 00000200 "boot"
mmcblk0p58: 02000000 00000200 "recovery"
mmcblk0p59: 10000000 00000200 "cache"
mmcblk0p60: a0000000 00000200 "system"
mmcblk0p61: 12000000 00000200 "apppreload"
mmcblk0p62: 02800000 00000200 "cota"
mmcblk0p63: f0000000 00000200 "userdata"
Something that stood out (just like on the M9) was mmcblk0p36 which is "rfg_8" as the unlock partition on the M9 was also rfg_8.
With the help of @kristid1991 and a remote connection,
I compared the rfg_8 from the 626 and compared it to mine from the M9 and THEY WERE THE SAME.
So I flashed (dd) the 'sim unlock' mmcblk0p36 and it was SIM UNLOCKED again
To Sim unlock your device
Please use the following code:
Code:
adb shell
su
dd if=/dev/block/mmcblk0p36 of=/sdcard/mmcblk0p36old
exit
exit
adb pull /sdcard/mmcblk0p36old
Do the above and save it to you computer. Download my mmcblk0p36-rfg_8-Locked.txt and compare the two files.
You can do this using HxD from here http://mh-nexus.de/en/hxd/
Drag both files (locked partitions) into HxD and press Ctrl + K or go to File > Analysis > File-Compare > Compare....
It will prop up 'both files are identical'
If there is a file difference then STOP
If the file is the same then you can do the following:
Please copy and paste one line at a time
mmcblk0p36-rfg_8-UnLocked.txt must be in your ADB directory OR manually place on the root of internal SD Card and rename to mmcblk0p36new
Code:
adb push mmcblk0p36-rfg_8-UnLocked.txt /sdcard/mmcblk0p36new
adb shell
su
dd if=/sdcard/mmcblk0p36new of=/dev/block/mmcblk0p36
exit
exit
Please use the Poll above and leave a comment
Please don't forget to click the thanks button or donate to me http://forum.xda-developers.com/donatetome.php?u=4428363
This took a lot of time and effort. The (at least) $5 it would have cost you for the unlock code, could be put to better use
Thanks for the support guys
Stifilz
THANKS TO:
@kristid1991 for the remote connection to UNLOCK 626
Click to expand...
Click to collapse
is this guide works on this model:
http://www.ebay.com/itm/131593194519?_trksid=p2055119.m1438.l2649&ssPageName=STRK:MEBIDX:IT
HTC Desire 626s 5" Android Smartphone works with Virgin Mobile
?
Thanks

@stifilz I'm trying to unlock a Desire 626s MetroPCS variant and got the same results @dbstrand24 did. The locked mmcblk0p36 file was identical to yours. I flashed the unlocked mmcblk0p36, popped in a T-Mobile SIM and still got the "This device can be unlocked" message.

Y.G. said:
@stifilz I'm trying to unlock a Desire 626s MetroPCS variant and got the same results @dbstrand24 did. The locked mmcblk0p36 file was identical to yours. I flashed the unlocked mmcblk0p36, popped in a T-Mobile SIM and still got the "This device can be unlocked" message.
Click to expand...
Click to collapse
Could be something to do with Metro? Is there and unlock app? Like T-Mobile has? Perhaps that is getting in the way? With the M9 unlock it worked fine with T-Mobile device but I'm not sure about Metro...

stifilz said:
Could be something to do with Metro? Is there and unlock app? Like T-Mobile has? Perhaps that is getting in the way? With the M9 unlock it worked fine with T-Mobile device but I'm not sure about Metro...
Click to expand...
Click to collapse
Yeah it has an unlock device app. I ran it after pushing the unlock file and it still said the device was ineligible to be unlocked.

i have this error can anyone help me, i have sdcard inside.
C:\adb>adb shell
[email protected]_a32eul:/ $ su
[email protected]_a32eul:/ # dd if=/dev/block/mmcblk0p36 of=/sdcard/mmcblk0p36old
256+0 records in
256+0 records out
131072 bytes transferred in 0.004 secs (32768000 bytes/sec)
[email protected]_a32eul:/ # exit
[email protected]_a32eul:/ $ exit
C:\adb>adb pull /sdcard/mmcblk0p36old
remote object '/sdcard/mmcblk0p36old' does not exist
C:\adb>adb push mmcblk0p36-rfg_8-UnLocked.txt /sdcard/mmcblk0p36new
1066 KB/s (131072 bytes in 0.120s)
C:\adb>adb shell
[email protected]_a32eul:/ $ su
[email protected]_a32eul:/ # dd if=/sdcard/mmcblk0p36new of=/dev/block/mmcblk0p36
dd: /sdcard/mmcblk0p36new: No such file or directory
1|[email protected]_a32eul:/ # exit
1|[email protected]_a32eul:/ $ exit
---------- Post added at 12:33 PM ---------- Previous post was at 12:24 PM ----------
ok working great and unlock, change /sdcard to /sdcard2. check logs.
C:\adb>adb shell
[email protected]_a32eul:/ $ su
[email protected]_a32eul:/ # dd if=/dev/block/mmcblk0p36 of=/sdcard2/mmcblk0p36old
256+0 records in
256+0 records out
131072 bytes transferred in 0.070 secs (1872457 bytes/sec)
[email protected]_a32eul:/ # exit
[email protected]_a32eul:/ $ exit
C:\adb>adb pull /sdcard2/mmcblk0p36old
2560 KB/s (131072 bytes in 0.050s)
C:\adb>adb push mmcblk0p36-rfg_8-UnLocked.txt /sdcard2/mmcblk0p36new
41 KB/s (131072 bytes in 3.097s)
C:\adb>adb shell
[email protected]_a32eul:/ $ su
[email protected]_a32eul:/ # dd if=/sdcard/mmcblk0p36new of=/dev/block/mmcblk0p36
dd: /sdcard/mmcblk0p36new: No such file or directory
1|[email protected]_a32eul:/ # dd if=/sdcard2/mmcblk0p36new of=/dev/block/mmcblk0p36
256+0 records in
256+0 records out
131072 bytes transferred in 0.149 secs (879677 bytes/sec)
[email protected]_a32eul:/ # exit
[email protected]_a32eul:/ $ exit

is it method work for HTC Desire 626S T-Mobile ?
anyone tested ?

Gsm UK said:
is it method work for HTC Desire 626S T-Mobile ?
anyone tested ?
Click to expand...
Click to collapse
You tell us. M9 was the same for T-Mobile

how u get s-off on 626 ... i cant find anywhere

Only two thing's are required, anything else is optional such as twrp recovery.
1. Bootloader Unlocked
2. Rooted

Related

Radio block?

Hi ppl
Can someone tell me or link me.. As to which mmcblk represents radio?
Or if someone can kindly post the output of this command (need to be done after su).. It will be greatly appreciated
adb shell
su
cat /proc/emmc/
Thanks
Sent from my HTC Sensation 4G using xda premium
Code:
# cat /proc/emmc
dev: size erasesize name
mmcblk0p17: 00040000 00000200 "misc"
mmcblk0p21: 0087f400 00000200 "recovery"
mmcblk0p22: 00400000 00000200 "boot"
mmcblk0p25: 22dffe00 00000200 "system"
mmcblk0p27: 12bffe00 00000200 "cache"
mmcblk0p26: 496ffe00 00000200 "userdata"
mmcblk0p28: 014bfe00 00000200 "devlog"
mmcblk0p29: 00040000 00000200 "pdata"
#
Sent from my HTC Glacier using Tapatalk 2

[Info] Dual Sim 802d India --Got Updated to 2.37.720.1

Hi all,
i'm using HTC One dual sim 802d Indian version.
Today only i have got an update to 4.2.2..... so Indian user cheers for this update
something is better than nothing ...
So the latest version now is 2.37.720.1 (316.38 MB)
even i got the same update
why are the playing with us , the world has got 4.3 and we are still getting 4.2.2 bug fixes
nitin_ko said:
even i got the same update
why are the playing with us , the world has got 4.3 and we are still getting 4.2.2 bug fixes
Click to expand...
Click to collapse
Yap bro just hopping to get 4.3 asap ...
At least htc is still working on something or other
ravinder0003 said:
Yap bro just hopping to get 4.3 asap ...
At least htc is still working on something or other
Click to expand...
Click to collapse
we are way down their list. Hope we get it this year only and with sense 5.5
ravinder0003 said:
Hi all,
i'm using HTC One dual sim 802d Indian version.
Today only i have got an update to 4.2.2..... so Indian user cheers for this update
something is better than nothing ...
So the latest version now is 2.37.720.1 (316.38 MB)
Click to expand...
Click to collapse
hello ,
could you please provide a htc one dual sim 802d stock nandroid backup CWM.
My HTC run soul 20 v2 and i want to use the official one and cannot find one compatible with my phone could you please provide it to me
the thing that i didnt do a backup before installing soul ROM
HTC one dual sim was runing arabic version rom using "more local "
pn07510
hboot 2.27
s-off
CWM recovery
Please
fadihawari said:
hello ,
could you please provide a htc one dual sim 802d stock nandroid backup CWM.
My HTC run soul 20 v2 and i want to use the official one and cannot find one compatible with my phone could you please provide it to me
the thing that i didnt do a backup before installing soul ROM
HTC one dual sim was runing arabic version rom using "more local "
pn07510
hboot 2.27
s-off
CWM recovery
Please
Click to expand...
Click to collapse
thake a look at this thread
superpfpf said:
thake a look at this thread
Click to expand...
Click to collapse
Could not flash anything from this too :crying:
fadihawari said:
Could not flash anything from this too :crying:
Click to expand...
Click to collapse
connect yout phone with your computer and enter in your console on your computer:
1. adb shell
2. su -
3. cat /proc/emmc
now you see a list of your partitions, it looks similar to this
Code:
dev: size erasesize name
mmcblk0p20: 000ffa00 00000200 "misc"
mmcblk0p37: 00fffe00 00000200 "recovery"
mmcblk0p36: 01000000 00000200 "boot"
mmcblk0p38: 93fffc00 00000200 "system"
mmcblk0p27: 00140200 00000200 "local"
mmcblk0p39: 17fffe00 00000200 "cache"
mmcblk0p40: 670000000 00000200 "userdata"
mmcblk0p23: 01400000 00000200 "devlog"
mmcblk0p25: 00040000 00000200 "pdata"
mmcblk0p28: 00010000 00000200 "extra"
mmcblk0p34: 04b00200 00000200 "radio"
mmcblk0p16: 03c00400 00000200 "adsp"
mmcblk0p15: 00100000 00000200 "dsps"
mmcblk0p18: 00500000 00000200 "wcnss"
mmcblk0p17: 007ffa00 00000200 "radio_config"
mmcblk0p21: 00400000 00000200 "modem_st1"
mmcblk0p22: 00400000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "skylink"
mmcblk0p31: 01900000 00000200 "carrier"
mmcblk0p29: 00100000 00000200 "cdma_record"
mmcblk0p19: 01affe00 00000200 "reserve_1"
mmcblk0p33: 034ffa00 00000200 "reserve_2"
mmcblk0p35: 05fffc00 00000200 "reserve_3"
mmcblk0p32: 04729a00 00000200 "reserve"
search for "recovery"
4. then use the partition listed for your device and flash the stock recovery, where it must be on your external sdcard
Code:
dd if=/sdcard2/recovery.img of=/dev/block/mmcblk0p37
5. lock the bootloader
Code:
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
6. reboot into fastboot mode, in soul rom, hold power and choose restart, then choose bootloader
7. in fastboot mode enter on your console on you computer:
Code:
fastboot oem rebootRUU
8. when your phone is ready, you will see it on the display of the phone, enter
Code:
fastboot flash zip ruu.zip
where ruu.zip is the name of the file you downloaded from this thread for example, if you downloaded
Code:
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.43.1401.1_Radio_1237.25.32.0717__NV_NVMFG_CT_4.22_001_release_344194_signed_2_4.zip
then put it in your adb folder rename it to ruu.zip or use the original name to flash the file
9. if the flash procedure stops after a few seconds, reenter the command
Code:
fastboot flash zip ruu.zip
now wait, when its finished
10. restart the phone
Code:
fastboot reboot
i hope it helps
p.s. if you need a stock recovery, you can use one in the zip file you downloaded, or in one of the ota zip files, there is another zipfile inside the ota file called firmware.zip
superpfpf said:
connect yout phone with your computer and enter in your console on your computer:
1. adb shell
2. su -
3. cat /proc/emmc
now you see a list of your partitions, it looks similar to this
Code:
dev: size erasesize name
mmcblk0p20: 000ffa00 00000200 "misc"
mmcblk0p37: 00fffe00 00000200 "recovery"
mmcblk0p36: 01000000 00000200 "boot"
mmcblk0p38: 93fffc00 00000200 "system"
mmcblk0p27: 00140200 00000200 "local"
mmcblk0p39: 17fffe00 00000200 "cache"
mmcblk0p40: 670000000 00000200 "userdata"
mmcblk0p23: 01400000 00000200 "devlog"
mmcblk0p25: 00040000 00000200 "pdata"
mmcblk0p28: 00010000 00000200 "extra"
mmcblk0p34: 04b00200 00000200 "radio"
mmcblk0p16: 03c00400 00000200 "adsp"
mmcblk0p15: 00100000 00000200 "dsps"
mmcblk0p18: 00500000 00000200 "wcnss"
mmcblk0p17: 007ffa00 00000200 "radio_config"
mmcblk0p21: 00400000 00000200 "modem_st1"
mmcblk0p22: 00400000 00000200 "modem_st2"
mmcblk0p30: 00040000 00000200 "skylink"
mmcblk0p31: 01900000 00000200 "carrier"
mmcblk0p29: 00100000 00000200 "cdma_record"
mmcblk0p19: 01affe00 00000200 "reserve_1"
mmcblk0p33: 034ffa00 00000200 "reserve_2"
mmcblk0p35: 05fffc00 00000200 "reserve_3"
mmcblk0p32: 04729a00 00000200 "reserve"
search for "recovery"
4. then use the partition listed for your device and flash the stock recovery, where it must be on your external sdcard
Code:
dd if=/sdcard2/recovery.img of=/dev/block/mmcblk0p37
5. lock the bootloader
Code:
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
6. reboot into fastboot mode, in soul rom, hold power and choose restart, then choose bootloader
7. in fastboot mode enter on your console on you computer:
Code:
fastboot oem rebootRUU
8. when your phone is ready, you will see it on the display of the phone, enter
Code:
fastboot flash zip ruu.zip
where ruu.zip is the name of the file you downloaded from this thread for example, if you downloaded
Code:
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.43.1401.1_Radio_1237.25.32.0717__NV_NVMFG_CT_4.22_001_release_344194_signed_2_4.zip
then put it in your adb folder rename it to ruu.zip or use the original name to flash the file
9. if the flash procedure stops after a few seconds, reenter the command
Code:
fastboot flash zip ruu.zip
now wait, when its finished
10. restart the phone
Code:
fastboot reboot
i hope it helps
p.s. if you need a stock recovery, you can use one in the zip file you downloaded, or in one of the ota zip files, there is another zipfile inside the ota file called firmware.zip
Click to expand...
Click to collapse
this what i got
sending 'zip' (1171494 KB)...
OKAY [ 47.666s]
writing 'zip'...
(bootloader) rom parsing start ...
(bootloader) rom parsing finish ...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 55.274s
fadihawari said:
this what i got
sending 'zip' (1171494 KB)...
OKAY [ 47.666s]
writing 'zip'...
(bootloader) rom parsing start ...
(bootloader) rom parsing finish ...
(bootloader) zip header checking...
(bootloader) zip info parsing...
(bootloader) checking model ID...
(bootloader) checking custom ID...
FAILED (remote: 42 custom id check fail)
finished. total time: 55.274s
Click to expand...
Click to collapse
That means you are flashing a zip which is not meant for your CID. what is your CID and which file are you flashing?
rockyseenu said:
That means you are flashing a zip which is not meant for your CID. what is your CID and which file are you flashing?
Click to expand...
Click to collapse
CID now on HC__a07
tried to flash this
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.17.1401.2_Radio_1237.20.28.0614_NV_CT_3.23_001___release_324898_signed_2_2.zip
this
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.43.1401.1_ Radio_1237.25.32.0717__NV_NVMFG_CT_4.22_001_releas e_344194_signed_2_4.zip
and even tried this
RUU_M7C_DWG_JB_50_HTCCN_CHS_CT_1.12.1401.1_Radio_1237.17.18.0423release_signed.exe
S-OFF and Can change CID
fadihawari said:
CID now on HC__a07
tried to flash this
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.17.1401.2_Radio_1237.20.28.0614_NV_CT_3.23_001___release_324898_signed_2_2.zip
this
PN07IMG_M7C_DWG_JB_50_S1_HTCCN_CHS_CT_2.43.1401.1_ Radio_1237.25.32.0717__NV_NVMFG_CT_4.22_001_releas e_344194_signed_2_4.zip
and even tried this
RUU_M7C_DWG_JB_50_HTCCN_CHS_CT_1.12.1401.1_Radio_1237.17.18.0423release_signed.exe
S-OFF and Can change CID
Click to expand...
Click to collapse
the last one is an exe file. dont flash that. you can try any of the first two. Change your CID to HTCCN702 and then flash either of the zips.
or supercid 11111111
rockyseenu said:
the last one is an exe file. dont flash that. you can try any of the first two. Change your CID to HTCCN702 and then flash either of the zips.
Click to expand...
Click to collapse
Flashed successfully but when start to load icons a system it roboot
; is there a rom for Asia not the china telecom i thing=k it is radio and compatibility issue
rockyseenu said:
the last one is an exe file. dont flash that. you can try any of the first two. Change your CID to HTCCN702 and then flash either of the zips.
Click to expand...
Click to collapse
I bricked my device ihave 720 based DWG software and when i flashed 1401 keep restarting please i need a software for 720 based DWG software
radio.img

requests for partition table,getvar all

in preparation for resetting the software status banner,lock/unlock bootloader,and mid changes,id appreciate results of the following:
adb shell (adb shell again if needed to get to a # prompt )
cat /proc/emmc
cat proc/partitions
please note that s off isnt needed,but you must be rooted.
also,as usual id like the results of fastboot getvar all from as many variants as possible for mid changes. pm them to me,or post here,but remove your esn and imie if you post them publicly.
looks like we will need dumps of:
p2(pg1fs)
p7(mfg)
p8(pg2fs)
dd if=/dev/block/mmcblk0p2 of=/sdcard/mmcblk0p2
dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
The device should be unlocked or relocked in order to locate the lock status flag
again,you must be rooted. upload them and pm me the links
thanks!
i cant root at the moment but here we go with partitions
179 0 30535680 mmcblk0
179 1 16 mmcblk0p1
179 2 4096 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 40960 mmcblk0p5
179 6 2015 mmcblk0p6
179 7 256 mmcblk0p7
179 8 24255 mmcblk0p8
179 9 512 mmcblk0p9
179 10 2048 mmcblk0p10
179 11 96 mmcblk0p11
179 12 2048 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 10240 mmcblk0p14
179 15 10240 mmcblk0p15
259 0 1024 mmcblk0p16
259 1 1024 mmcblk0p17
259 2 1024 mmcblk0p18
259 3 1024 mmcblk0p19
259 4 1024 mmcblk0p20
259 5 1024 mmcblk0p21
259 6 1024 mmcblk0p22
259 7 1024 mmcblk0p23
259 8 1024 mmcblk0p24
259 9 1536 mmcblk0p25
259 10 60417 mmcblk0p26
259 11 20480 mmcblk0p27
259 12 1 mmcblk0p28
259 13 5087 mmcblk0p29
259 14 22528 mmcblk0p30
259 15 10240 mmcblk0p31
259 16 1024 mmcblk0p32
259 17 1536 mmcblk0p33
259 18 1536 mmcblk0p34
259 19 20480 mmcblk0p35
259 20 30720 mmcblk0p36
259 21 256 mmcblk0p37
259 22 16 mmcblk0p38
259 23 64 mmcblk0p39
259 24 1024 mmcblk0p40
259 25 1 mmcblk0p41
259 26 8 mmcblk0p42
259 27 512 mmcblk0p43
259 28 128 mmcblk0p44
259 29 1024 mmcblk0p45
259 30 10 mmcblk0p46
259 31 1281 mmcblk0p47
259 32 512 mmcblk0p48
259 33 2048 mmcblk0p49
259 34 20480 mmcblk0p50
259 35 256 mmcblk0p51
259 36 128 mmcblk0p52
259 37 128 mmcblk0p53
259 38 128 mmcblk0p54
259 39 128 mmcblk0p55
259 40 128 mmcblk0p56
259 41 128 mmcblk0p57
259 42 128 mmcblk0p58
259 43 128 mmcblk0p59
259 44 16384 mmcblk0p60
259 45 14364 mmcblk0p61
259 46 65536 mmcblk0p62
259 47 65536 mmcblk0p63
259 48 65536 mmcblk0p64
259 49 327680 mmcblk0p65
259 50 4587520 mmcblk0p66
259 51 24641536 mmcblk0p67
259 52 296960 mmcblk0p68
259 53 61440 mmcblk0p69
259 54 10240 mmcblk0p70
179 16 4096 mmcblk0rpmb
hope its ok without root
thanks! how bout cat /proc/emmc ?
wil do it now for you
PHP:
[email protected]_himauhl:/ $ cat /proc/emmc
cat /proc/emmc
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 00100000 00000200 "pmic"
mmcblk0p5: 02800000 00000200 "dummy"
mmcblk0p6: 001f7c00 00000200 "reserve_1"
mmcblk0p7: 00040000 00000200 "mfg"
mmcblk0p8: 017afc00 00000200 "pg2fs"
mmcblk0p9: 00080000 00000200 "rpm"
mmcblk0p10: 00200000 00000200 "tz"
mmcblk0p11: 00018000 00000200 "sdi"
mmcblk0p12: 00200000 00000200 "hyp"
mmcblk0p13: 00100000 00000200 "aboot"
mmcblk0p14: 00a00000 00000200 "tool_diag"
mmcblk0p15: 00a00000 00000200 "sp1"
mmcblk0p16: 00100000 00000200 "ddr"
mmcblk0p17: 00100000 00000200 "rfg_0"
mmcblk0p18: 00100000 00000200 "rfg_1"
mmcblk0p19: 00100000 00000200 "rfg_2"
mmcblk0p20: 00100000 00000200 "rfg_3"
mmcblk0p21: 00100000 00000200 "rfg_4"
mmcblk0p22: 00100000 00000200 "rfg_5"
mmcblk0p23: 00100000 00000200 "rfg_6"
mmcblk0p24: 00100000 00000200 "rfg_7"
mmcblk0p25: 00180000 00000200 "fsg"
mmcblk0p26: 03b00400 00000200 "radio"
mmcblk0p27: 01400000 00000200 "adsp"
mmcblk0p28: 00000400 00000200 "limits"
mmcblk0p29: 004f7c00 00000200 "reserve_2"
mmcblk0p30: 01600000 00000200 "persist"
mmcblk0p31: 00a00000 00000200 "ramdump"
mmcblk0p32: 00100000 00000200 "misc"
mmcblk0p33: 00180000 00000200 "modem_st1"
mmcblk0p34: 00180000 00000200 "modem_st2"
mmcblk0p35: 01400000 00000200 "fataldevlog"
mmcblk0p36: 01e00000 00000200 "devlog"
mmcblk0p37: 00040000 00000200 "pdata"
mmcblk0p38: 00004000 00000200 "control"
mmcblk0p39: 00010000 00000200 "extra"
mmcblk0p40: 00100000 00000200 "cdma_record"
mmcblk0p41: 00000400 00000200 "fsc"
mmcblk0p42: 00002000 00000200 "ssd"
mmcblk0p43: 00080000 00000200 "sensor_hub"
mmcblk0p44: 00020000 00000200 "sec"
mmcblk0p45: 00100000 00000200 "abootbak"
mmcblk0p46: 00002800 00000200 "cir_img"
mmcblk0p47: 00140400 00000200 "local"
mmcblk0p48: 00080000 00000200 "frp"
mmcblk0p49: 00200000 00000200 "cpe"
mmcblk0p50: 01400000 00000200 "carrier"
mmcblk0p51: 00040000 00000200 "skylink"
mmcblk0p52: 00020000 00000200 "rfg_8"
mmcblk0p53: 00020000 00000200 "rfg_9"
mmcblk0p54: 00020000 00000200 "rfg_10"
mmcblk0p55: 00020000 00000200 "rfg_11"
mmcblk0p56: 00020000 00000200 "rfg_12"
mmcblk0p57: 00020000 00000200 "rfg_13"
mmcblk0p58: 00020000 00000200 "rfg_14"
mmcblk0p59: 00020000 00000200 "rfg_15"
mmcblk0p60: 01000000 00000200 "absolute"
mmcblk0p61: 00e07000 00000200 "reserve"
mmcblk0p62: 04000000 00000200 "hosd"
mmcblk0p63: 04000000 00000200 "boot"
mmcblk0p64: 04000000 00000200 "recovery"
mmcblk0p65: 14000000 00000200 "cache"
mmcblk0p66: 18000000 00000200 "system"
mmcblk0p67: e0000000 00000200 "userdata"
mmcblk0p68: 12200000 00000200 "apppreload"
mmcblk0p69: 03c00000 00000200 "cota"
mmcblk0p70: 00a00000 00000200 "battery"
[email protected]_himauhl:/ $
excellent! very helpful,thank you.
looks like we will need partitions 2,7,8 if anyone gets a change to dump
scotty1223 said:
excellent! very helpful,thank you.
looks like we will need partitions 2,7,8 if anyone gets a change to dump
Click to expand...
Click to collapse
I may be able to get you this from a Verizon M9.
My name is Harold and I'm a flashaholic.....
hgoldner said:
I may be able to get you this from a Verizon M9.
My name is Harold and I'm a flashaholic.....
Click to expand...
Click to collapse
Thanks. I forgot to mention,the device needs to be unlocked or relocked in order to verify the flag location
Sent from my Nexus 9 using Tapatalk
Just noticing that your partition list doesn't match mine. Boot is in 65 for example not 63.
hgoldner said:
Just noticing that your partition list doesn't match mine. Boot is in 65 for example not 63.
Click to expand...
Click to collapse
Verizon and Sprint typically are a little bit different from GSM models. your partitions 2, 7, and 8 are the same, correct? Feel free to post yours up.
Sent from my HTC One max
scotty1223 said:
Verizon and Sprint typically are a little bit different from GSM models. your partitions 2, 7, and 8 are the same, correct? Feel free to post yours up.
Sent from my HTC One max
Click to expand...
Click to collapse
Here are latest Verizon M9 partitions:
Code:
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 00100000 00000200 "pmic"
mmcblk0p5: 02800000 00000200 "dummy"
mmcblk0p6: 001f7c00 00000200 "reserve_1"
mmcblk0p7: 00040000 00000200 "mfg"
mmcblk0p8: 017afc00 00000200 "pg2fs"
mmcblk0p9: 00080000 00000200 "rpm"
mmcblk0p10: 00200000 00000200 "tz"
mmcblk0p11: 00018000 00000200 "sdi"
mmcblk0p12: 00200000 00000200 "hyp"
mmcblk0p13: 00100000 00000200 "aboot"
mmcblk0p14: 00a00000 00000200 "tool_diag"
mmcblk0p15: 00a00000 00000200 "sp1"
mmcblk0p16: 00100000 00000200 "ddr"
mmcblk0p17: 00100000 00000200 "rfg_0"
mmcblk0p18: 00100000 00000200 "rfg_1"
mmcblk0p19: 00100000 00000200 "rfg_2"
mmcblk0p20: 00100000 00000200 "rfg_3"
mmcblk0p21: 00100000 00000200 "rfg_4"
mmcblk0p22: 00100000 00000200 "rfg_5"
mmcblk0p23: 00100000 00000200 "rfg_6"
mmcblk0p24: 00100000 00000200 "rfg_7"
mmcblk0p25: 00180000 00000200 "fsg"
mmcblk0p26: 03b00400 00000200 "radio"
mmcblk0p27: 01400000 00000200 "adsp"
mmcblk0p28: 00000400 00000200 "limits"
mmcblk0p29: 004f7c00 00000200 "reserve_2"
mmcblk0p30: 01600000 00000200 "persist"
mmcblk0p31: 00a00000 00000200 "ramdump"
mmcblk0p32: 00100000 00000200 "misc"
mmcblk0p33: 00180000 00000200 "modem_st1"
mmcblk0p34: 00180000 00000200 "modem_st2"
mmcblk0p35: 01400000 00000200 "fataldevlog"
mmcblk0p36: 01e00000 00000200 "devlog"
mmcblk0p37: 00040000 00000200 "pdata"
mmcblk0p38: 00004000 00000200 "control"
mmcblk0p39: 00010000 00000200 "extra"
mmcblk0p40: 00100000 00000200 "cdma_record"
mmcblk0p41: 00000400 00000200 "fsc"
mmcblk0p42: 00002000 00000200 "ssd"
mmcblk0p43: 00080000 00000200 "sensor_hub"
mmcblk0p44: 00020000 00000200 "sec"
mmcblk0p45: 00100000 00000200 "abootbak"
mmcblk0p46: 00002800 00000200 "cir_img"
mmcblk0p47: 00140400 00000200 "local"
mmcblk0p48: 00080000 00000200 "frp"
mmcblk0p49: 00200000 00000200 "cpe"
mmcblk0p50: 00a00000 00000200 "vzw_quality"
mmcblk0p51: 00a00000 00000200 "vzw_logger"
mmcblk0p52: 01400000 00000200 "carrier"
mmcblk0p53: 00040000 00000200 "skylink"
mmcblk0p54: 00020000 00000200 "rfg_8"
mmcblk0p55: 00020000 00000200 "rfg_9"
mmcblk0p56: 00020000 00000200 "rfg_10"
mmcblk0p57: 00020000 00000200 "rfg_11"
mmcblk0p58: 00020000 00000200 "rfg_12"
mmcblk0p59: 00020000 00000200 "rfg_13"
mmcblk0p60: 00020000 00000200 "rfg_14"
mmcblk0p61: 00020000 00000200 "rfg_15"
mmcblk0p62: 00a00000 00000200 "battery"
mmcblk0p63: 00007000 00000200 "reserve"
mmcblk0p64: 04000000 00000200 "hosd"
mmcblk0p65: 04000000 00000200 "boot"
mmcblk0p66: 04000000 00000200 "recovery"
mmcblk0p67: 40000000 00000200 "cache"
mmcblk0p68: 18000000 00000200 "system"
mmcblk0p69: b8000000 00000200 "userdata"
mmcblk0p70: 12200000 00000200 "apppreload"
mmcblk0p71: 03c00000 00000200 "cota"
Sorry I only see this now. There had been a partition table since a while from me.
Find it here:
https://docs.google.com/spreadsheets/d/1yCWtDQ-2tpUzC-JDoVaScllsF3Db96Tr18U1izo7oJM/edit#gid=0
Here you go.
All information from my unlocked, o2 branded M9
https://www.dropbox.com/s/c80zkygvlkh3qmy/dump.zip?dl=0
emmc, partitions, mmcblk0p2 / 7 / 8
Sent from my HTC One M9 using XDA Free mobile app
webdepp said:
Here you go.
All information from my unlocked, o2 branded M9
https://www.dropbox.com/s/c80zkygvlkh3qmy/dump.zip?dl=0
emmc, partitions, mmcblk0p2 / 7 / 8
Sent from my HTC One M9 using XDA Free mobile app
Click to expand...
Click to collapse
excellent! just what i needed,things have moved a little bit,but still basically the same
we should be good to go if/when s off is achieved
Yay, good to hear!
Glad I could help
Sent from my HTC One M9 using XDA Free mobile app
scotty1223 said:
excellent! just what i needed,things have moved a little bit,but still basically the same
we should be good to go if/when s off is achieved
Click to expand...
Click to collapse
scotty do you need the partition dumps from my Developer Edition ?
Here's the getvar all
C:\adb>adb devices
List of devices attached
FA53HY****** device
C:\adb>adb reboot-bootloader
C:\adb>fastboot getvar all
(bootloader) version: 0.5
(bootloader) max-download-size: 0x20000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:cache: 0x14000000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:userdata: 0x5e0000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:system: 0x118000000
(bootloader) serialno: FA53HY******
all:
finished. total time: 0.097s
C:\adb>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_himaulatt
(bootloader) version: 1.0
(bootloader) imei: 35722***********
(bootloader) version-main: 1.32.617.6
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PJA11000
(bootloader) cid: BS_US002
all:
finished. total time: 0.013s
C:\adb>adb devices
Click to expand...
Click to collapse
and here the partition info
C:\adb>adb shell
[email protected]_himaulatt:/ $ cat proc/partitions
cat proc/partitions
major minor #blocks name
7 0 15668 loop0
179 0 30535680 mmcblk0
179 1 16 mmcblk0p1
179 2 4096 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 40960 mmcblk0p5
179 6 2015 mmcblk0p6
179 7 256 mmcblk0p7
179 8 24255 mmcblk0p8
179 9 512 mmcblk0p9
179 10 2048 mmcblk0p10
179 11 96 mmcblk0p11
179 12 2048 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 10240 mmcblk0p14
179 15 10240 mmcblk0p15
259 0 1024 mmcblk0p16
259 1 1024 mmcblk0p17
259 2 1024 mmcblk0p18
259 3 1024 mmcblk0p19
259 4 1024 mmcblk0p20
259 5 1024 mmcblk0p21
259 6 1024 mmcblk0p22
259 7 1024 mmcblk0p23
259 8 1024 mmcblk0p24
259 9 1536 mmcblk0p25
259 10 60417 mmcblk0p26
259 11 20480 mmcblk0p27
259 12 1 mmcblk0p28
259 13 5087 mmcblk0p29
259 14 22528 mmcblk0p30
259 15 10240 mmcblk0p31
259 16 1024 mmcblk0p32
259 17 1536 mmcblk0p33
259 18 1536 mmcblk0p34
259 19 20480 mmcblk0p35
259 20 30720 mmcblk0p36
259 21 256 mmcblk0p37
259 22 16 mmcblk0p38
259 23 64 mmcblk0p39
259 24 1024 mmcblk0p40
259 25 1 mmcblk0p41
259 26 8 mmcblk0p42
259 27 512 mmcblk0p43
259 28 128 mmcblk0p44
259 29 1024 mmcblk0p45
259 30 10 mmcblk0p46
259 31 1281 mmcblk0p47
259 32 512 mmcblk0p48
259 33 2048 mmcblk0p49
259 34 20480 mmcblk0p50
259 35 256 mmcblk0p51
259 36 128 mmcblk0p52
259 37 128 mmcblk0p53
259 38 128 mmcblk0p54
259 39 128 mmcblk0p55
259 40 128 mmcblk0p56
259 41 128 mmcblk0p57
259 42 128 mmcblk0p58
259 43 128 mmcblk0p59
259 44 16384 mmcblk0p60
259 45 14364 mmcblk0p61
259 46 65536 mmcblk0p62
259 47 65536 mmcblk0p63
259 48 65536 mmcblk0p64
259 49 327680 mmcblk0p65
259 50 4587520 mmcblk0p66
259 51 24641536 mmcblk0p67
259 52 296960 mmcblk0p68
259 53 61440 mmcblk0p69
259 54 10240 mmcblk0p70
179 16 4096 mmcblk0rpmb
179 32 62367744 mmcblk1
179 33 62351360 mmcblk1p1
254 0 15668 dm-0
[email protected]_himaulatt:/ $
Click to expand...
Click to collapse
and the emmc
C:\adb>adb devices
List of devices attached
FA53HY****** device
C:\adb>adb shell
[email protected]_himaulatt:/ $ cat /proc/emmc
cat /proc/emmc
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 00100000 00000200 "pmic"
mmcblk0p5: 02800000 00000200 "dummy"
mmcblk0p6: 001f7c00 00000200 "reserve_1"
mmcblk0p7: 00040000 00000200 "mfg"
mmcblk0p8: 017afc00 00000200 "pg2fs"
mmcblk0p9: 00080000 00000200 "rpm"
mmcblk0p10: 00200000 00000200 "tz"
mmcblk0p11: 00018000 00000200 "sdi"
mmcblk0p12: 00200000 00000200 "hyp"
mmcblk0p13: 00100000 00000200 "aboot"
mmcblk0p14: 00a00000 00000200 "tool_diag"
mmcblk0p15: 00a00000 00000200 "sp1"
mmcblk0p16: 00100000 00000200 "ddr"
mmcblk0p17: 00100000 00000200 "rfg_0"
mmcblk0p18: 00100000 00000200 "rfg_1"
mmcblk0p19: 00100000 00000200 "rfg_2"
mmcblk0p20: 00100000 00000200 "rfg_3"
mmcblk0p21: 00100000 00000200 "rfg_4"
mmcblk0p22: 00100000 00000200 "rfg_5"
mmcblk0p23: 00100000 00000200 "rfg_6"
mmcblk0p24: 00100000 00000200 "rfg_7"
mmcblk0p25: 00180000 00000200 "fsg"
mmcblk0p26: 03b00400 00000200 "radio"
mmcblk0p27: 01400000 00000200 "adsp"
mmcblk0p28: 00000400 00000200 "limits"
mmcblk0p29: 004f7c00 00000200 "reserve_2"
mmcblk0p30: 01600000 00000200 "persist"
mmcblk0p31: 00a00000 00000200 "ramdump"
mmcblk0p32: 00100000 00000200 "misc"
mmcblk0p33: 00180000 00000200 "modem_st1"
mmcblk0p34: 00180000 00000200 "modem_st2"
mmcblk0p35: 01400000 00000200 "fataldevlog"
mmcblk0p36: 01e00000 00000200 "devlog"
mmcblk0p37: 00040000 00000200 "pdata"
mmcblk0p38: 00004000 00000200 "control"
mmcblk0p39: 00010000 00000200 "extra"
mmcblk0p40: 00100000 00000200 "cdma_record"
mmcblk0p41: 00000400 00000200 "fsc"
mmcblk0p42: 00002000 00000200 "ssd"
mmcblk0p43: 00080000 00000200 "sensor_hub"
mmcblk0p44: 00020000 00000200 "sec"
mmcblk0p45: 00100000 00000200 "abootbak"
mmcblk0p46: 00002800 00000200 "cir_img"
mmcblk0p47: 00140400 00000200 "local"
mmcblk0p48: 00080000 00000200 "frp"
mmcblk0p49: 00200000 00000200 "cpe"
mmcblk0p50: 01400000 00000200 "carrier"
mmcblk0p51: 00040000 00000200 "skylink"
mmcblk0p52: 00020000 00000200 "rfg_8"
mmcblk0p53: 00020000 00000200 "rfg_9"
mmcblk0p54: 00020000 00000200 "rfg_10"
mmcblk0p55: 00020000 00000200 "rfg_11"
mmcblk0p56: 00020000 00000200 "rfg_12"
mmcblk0p57: 00020000 00000200 "rfg_13"
mmcblk0p58: 00020000 00000200 "rfg_14"
mmcblk0p59: 00020000 00000200 "rfg_15"
mmcblk0p60: 01000000 00000200 "absolute"
mmcblk0p61: 00e07000 00000200 "reserve"
mmcblk0p62: 04000000 00000200 "hosd"
mmcblk0p63: 04000000 00000200 "boot"
mmcblk0p64: 04000000 00000200 "recovery"
mmcblk0p65: 14000000 00000200 "cache"
mmcblk0p66: 18000000 00000200 "system"
mmcblk0p67: e0000000 00000200 "userdata"
mmcblk0p68: 12200000 00000200 "apppreload"
mmcblk0p69: 03c00000 00000200 "cota"
mmcblk0p70: 00a00000 00000200 "battery"
[email protected]_himaulatt:/ $
Click to expand...
Click to collapse
It should be the same as the other gsm models,but it definitely wouldn't hurt to verify if you feel like dumping
scotty1223 said:
It should be the same as the other gsm models,but it definitely wouldn't hurt to verify if you feel like dumping
Click to expand...
Click to collapse
Waiting when you know tutorial lock and unlock bootloader and M8, thanks for your work!
now i have a rooted unlocked M9 will do the dumping for you in the evening !
edit:
pm sent to you scotty
how do you get this
C:\adb>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_himaulatt
(bootloader) version: 1.0
(bootloader) imei: 35722***********
(bootloader) version-main: 1.32.617.6
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PJA11000
(bootloader) cid: BS_US002
all:
finished. total time: 0.013s
when i do this-----C:\adb>fastboot getvar all------- i only get this
C:\adb>fastboot getvar all
(bootloader) version: 0.5
(bootloader) max-download-size: 0x20000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:cache: 0x14000000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:userdata: 0x5e0000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:system: 0x118000000
(bootloader) serialno: FA53HY******
all:
finished. total time: 0.097s
freelockuk said:
how do you get this
C:\adb>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_himaulatt
(bootloader) version: 1.0
(bootloader) imei: 35722***********
(bootloader) version-main: 1.32.617.6
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 0PJA11000
(bootloader) cid: BS_US002
all:
finished. total time: 0.013s
when i do this-----C:\adb>fastboot getvar all------- i only get this
C:\adb>fastboot getvar all
(bootloader) version: 0.5
(bootloader) max-download-size: 0x20000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:cache: 0x14000000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:userdata: 0x5e0000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:system: 0x118000000
(bootloader) serialno: FA53HY******
all:
finished. total time: 0.097s
Click to expand...
Click to collapse
do the same command in Download mode

Sim Unlock. Free!! - CONFIRMED WORKING

CONFIRMED WORKING
No CDMA like Sprint or Verizon. Feel free to test though
EDIT: Sprint See http://forum.xda-developers.com/sprint-one-m9/general/nv-unlocksim-t3314755
Hey guys.
I recently purchased a HTC M9 Sprint with the hopes that I could unlock it. Unfortunately I was not able to
Anyway brought a AT&T version (that arrived yesterday) and started to have a play with it.
First things first:
HTC DEV bootloader unlock
TWRP install
SU
S-Off via Sunshine (optional)
Now for the fun
I dumped all the partitions (except userdata as it was 28GB lol). Then started to work on the Sim Unlock. My attempt via the method that i posted here did not work for me. I then decided to try my luck with a code from Ebay. I got one for US $4 which was pretty good. Took a few hours, but sure enough I received an email with a code. I started a logcat and then entered the SIM Unlock code and to my surprise it WORKED . Nothing interesting in the logcat though
I then dumped all the partitions again (except userdata)
Here is the list BTW:
Code:
dev: size erasesize name
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00400000 00000200 "pg1fs"
mmcblk0p3: 00100000 00000200 "sbl1"
mmcblk0p4: 00100000 00000200 "pmic"
mmcblk0p5: 02800000 00000200 "dummy"
mmcblk0p6: 001f7c00 00000200 "reserve_1"
mmcblk0p7: 00040000 00000200 "mfg"
mmcblk0p8: 017afc00 00000200 "pg2fs"
mmcblk0p9: 00080000 00000200 "rpm"
mmcblk0p10: 00200000 00000200 "tz"
mmcblk0p11: 00018000 00000200 "sdi"
mmcblk0p12: 00200000 00000200 "hyp"
mmcblk0p13: 00100000 00000200 "aboot"
mmcblk0p14: 00a00000 00000200 "tool_diag"
mmcblk0p15: 00a00000 00000200 "sp1"
mmcblk0p16: 00100000 00000200 "ddr"
mmcblk0p17: 00100000 00000200 "rfg_0"
mmcblk0p18: 00100000 00000200 "rfg_1"
mmcblk0p19: 00100000 00000200 "rfg_2"
mmcblk0p20: 00100000 00000200 "rfg_3"
mmcblk0p21: 00100000 00000200 "rfg_4"
mmcblk0p22: 00100000 00000200 "rfg_5"
mmcblk0p23: 00100000 00000200 "rfg_6"
mmcblk0p24: 00100000 00000200 "rfg_7"
mmcblk0p25: 00180000 00000200 "fsg"
mmcblk0p26: 03b00400 00000200 "radio"
mmcblk0p27: 01400000 00000200 "adsp"
mmcblk0p28: 00000400 00000200 "limits"
mmcblk0p29: 004f7c00 00000200 "reserve_2"
mmcblk0p30: 01600000 00000200 "persist"
mmcblk0p31: 00a00000 00000200 "ramdump"
mmcblk0p32: 00100000 00000200 "misc"
mmcblk0p33: 00180000 00000200 "modem_st1"
mmcblk0p34: 00180000 00000200 "modem_st2"
mmcblk0p35: 01400000 00000200 "fataldevlog"
mmcblk0p36: 01e00000 00000200 "devlog"
mmcblk0p37: 00040000 00000200 "pdata"
mmcblk0p38: 00004000 00000200 "control"
mmcblk0p39: 00010000 00000200 "extra"
mmcblk0p40: 00100000 00000200 "cdma_record"
mmcblk0p41: 00000400 00000200 "fsc"
mmcblk0p42: 00002000 00000200 "ssd"
mmcblk0p43: 00080000 00000200 "sensor_hub"
mmcblk0p44: 00020000 00000200 "sec"
mmcblk0p45: 00100000 00000200 "abootbak"
mmcblk0p46: 00002800 00000200 "cir_img"
mmcblk0p47: 00140400 00000200 "local"
mmcblk0p48: 00080000 00000200 "frp"
mmcblk0p49: 00200000 00000200 "cpe"
mmcblk0p50: 01400000 00000200 "carrier"
mmcblk0p51: 00040000 00000200 "skylink"
mmcblk0p52: 00020000 00000200 "rfg_8"
mmcblk0p53: 00020000 00000200 "rfg_9"
mmcblk0p54: 00020000 00000200 "rfg_10"
mmcblk0p55: 00020000 00000200 "rfg_11"
mmcblk0p56: 00020000 00000200 "rfg_12"
mmcblk0p57: 00020000 00000200 "rfg_13"
mmcblk0p58: 00020000 00000200 "rfg_14"
mmcblk0p59: 00020000 00000200 "rfg_15"
mmcblk0p60: 01000000 00000200 "absolute"
mmcblk0p61: 00e07000 00000200 "reserve"
mmcblk0p62: 04000000 00000200 "hosd"
mmcblk0p63: 04000000 00000200 "boot"
mmcblk0p64: 04000000 00000200 "recovery"
mmcblk0p65: 14000000 00000200 "cache"
mmcblk0p66: 18000000 00000200 "system"
mmcblk0p67: e0000000 00000200 "userdata"
mmcblk0p68: 12200000 00000200 "apppreload"
mmcblk0p69: 03c00000 00000200 "cota"
mmcblk0p70: 00a00000 00000200 "battery"
Now for the actual fun. I compared every single partition before and after the SIM Lock trying to find a difference. There were many differences between files as they are not 'static' and used by the system. (This was done from recovery BTW).
I was looking for a small difference such as that of the bootloader lock / unlock which you only have to change a small amount of data.
Something that stood out was mmcblk0p52 which is "rfg_8" and I only noticed this because I had made two dump before Sim Unlocking and it was THE ONLY PAIR OF DUMPS THAT MATCHED.
The files themselves aren't that big so I thought what the hell.
I flashed (dd) the 'before sim unlock' mmcblk0p52 and it was SIM LOCKED again
I then flashed (dd) the after 'after sim unlock' mmcblk0p52 and it was SIM UNLOCKED again
If you could help by getting your mmcblkop52 to me I can then compare and see if this will equal a free SIM UNLOCK for you.
AT&T No longer need Files are the same
T-Mobile No longer need Files are the same
Sprint Partition is empty, all 0's - will need to find another way
Verizon I assume it is the same as Sprint.
Others??
Please use the following code:
Code:
adb shell
su
dd if=/dev/block/bootdevice/by-name/rfg_8 of=/sdcard/rfg_8old
exit
exit
adb pull /sdcard/rfg_8old
Then upload the rfg_8old and link to me.
To Sim unlock your device
Do the above and save it to you computer. Download my rfg_8-Locked.txt and compare the two files.
You can do this using HxD from here http://mh-nexus.de/en/hxd/
Drag both files (locked partitions) into HxD and press Ctrl + K or go to File > Analysis > File-Compare > Compare....
It will prop up 'both files are identical'
If there is a file difference then STOP
If the file is the same then you can do the following:
Please copy and paste one line at a time
[Irfg_8-UnLocked.txt must be in your ADB directory OR manually place on the root of internal SD Card and rename to rfg_8 [/I]
Code:
adb push rfg_8-UnLocked.txt /sdcard/rfg_8new
adb shell
su
dd if=/sdcard/rfg_8new of=/dev/block/bootdevice/by-name/rfg_8
exit
exit
Please use the Poll above and leave a comment
Please don't forget to click the thanks button or donate to me http://forum.xda-developers.com/donatetome.php?u=4428363
This took a lot of time and effort. The (at least) $5 it would have cost you for the unlock code, could be put to better use
Thanks for the support guys
Stifilz
THANKS TO:
@grim489 for dumping the mmcblk0p52 from T-Mobile (which I found was an exact match)
@bigp951 for dumping the mmcblk0p52 from AT&T locked sim (which I found was an exact match)
@bigp951 for dumping the mmcblk0p52 from DEV Edition factory unlocked sim (which I found was empty 0's, probably due to never being locked)
@bigp951 for testing the Unlocked partition on AT&T and confirming it worked
@WildsideUK for confirming that this works while S-On
Interesting. I'll look into this.
Sent From My HTC One (M9)
M9 Sprint
Do you think it will work with my sprint M9?
Here is my mmcblk0p52, I am sim locked to T-Mobile. Haven't got around to trying the international software/firmware with your other unlock thread but managed to get this. :good:
elmy2424 said:
Do you think it will work with my sprint M9?
Click to expand...
Click to collapse
Not at the moment. I have a sprint M9 and have not managed to get it working with this method
grim489 said:
Here is my mmcblk0p52, I am sim locked to T-Mobile. Haven't got around to trying the international software/firmware with your other unlock thread but managed to get this. :good:
Click to expand...
Click to collapse
OMFG. THE FILE IS IDENTICAL TO MY SIM LOCKED PARTITION. FEEL FREE TO USE HxD TO 'FILE COMPARE' THE HEX VALUES YOURSELF. IF YOU ARE KEEN THEN PLEASE FLASH MY UNLOCKED PARTITION. BE VERY CAREFUL WITH THE DD COMMAND!
Obviously reverse the DD command
Do it in recovery or normal and then reboot.
Can you please dump the partition after too. Here is HxD (I love this software)
Drag both files (locked partitions) into HxD and press Ctrl + K or go to File > Analysis > File-Compare > Compare....
It will prop up 'both files are identical'
Thank you @grim489, credits to you
Gotta find somebody's sim to steal and test but it's no problem I'm just doing the simple stuff haha. Let me get back to you in a little bit stifilz, gonna try it out.
Sent from my HTC One M9 using Tapatalk
are you inside US , i think sprint is unlocking their phones for free, just have to call them,
grim489 said:
Gotta find somebody's sim to steal and test but it's no problem I'm just doing the simple stuff haha. Let me get back to you in a little bit stifilz, gonna try it out.
Sent from my HTC One M9 using Tapatalk
Click to expand...
Click to collapse
Awaiting anxiously
In the mean time can someone that is Sim Unlocked please dump their mmcblk0p52
Here is mine. AT&T SIM locked. I just added .txt to the end.
stifilz said:
Awaiting anxiously
In the mean time can someone that is Sim Unlocked please dump their mmcblk0p52
Click to expand...
Click to collapse
would the dev edition dump work? I have one of those as well...
bigp951 said:
would the dev edition dump work? I have one of those as well...
Click to expand...
Click to collapse
Yup. That would help check the 'unlock' image
stifilz said:
Yup. That would help check the 'unlock' image
Click to expand...
Click to collapse
Here you go!
dev edition---
I hope this works because I bought an AT&T m9 today for my wife but we are on T-mobile. Only thing is I know nothing about dd commands so would need instructions like in the OP.
bigp951 said:
I hope this works because I bought an AT&T m9 today for my wife but we are on T-mobile. Only thing is I know nothing about dd commands so would need instructions like in the OP.
Click to expand...
Click to collapse
Ok first thing you will need to do is dump the current mmcblk0p52 (same as first OP). Pull this files to computer. Download my mmcblk0p52-rfg_8-Locked.txt (LOCKED VERSION) and compare the two files using HxD or similar.
IF they are the same then you can proceed to flash the my mmcblk0p52-rfg_8-UnLocked.txt(UNLOCKED) file.
Code:
adb push mmcblk0p52-rfg_8-UnLocked /sdcard/mmcblk0p52
adb shell
su
dd if=/sdcard/mmcblk0p52 of=/dev/block/mmcblk0p52
exit
exit
Please proceed at your own risk
Thanks
bigp951 said:
here is mine. At&t sim locked. I just added .txt to the end.
Click to expand...
Click to collapse
exactly the same as mine
bigp951 said:
Here you go!
dev edition---
Click to expand...
Click to collapse
DEV edition is BLANK (file is all zeros) this could make sense as it was never Sim locked and therefore does not need to be unlocked
stifilz said:
Ok first thing you will need to do is dump the current mmcblk0p52 (same as first OP). Pull this files to computer. Download my mmcblk0p52-rfg_8-Locked.txt (LOCKED VERSION) and compare the two files using HxD or similar.
IF they are the same then you can proceed to flash the my mmcblk0p52-rfg_8-UnLocked.txt(UNLOCKED) file.
Code:
adb push mmcblk0p52-rfg_8-UnLocked /sdcard/mmcblk0p52
adb shell
su
dd if=/sdcard/mmcblk0p52 of=/dev/block/mmcblk0p52
exit
exit
Please proceed at your own risk
Thanks
Click to expand...
Click to collapse
I am ready to attempt this but am curious to what my chances are for a hard brick? I will copy and paste your commands
I have a nandroid on my sd card so I should be able to recover from anything minor.
EDIT--strangely enough when I attempted to push the file to the sd card this came back...
failed to copy 'mmcblk0p52-rfg_8-UnLocked' to '/sdcard/mmcblk0p52': Permission d
enied
I will put the file in the sd card manually and proceed from there
bigp951 said:
I am ready to attempt this but am curious to what my chances are for a hard brick? I will copy and paste your commands
I have a nandroid on my sd card so I should be able to recover from anything minor.
Click to expand...
Click to collapse
I am fairly certain that it will be the correct file. I don't have another partition of someone that has Sim Unlocked before (I only have my one). I assume that it is not Unlock Code specific. I have flashed to my Sprint M9 to no avail (this had 0's before like your dev edition). Also no damage to the phone
Hardbrick would be HIGHLY UNLIKELY. I have put my HTC's though the wars and they have always came back to me. As long as you are S-OFF you can recover from almost anything. Copy and paste and double check everything .
Best of luck :good:
bigp951 said:
EDIT--strangely enough when I attempted to push the file to the sd card this came back...
failed to copy 'mmcblk0p52-rfg_8-UnLocked' to '/sdcard/mmcblk0p52': Permission d
enied
I will put the file in the sd card manually and proceed from there
Click to expand...
Click to collapse
mmcblk0p52-rfg_8-UnLocked (note .txt has been removed) will need to be in the folder where your ADB is
IT WORKED!

HTC 10 Verizon Turning on Radio..

hey guys...
i need working device modem parts for my device.. when i try to call emergency it says Turning on radio.. can u pls send me modem parts..?
i need these parts;
mmcblk0p29 ( fsg)
mmcblk0p30 (radio)
mmcblk0p39 (modemst1)
mmcblk0p40 (modemst2)
mmcblk0p64 (cradio)
Code:
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00040000 00000200 "mfg"
mmcblk0p3: 00400000 00000200 "pg1fs"
mmcblk0p4: 017afc00 00000200 "pg2fs"
mmcblk0p5: 00200000 00000200 "xbl"
mmcblk0p6: 00200000 00000200 "tz"
mmcblk0p7: 00080000 00000200 "rpm"
mmcblk0p8: 00080000 00000200 "pmic"
mmcblk0p9: 00080000 00000200 "hyp"
mmcblk0p10: 00400000 00000200 "aboot"
mmcblk0p11: 04000000 00000200 "hosd"
mmcblk0p12: 00a00000 00000200 "tool_diag"
mmcblk0p13: 00000400 00000200 "devinfo"
mmcblk0p14: 00020000 00000200 "devcfg"
mmcblk0p15: 00020000 00000200 "lksecapp"
mmcblk0p16: 00040000 00000200 "cmnlib32"
mmcblk0p17: 00040000 00000200 "cmnlib64"
mmcblk0p18: 00040000 00000200 "apdp"
mmcblk0p19: 00040000 00000200 "msadp"
mmcblk0p20: 00000400 00000200 "dpo"
mmcblk0p21: 00a00000 00000200 "sp1"
mmcblk0p22: 00100000 00000200 "ddr"
mmcblk0p23: 00000400 00000200 "cdt"
mmcblk0p24: 00100000 00000200 "rfg_0"
mmcblk0p25: 00100000 00000200 "rfg_1"
mmcblk0p26: 00100000 00000200 "rfg_2"
mmcblk0p27: 00100000 00000200 "rfg_3"
mmcblk0p28: 00100000 00000200 "rfg_4"
mmcblk0p29: 00200000 00000200 "fsg"
mmcblk0p30: 04600000 00000200 "radio"
mmcblk0p31: 01400000 00000200 "adsp"
mmcblk0p32: 00200000 00000200 "fp"
mmcblk0p33: 00a00000 00000200 "slpi"
mmcblk0p34: 02000000 00000200 "mdtp"
mmcblk0p35: 00100000 00000200 "dip"
mmcblk0p36: 00200000 00000200 "venus"
mmcblk0p37: 00447400 00000200 "reserve1"
mmcblk0p38: 00100000 00000200 "misc"
mmcblk0p39: 00200000 00000200 "modemst1"
mmcblk0p40: 00200000 00000200 "modemst2"
mmcblk0p41: 01400000 00000200 "fataldevlog"
mmcblk0p42: 01e00000 00000200 "devlog"
mmcblk0p43: 00140400 00000200 "local"
mmcblk0p44: 00010000 00000200 "extra"
mmcblk0p45: 00000400 00000200 "fsc"
mmcblk0p46: 00100000 00000200 "rfg_8"
mmcblk0p47: 00002000 00000200 "ssd"
mmcblk0p48: 02000000 00000200 "persist"
mmcblk0p49: 00020000 00000200 "sec"
mmcblk0p50: 00080000 00000200 "frp"
mmcblk0p51: 00a00000 00000200 "ramdump"
mmcblk0p52: 00000400 00000200 "skylink"
mmcblk0p53: 02d00000 00000200 "carrier"
mmcblk0p54: 00080000 00000200 "keystore"
mmcblk0p55: 00080000 00000200 "keymaster"
mmcblk0p56: 00100000 00000200 "mota"
mmcblk0p57: 01000000 00000200 "dsp"
mmcblk0p58: 00d0d400 00000200 "reserve2"
mmcblk0p59: 04000000 00000200 "boot"
mmcblk0p60: 04000000 00000200 "recovery"
mmcblk0p61: 0e000000 00000200 "cache"
mmcblk0p62: 0d000000 00000200 "system"
mmcblk0p63: fe000000 00000200 "userdata"
mmcblk0p64: 04000000 00000200 "cradio"
mmcblk0p65: 00500000 00000200 "apppreload"
mmcblk0p66: 03c00000 00000200 "cota"
mmcblk0p67: 01000000 00000200 "vzw_quality"
mmcblk0p68: 01000000 00000200 "vzw_logger"
[email protected]_pmewl:/ #
t-mobile_mda said:
hey guys...
i need working device modem parts for my device.. when i try to call emergency it says Turning on radio.. can u pls send me modem parts..?
i need these parts;
mmcblk0p29 ( fsg)
mmcblk0p30 (radio)
mmcblk0p39 (modemst1)
mmcblk0p40 (modemst2)
mmcblk0p64 (cradio)
Code:
mmcblk0p1: 00004000 00000200 "board_info"
mmcblk0p2: 00040000 00000200 "mfg"
mmcblk0p3: 00400000 00000200 "pg1fs"
mmcblk0p4: 017afc00 00000200 "pg2fs"
mmcblk0p5: 00200000 00000200 "xbl"
mmcblk0p6: 00200000 00000200 "tz"
mmcblk0p7: 00080000 00000200 "rpm"
mmcblk0p8: 00080000 00000200 "pmic"
mmcblk0p9: 00080000 00000200 "hyp"
mmcblk0p10: 00400000 00000200 "aboot"
mmcblk0p11: 04000000 00000200 "hosd"
mmcblk0p12: 00a00000 00000200 "tool_diag"
mmcblk0p13: 00000400 00000200 "devinfo"
mmcblk0p14: 00020000 00000200 "devcfg"
mmcblk0p15: 00020000 00000200 "lksecapp"
mmcblk0p16: 00040000 00000200 "cmnlib32"
mmcblk0p17: 00040000 00000200 "cmnlib64"
mmcblk0p18: 00040000 00000200 "apdp"
mmcblk0p19: 00040000 00000200 "msadp"
mmcblk0p20: 00000400 00000200 "dpo"
mmcblk0p21: 00a00000 00000200 "sp1"
mmcblk0p22: 00100000 00000200 "ddr"
mmcblk0p23: 00000400 00000200 "cdt"
mmcblk0p24: 00100000 00000200 "rfg_0"
mmcblk0p25: 00100000 00000200 "rfg_1"
mmcblk0p26: 00100000 00000200 "rfg_2"
mmcblk0p27: 00100000 00000200 "rfg_3"
mmcblk0p28: 00100000 00000200 "rfg_4"
mmcblk0p29: 00200000 00000200 "fsg"
mmcblk0p30: 04600000 00000200 "radio"
mmcblk0p31: 01400000 00000200 "adsp"
mmcblk0p32: 00200000 00000200 "fp"
mmcblk0p33: 00a00000 00000200 "slpi"
mmcblk0p34: 02000000 00000200 "mdtp"
mmcblk0p35: 00100000 00000200 "dip"
mmcblk0p36: 00200000 00000200 "venus"
mmcblk0p37: 00447400 00000200 "reserve1"
mmcblk0p38: 00100000 00000200 "misc"
mmcblk0p39: 00200000 00000200 "modemst1"
mmcblk0p40: 00200000 00000200 "modemst2"
mmcblk0p41: 01400000 00000200 "fataldevlog"
mmcblk0p42: 01e00000 00000200 "devlog"
mmcblk0p43: 00140400 00000200 "local"
mmcblk0p44: 00010000 00000200 "extra"
mmcblk0p45: 00000400 00000200 "fsc"
mmcblk0p46: 00100000 00000200 "rfg_8"
mmcblk0p47: 00002000 00000200 "ssd"
mmcblk0p48: 02000000 00000200 "persist"
mmcblk0p49: 00020000 00000200 "sec"
mmcblk0p50: 00080000 00000200 "frp"
mmcblk0p51: 00a00000 00000200 "ramdump"
mmcblk0p52: 00000400 00000200 "skylink"
mmcblk0p53: 02d00000 00000200 "carrier"
mmcblk0p54: 00080000 00000200 "keystore"
mmcblk0p55: 00080000 00000200 "keymaster"
mmcblk0p56: 00100000 00000200 "mota"
mmcblk0p57: 01000000 00000200 "dsp"
mmcblk0p58: 00d0d400 00000200 "reserve2"
mmcblk0p59: 04000000 00000200 "boot"
mmcblk0p60: 04000000 00000200 "recovery"
mmcblk0p61: 0e000000 00000200 "cache"
mmcblk0p62: 0d000000 00000200 "system"
mmcblk0p63: fe000000 00000200 "userdata"
mmcblk0p64: 04000000 00000200 "cradio"
mmcblk0p65: 00500000 00000200 "apppreload"
mmcblk0p66: 03c00000 00000200 "cota"
mmcblk0p67: 01000000 00000200 "vzw_quality"
mmcblk0p68: 01000000 00000200 "vzw_logger"
[email protected]_pmewl:/ #
Click to expand...
Click to collapse
hey guys..
anyone has any idea..?
You tried just flashing the appropriate radio ?
Tallywacker said:
You tried just flashing the appropriate radio ?
Click to expand...
Click to collapse
yes i had..
device was dissambly, pb was the antennas..after connecting the antennas everything was oki..
thanx..

Categories

Resources