Database Users

[Q] What about the Alcatel OT Fire C (4019X)?

Hello!
I've been trying to see if there's any root exploits, ROMs, whatever for this phone. Is it Hamachi (4012) compatible? Or is it another species? It does seem there's not much about it.

The only thing I've found is this mail thread.
comments DOT gmane DOT org / gmane DOT comp DOT mozilla DOT devel DOT b2g / 12487
The Fire C is a Jelly Bean based one. Start from there.
If I can successfully flash mine will post results. Wish me luck.
resetreboot said:
Hello!
I've been trying to see if there's any root exploits, ROMs, whatever for this phone. Is it Hamachi (4012) compatible? Or is it another species? It does seem there's not much about it.
Click to expand...
Click to collapse

mancvso said:
The only thing I've found is this mail thread.
comments DOT gmane DOT org / gmane DOT comp DOT mozilla DOT devel DOT b2g / 12487
The Fire C is a Jelly Bean based one. Start from there.
If I can successfully flash mine will post results. Wish me luck.
Click to expand...
Click to collapse
Nope. Bricked phone.
Anyone knows how to use this files?
forum DOT gsmhosting DOT com / vbb / f272 / flash-file-request-alcatel-4019x-1883599

Where did you find these files? Can you point me to them?
Maybe I can make something out of it. The MTK Droid Tools is totally unable of dumping anything from this phone and it's supposedly designed for these kind of phones (the chipset is a MediaTek).
If only I could snatch the boot image...! But the /dev/ block devices do not make any sense to me, otherwise I'd have at least something to go back when I screw the boot loader.

The URL is in the post above, just replace " DOT " with "." and delete spaces.
Anyway, the direct link is
mediafireDOTcom/?t6x77dxpb9bucbf
Which one is boot, system, userdata? Do you have the original file sizes?
I've tried with various Hamachi (4012X) boot.img but none of them works.
PD: I cannot post links.

I managed to fix my phone!!
In the folder above (Mediafire)
boot.img is B1TC000112R0.mbn
recovery.img is R1TC000112R0.mbn
system.img Y1TC000112R0.mbn
Be sure to explicitly start in fastboot mode (Power+Volume down)
As a side note, if load recovery.img in boot.img the phone will start in that mode. I've had to do that to make it boot (and them flash boot.img)
Good luck. Pass it on.

Wonderful! This is really useful info.
Now we can try to couple it with the FFOS SDK and try to get root and maybe upgrade to 2.0...
D'loading so I can start hacking...

resetreboot said:
Wonderful! This is really useful info.
Now we can try to couple it with the FFOS SDK and try to get root and maybe upgrade to 2.0...
D'loading so I can start hacking...
Click to expand...
Click to collapse
Please do so! An upgrade to 2.x is crucial even for copy/pasting text.

mancvso said:
I managed to fix my phone!!
In the folder above (Mediafire)
boot.img is B1TC000112R0.mbn
recovery.img is R1TC000112R0.mbn
system.img Y1TC000112R0.mbn
Be sure to explicitly start in fastboot mode (Power+Volume down)
As a side note, if load recovery.img in boot.img the phone will start in that mode. I've had to do that to make it boot (and them flash boot.img)
Good luck. Pass it on.
Click to expand...
Click to collapse
Great news, remember you can type *#3228# to know what are all these filenames in your device.
I have a 4019M (sold unlocked in this country) and I am interested on this, however I don't have experience flashing yet, as this is my first smartphone. If you need to do some tests from here for this particular device to get root and upgrades, feel free to ask!
This device is qualcomm based and gonk is jelly bean based, if I recall correctly.

Some news, they finally uploaded this month 4019X / 4019A GPL compliance sources into sourceforge · net / projects / alcatel / files /

Some progress to get a proper factory image
When using One Touch Update, I tried to figure what happens with the factory image download from the vendor. It downloads a bunch of 64 KiB files stored in a downloaded/ subdir of the programfiles application folder. They are downloaded via TCP, not using HTTP. Once the download is complete, out1.data and out2.data are generated, I guess all these files get somewhat assembled into these. They are placed in the programfiles application folder too, 203 MiB each. They look like a couple of Android sparse image files, according to header magic numbers. These files should be copypasted somewhere before ending the flash operation and closing the application, otherwise they will be deleted. Maybe these files contain interesting stuff :good:. There is also a log file showing addresses where is flashing and sizes of the images of the factory flashing operation.
Maybe some USB sniffing is worth, but not tested.

4019X Brick
Hi guys.
I have a 4019X bricked becasuse i tried to install a wrong system.img.
Can you upload again the factory flash images? The mediafire link is broken.
I made a backup of the original system with adb pull /system /system as mozilla´s recommend in the Firefox OS build prerequisites.
But i dont know how to compile to restore my phone. I tried this:
ANDROIDFS_DIR=<path to system backup> ./config.sh tarako
ANDROIDFS_DIR=<path to system backup> ./build.sh
but always fail.
If you dont know, can you tell me how to use the source code of alcatel to unbrik my phone:
sourceforge.net ... OT_FF_4019X_20150408.tar.xz
Thanks

Backup of the stock One Touch Fire C files
https://www.dropbox.com/s/nzn6g4qhh585ho4/4019X-2[X=A,B,C,D]TBHU1.rar?dl=0
Please keep us informed on any progress, now that Firefox has freed itself.

can u tell me if this rom has portuguese language? i need 4019x android or firefox with portuguese language? or anyway to add language?
best regards

mancvso said:
I managed to fix my phone!!
In the folder above (Mediafire)
boot.img is B1TC000112R0.mbn
recovery.img is R1TC000112R0.mbn
system.img Y1TC000112R0.mbn
Be sure to explicitly start in fastboot mode (Power+Volume down)
As a side note, if load recovery.img in boot.img the phone will start in that mode. I've had to do that to make it boot (and them flash boot.img)
Good luck. Pass it on.
Click to expand...
Click to collapse
Hi! I can not fix my Alcatel OT- 4019A yet. ¿could you please help me with that?
I don't know exactly what do with that archives.
Thanks!

Gsmfanatic said:
can u tell me if this rom has portuguese language? i need 4019x android or firefox with portuguese language? or anyway to add language?
best regards
Click to expand...
Click to collapse
The firmware doesn't have the Portuguese language, flashed it myself ...

Possible way to self-sign Recovery and Rom's on S7, Just need some help.

Hey, I noticed while looking through the Stock Firmware AP file, that in meta-data/fota.zip there are .jar files that have to do with package signing. Only issue is that the zip is password protected. If someone has the Compute power and skills to decrypt a zip and look at the jar files and ****, maybe we could find a way to sign our own TWRP recoveries and roms. Just a thought, i'll post a link to the fota.zip file i was talking about in a bit if anyone wants to take a crack at it. (Google drive is taking forever to upload cause of AT&T's ****ty DSL speeds, sorry)
Download Link: htt*ps:/*/drive.*google*.com/file/*d/0B9tb-svjqaVD*b3Y0V0tXR3drSzA/vie*w?usp=sharing (Remove all *'s from link, stupid 10 post until you can post links limitation)
Thanks,
Lavavex

Did you saw this Thread?
https://forum.xda-developers.com/an...signing-boot-images-android-verified-t3600606
About fota.zip...
Did you heard about plain text attack?
In few Seconds... minutes done... no password required but you can unpack.
Best Regards

Yesterday I have download this fota.zip... and yes... same password as for instance from my prior test with:
SM-J330F and 1 more...
Here are the 3 keys to decrypt if somebody want try...
Code:
2b4d493c
6142b289
1b7024aa
Code:
Key0
Key1
Key2
I have used Advanced Archive Password Recovery from elcomsoft...
Best Regards

adfree said:
Yesterday I have download this fota.zip... and yes... same password as for instance from my prior test with:
SM-J330F and 1 more...
Here are the 3 keys to decrypt if somebody want try...
Code:
2b4d493c
6142b289
1b7024aa
Code:
Key0
Key1
Key2
I have used Advanced Archive Password Recovery from elcomsoft...
Best Regards
Click to expand...
Click to collapse
Which will allow unpacking of the above zip? I thought it needed a zip password.

osm0sis said:
Which will allow unpacking of the above zip? I thought it needed a zip password.
Click to expand...
Click to collapse
We never found the Password... but for Decryption you need only these 3 Keys...
They can be easily found in few Minutes... with the right Tool...
Code:
2b4d493c
6142b289
1b7024aa
Here Key0 Key1 Key2 for Samsungs fota.zip...
This is really no rocket science...
Simple read about plain-text attack...
You can see all filenames...
You can see all filesizes etc...
Many files are floating around the Internet... to create ZIP for attack...
Then result is in few Minutes possible... :angel:
Use these 3 Keys in Tool:
Code:
Advanced Archive Password Recovery
And try self to unpack...
Best Regards
Edit 1.
Screenshot added...
Then maybe more clear...
Trial Version have mabye limtations... but to see it work... it is enough to play with trial.

@adfree or to anyone who can answer.
Quick question, what are the legal limitations to what is going on here? I may or not have a file from inside the fota.zip, but will sharing it put me in the legal wrong? If it is within the legal boundaries, I'd be happy to upload it for anyone to take a look at, but I don't want to land on the wrong side of the law by doing so. Please do let me know, as this is the most exciting development we've had when it comes to bootloader unlocking in a while. Also, it seems as though we can't view the entirety of the contents of the fota.zip with the trial version of the zip extraction tool mentioned in this thread, so if someone with more knowledge about this can confirm we could unlock our bootloaders with the contents of the zip (based on what is currently known about this), I'd be happy to bite the bullet of paying for the premium version given we can do this within the boundaries of the law.
Thanks.

1.
Maybe you can answer your question self...
Samsung PROTECTED this ZIP with password.
2.
IMHO it is Kernel related...
Yeah I know... Boot is every irritating...
But it is not sboot.bin related...
3.
About decrypting all files...
There are floating around Command Line Tool...
Code:
pkcrack
Try to Google it...
I have not tried...
I am 1 click Button user...
Best Regards

zipdecrypt from the pkcrack package plus those 3 keys worked flawlessly. :good:
Edit: Crazy number of utilities in this zip, but no script to run them all, and a lot of references to external files. No smoking gun like a "sbootimg_signer" binary or anything to make their proprietary footer signature, and no Samsung signature files.

the password for that zip is fotatest1234

Correct. All fota zips passwords are fotatest1234

Drdra3 said:
Correct. All fota zips passwords are fotatest1234
Click to expand...
Click to collapse
@lavavex , @osm0sis
Yes it is, but now the question still to be answered is, do the tools within the fota.zip file, actually work for legitimately repacking the boot/recovery image? Because in the fota.zip I checked from Android Pie's release it mentioned the "user/test-keys" and very much so had all of the compiled tools to actually patch a system and create and ADB flashable zip for stock recovery.
Could we technically make a signed sideloadable update.zip if the the update package was created on the device itself? The scripts included, along with the updated compiled binary tools, really do seem to be the Toolkit we've been looking for but have overlooked. I haven't tested it out fully, but I'm still reading about how to proceed. It isn't just the S7 either. So are the tools customized to the device, the android branch, or the bootloader?

Delgoth said:
@lavavex , @osm0sis
Yes it is, but now the question still to be answered is, do the tools within the fota.zip file, actually work for legitimately repacking the boot/recovery image? Because in the fota.zip I checked from Android Pie's release it mentioned the "user/test-keys" and very much so had all of the compiled tools to actually patch a system and create and ADB flashable zip for stock recovery.
Could we technically make a signed sideloadable update.zip if the the update package was created on the device itself? The scripts included, along with the updated compiled binary tools, really do seem to be the Toolkit we've been looking for but have overlooked. I haven't tested it out fully, but I'm still reading about how to proceed. It isn't just the S7 either. So are the tools customized to the device, the android branch, or the bootloader?
Click to expand...
Click to collapse
Presumably what I previously said still stands:
osm0sis said:
Crazy number of utilities in this zip, but no script to run them all, and a lot of references to external files. No smoking gun like a "sbootimg_signer" binary or anything to make their proprietary footer signature, and no Samsung signature files.
Click to expand...
Click to collapse

[GUIDE] [MAGISK] Root stock Oreo B520 B521 B562

DISCLAIMER: I will not be responsible of any issues you could face following this how-to. You do it at your own risk!​
Here is a guide to root Honor 8 B521 Oreo. I did this on FRD-L09C432B521. Even if i think the "easy method" should work with other iteration of the phone (L02, L19, ...), I am not sure ramdisk is the same for all so test it if you feel lucky and please report if it works or not.
Requirements:
- Honor 8 running Oreo
- Unlocked Bootloader
- adb and fastboot installed on your computer (https://forum.xda-developers.com/android/software-hacking/alpha-adb-fastboot-installer-windows-t3637255 (Hit the thanks button)
Long method: (should work for all honor 8)​
1 -- Visit http://pro-teammt.ru/firmware-database/ and search your exact build (FRD-L09C432B521 for me). If you have several phones listed for your build, click the name of the build on the left. This will open an xml file on the first line of which you will see the exact model it is for.
2 -- Once you know which firmware is yours, click on "filelist". This will list the files for this build and theirs url. Copy the link pointing to "update.zip" (http://update.hicloud.com:8180/TDS/data/files/p3/s15/G3109/g1699/v159456/f1/full/update.zip for me). Decompress it wherever you want.
3 -- Download and run Huawei Update Extractor (Hit the thanks button) . Untick "verify header checksum" in "settings" tab.
4 -- In the "extract" tab, click on "..." and select "update.app" in the previously "update.zip" decompressed folder.
5 -- Files from "update.app" should now be listed. Find "ramdisk" and right click on it. Choose "extract" and you will be able to save the file wherever you want. Copy this file on your phone.
6 -- On your phone: Go to Magisk thread (Hit the thanks button) and download the latest magisk manager. Install it. Grant permission to the manager to access your storage in phone settings > applications.
7 -- Run Magisk Manager, it will ask you if you want to install the zip. Select "Yes". It will now ask if you want to flash the zip or to patch a boot image, choose this last one. Point to the ramdisk img you previously copied on your phone. Magisk manager will now patch it and create a new "patched_boot.img" file. Copy this on your computer.
8 -- On your computer: Open a command prompt where you copied "patched_boot.img". Enter the following commands:
adb reboot bootloader (your phone will reboot in bootloader mode)
fastboot flash ramdisk patched_boot.img
fastboot reboot
9 -- Your phone will now reboot and be rooted. To unroot, repeat the process (8) with your stock ramdisk (the one extracted with Huawei Update Extractor)
Easy method​
If your build is FRD-L09C432B521, FRD-L02C432B521, FRD-L04C567B520 or FRD-L09C432B562, you can use these already patched ramdisk.img.
patched_RAMDISKL09B521.img
stock_RAMDISKL09B521.img
patched_RAMDISKL02B521.img thanks to @Sharath007for the file
patched_RAMDISKL04B520.img thanks to @macbuggo for the file
stock_RAMDISKL04B520.img thanks to @macbuggo for the file
patched_RAMDISKL09B562.img thanks to @topscorer for the file
stock_RAMDISKL09B562.img thanks to @topscorer for the file
On your computer: Open a command prompt where you downloaded "patched_RAMDISKL09B521.img" (or L02/L04 ramdisk) .
Enter the following commands:
adb reboot bootloader (your phone will reboot in bootloader mode)
fastboot flash ramdisk patched_RAMDISKLXXBXXX.img (the exact name depends of the ramdisk you downloaded)
fastboot reboot
Your phone will now reboot
Go to Magisk thread (Hit the thanks button) and download the latest magisk manager. Install it.
You now got root. To unroot, repeat the process with stock ramdisk.

Worked in the first attempt.. Safety net passes..

Sharath007 said:
Worked in the first attempt.. Safety net passes..
Click to expand...
Click to collapse
Did you do this on L09? Otherwise, could you share the patched ramdisk so I can add it in OP?

stephtban said:
Did you do this on L09? Otherwise, could you share the patched ramdisk so I can add it in OP?
Click to expand...
Click to collapse
Thanks for your guide. I did it on my FRD-L02 Variant.
FRD_L02_patched_boot

Sharath007 said:
Thanks for your guide. I did it on my FRD-L02 Variant.
FRD_L02_patched_boot
Click to expand...
Click to collapse
Thanks! I added your ramdisk to OP. Do you still have unpatched version of it for easy unrooting?

delete

PremiumBlaze said:
Can't guys flash Magisk using twrp? It worked for me in android oreo.
Click to expand...
Click to collapse
You can indeed use twrp but as it is not completely functional yet, some people don't use it. Besides, Open Kirin suggest to flash their rom with fastboot so it limits the interest of having twrp.

stephtban said:
DISCLAIMER: I will not be responsible of any issues you could face following this how-to. You do it at your own risk!​
Here is a guide to root Honor 8 B521 Oreo. I did this on FRD-L09C432B521. Even if i think the "easy method" should work with other iteration of the phone (L02, L19, ...), I am not sure ramdisk is the same for all so test it if you feel lucky and please report if it works or not.
Requirements:
- Honor 8 running Oreo
- Unlocked Bootloader
- adb and fastboot installed on your computer (https://forum.xda-developers.com/android/software-hacking/alpha-adb-fastboot-installer-windows-t3637255 (Hit the thanks button)
Long method: (should work for all honor 8)​
1 -- Visit http://pro-teammt.ru/firmware-database/ and search your exact build (FRD-L09C432B521 for me). If you have several phones listed for your build, click the name of the build on the left. This will open an xml file on the first line of which you will see the exact model it is for.
2 -- Once you know which firmware is yours, click on "filelist". This will list the files for this build and theirs url. Copy the link pointing to "update.zip" (http://update.hicloud.com:8180/TDS/data/files/p3/s15/G3109/g1699/v159456/f1/full/update.zip for me). Decompress it wherever you want.
3 -- Download and run Huawei Update Extractor (Hit the thanks button) . Untick "verify header checksum" in "settings" tab.
4 -- In the "extract" tab, click on "..." and select "update.app" in the previously "update.zip" decompressed folder.
5 -- Files from "update.app" should now be listed. Find "ramdisk" and right click on it. Choose "extract" and you will be able to save the file wherever you want. Copy this file on your phone.
6 -- On your phone: Go to Magisk thread (Hit the thanks button) and download the latest magisk manager. Install it. Grant permission to the manager to access your storage in phone settings > applications.
7 -- Run Magisk Manager, it will ask you if you want to install the zip. Select "Yes". It will now ask if you want to flash the zip or to patch a boot image, choose this last one. Point to the ramdisk img you previously copied on your phone. Magisk manager will now patch it and create a new "patched_boot.img" file. Copy this on your computer.
8 -- On your computer: Open a command prompt where you copied "patched_boot.img". Enter the following commands:
adb reboot bootloader (your phone will reboot in bootloader mode)
fastboot flash ramdisk patched_boot.img
fastboot reboot
9 -- Your phone will now reboot and be rooted. To unroot, repeat the process (8) with your stock ramdisk (the one extracted with Huawei Update Extractor)
Easy method​
If your build is FRD-L09C432B521 or FRD-L02C432B521, you can use these already patched ramdisk.img.
patched_RAMDISKL09B521.img
stock_RAMDISKL09B521.img
patched_RAMDISKL02B521.img thanks to @Sharath007for the file
On your computer: Open a command prompt where you downloaded "patched_RAMDISKL09B521.img" (or L02 ramdisk) .
Enter the following commands:
adb reboot bootloader (your phone will reboot in bootloader mode)
fastboot flash ramdisk patched_RAMDISKL09B521.img OR fastboot flash ramdisk patched_RAMDISKL02B521.img
fastboot reboot
Your phone will now reboot and be rooted
To unroot, repeat the process with stock ramdisk.
Click to expand...
Click to collapse
Thanks! work perfectly

freewind29 said:
Thanks! work perfectly
Click to expand...
Click to collapse
Don't quote entire op please.

Did not work on my phone (L09C432) with the "easy way".
Flashed patched ramdisk, no root, but at least still running.

daFlox said:
Did not work on my phone (L09C432) with the "easy way".
Flashed patched ramdisk, no root, but at least still running.
Click to expand...
Click to collapse
Sorry, I forgot a step. After you flashed the patched ramdisk, go to Magisk thread (Hit the thanks button) and download the latest magisk manager. Install it. This should work then. Please tell me if it helped.
OP edited with this new step.

Worked great here for FRD-04, one thing to add
You may have to restart your phone to be able to see the patched file via MTP in order to copy it to your PC.

macbuggo said:
Worked great here for FRD-04, one thing to add
You may have to restart your phone to be able to see the patched file via MTP in order to copy it to your PC.
Click to expand...
Click to collapse
Happy this works. Could you share the stock ramdisk and the patched ramdisk so I can add it in OP.

stephtban said:
Sorry, I forgot a step. After you flashed the patched ramdisk, go to Magisk thread (Hit the thanks button) and download the latest magisk manager. Install it. This should work then. Please tell me if it helped.
OP edited with this new step.
Click to expand...
Click to collapse
Ahhh, okay!
Will try it this evening and report tomorrow.

daFlox said:
Will try it this evening and report tomorrow.
Click to expand...
Click to collapse
Works, thanks a lot!! (additional thanks in the original post )

stephtban said:
Happy this works. Could you share the stock ramdisk and the patched ramdisk so I can add it in OP.
Click to expand...
Click to collapse
I couldn't upload to XDA directly due to 8MB limit unfortunately, here it is if you want to put it up on your google drive or something
http://s000.tinyupload.com/index.php?file_id=10562650897614852938
This is a patched image of FRD-04C567 8.0.0.520 with Magisk 17.1

macbuggo said:
I couldn't upload to XDA directly due to 8MB limit unfortunately, here it is if you want to put it up on your google drive or something
http://s000.tinyupload.com/index.php?file_id=10562650897614852938
This is a patched image of FRD-04C567 8.0.0.520 with Magisk 17.1
Click to expand...
Click to collapse
Thanks. File and credit added to OP. Do you still have stock ramdisk for easy unrooting?

Tinyupload appears to be down, these links will last for 30 days
FRD-L04C567 8.0.0.520 ramdisk patched Magisk 17.1
https://ufile.io/nsa1h
Stock L04 520 ramdisk
https://ufile.io/34eq5

macbuggo said:
Tinyupload appears to be down, these links will last for 30 days
FRD-L04C567 8.0.0.520 ramdisk patched Magisk 17.1
https://ufile.io/nsa1h
Stock L04 520 ramdisk
https://ufile.io/34eq5
Click to expand...
Click to collapse
File added. Thx.

Hallo! Is it possible to root my FRD-L09 Honor 8 Oreo this way too? And after then can I flash/install a Stock Version with Emui 5 Android 7 Nougat and then un-root again? I need my device unrooted, because of SkyGo App (Germany) doesnt work with rootet Devices ...
If theres another way to downgrade without these operations, please let me know and maybe show me the steps for that?! Thank you so much!

[Guide] Convert locked OnePlus 8T TMO to Global version with MsmDownloadTool

This can:
Bypass TMO flash lock as it uses 9008 EDL.
Remove TMO sim lock and oem lock as you will be using global rom.
Convert your KB2007 (KB09CB) to KB2005 (KB05AA) as much as possible. (Although you're using the latest KB2005 firmware, any LineageOS stuff, such as LOS system,LOS recovery and LOS fastbootd, will still recognize it as KB2007. This is the same in OOS 11. But in OOS 12 system, it shows and acts like a KB2005.)
Should enables dsds (dual sim dual standby) in OOS 12. (Not tested. But status bar shows two empty sim slots in KB2005 OOS 12. After I flash LOS 19.1, slot 2 won't act unless boot with "persist.radio.multisim.config=dsds" prop.)
Give you access to Global OxygenOS firmware. (Bye slow TMO~)
Probably give you better overall condition (e.g. partition) than some fastboot scripts, as it's done directly by 9008 EDL.
AND THIS WILL DELETE ALL YOUR DATA ON DEVICE!!!
Actually, you should be able to change any brand device to any version you like by this method, but take your own risk as nothing is solid tested.
This can't:
Give you a second IMEI. (In OOS IMEI2 is "null". I guess it's hard baked somewhere.)
Remove TMO flash lock or unlock a locked bootloader. (You still need unlock token for that.)
You tell me please. I don't have enough time to test everything.
Please:
BE AWARE THAT YOU ARE RESPONSIBLE FOR WHAT YOU DO TO YOUR HARDWARE, NOT ME.
MY SUCCESS DOESN'T MEAN IT MAST HAPPENS TO YOU.
YOU ARE THE ONE WHO TAKE ALL THE RISKS. (And your phone, too.)
Be kind to other readers and help them, I can't stay online all day, sorry.
Why:
I own a fully unlocked KebabT running LineageOS 18.1, and I decided to try LOS 19.1 out.
But OOS 12 firmware is so buggy that it even broke my LOS instance, and the fastboot (not fastbootD, for hell reasons I can't enter LOS recovery AFTER ALL firmware upgrade) is also too buggy to fix my issue.
I unbricked my phone using this " https://forum.xda-developers.com/t/...l-to-restore-your-device-to-oxygenos.4180981/ " (Thanks for sharing!!!), but only to find that TMO firmware is so old, buggy and limited.
Then I googled and found this "https://www.droidwin.com/convert-oneplus-t-mobile-metro-to-global-on-locked-bootloader/" and this "https://github.com/bkerler/oppo_decrypt" ,but they are slightly outdated and doesn't fit kebab.
I fetched global firmware from here "https://forum.xda-developers.com/t/oneplus-8t-rom-ota-oxygen-os-repo-of-oxygen-os-builds.4193183/" (Thanks for sharing!!!) and started trying.
After a few tries I succeed and decided to share what I found.
How:
Firstly, know your hardware. Especially your ram type (ddr4 or ddr5) !
Then follow what this "https://www.droidwin.com/convert-oneplus-t-mobile-metro-to-global-on-locked-bootloader/" said, BUT WITH EXTRA MODIFICATION on your "settings.xml":
1. Overwrite "BasicInfo Project", "Version", "ModelVerifyPrjName", "ModelVerifyRandom" and "ModelVerifyHashToken", these makes you pass MsmDownloadTool's pre-check.
2. Scroll to the end of file and overwrite [Target ID="1" Desc="O2"] with [Target ID="101" Desc="TMO"], otherwise your flash won't begin as the tool can't find right hardware to flash.
3. Search for "Image ID=" and modify the results. For me, I have a DDR4 device, so I go with "xbl.img" and "xbl_config.img", so FOR ME I change "Image ID="1"" to "Image ID="101"", and change "Image ID="65537"" to "Image ID="65637"". Otherwise MsmDownloadTool won't be able to locate the right xbl img file to flash.
4. Follow the rest of that great guide and have a few tries, you won't lose more as you're already under EDL mode. Wish you success!
And:
Sorry in advance for any possible confusion as I'm not a native English speaker. You can ask in replies!
Please let me know if I'm wrong, I'll try to correct.
If this is already shared by other great guys, please forgive me as I really didn't find any related post in this forum.
I doubt this "https://forum.xda-developers.com/t/...m-unlock-or-bootloader-unlock-needed.4188491/" (Thanks for sharing!!!) is done in the same way but no one mentioned about it.
Special thanks to bkerler for creating this awesome "https://github.com/bkerler/oppo_decrypt" project!
Special thanks to LuK1337 for maintain LineageOS for OnePlus 8T!! You're great!!
Question:
It it possible to remove flash lock in this way?
I've tried several times to flash with kebab not kebabT MsmTool. But I can't make it work.

I can fix in os12 but need rw or unpack repack rom

Mr Hassan said:
I can fix in os12 but need rw or unpack repack rom
Click to expand...
Click to collapse
I don't understand.
Fix what or unpack what?
Is this what you need? "https://github.com/bkerler/oppo_decrypt"

I'm kind of curious to know what your model number would show up as in the About Phone screen. Being able to incorporate the SIM fix into the ROM would be a good thing. There was a link in the OP to a took that could unpack and repack the OPS file. My concern is, at least with the bastardized Color/Oxygen OS stock hybrid, that it will still see the device as a KB2007 and not an actual KB2005 outside of just the firmware version.

jcsww said:
I'm kind of curious to know what your model number would show up as in the About Phone screen.
Click to expand...
Click to collapse
For LOS and OOS 11, KB2007. (But for OOS 11 software update page, it shows as KB2005. You're able to get KB2005 OTA updates without any problem.)
For OOS 12, KB2005 everywhere.
You can try to spoof device model by using magisk_hide_props_config module, but it's another story.
jcsww said:
Being able to incorporate the SIM fix into the ROM would be a good thing.
Click to expand...
Click to collapse
If you use global version OOS or flash LOS, sim lock no longer exists.

IAAxl said:
I don't understand.
Fix what or unpack what?
Is this what you need? "https://github.com/bkerler/oppo_decrypt"
Click to expand...
Click to collapse
Unpack whole rom system vendor product odm
Its all in super.img

Mr Hassan said:
Unpack whole rom system vendor product odm
Its all in super.img
Click to expand...
Click to collapse
You can get super.img using oppo_decrypt.
But, I thought that's an unencrypted raw disk image, am I wrong?
And by the way, I flashed KB2005 super.img into my KB2007, but fastboot flash lock is still there, have to use unlock code bin file to disable it.

I apologize, as I don't quite understand the original post. This seems to be trying to specify a way to get dual-sim on KB2007 with A12? Apologies for the dumb questions, 1) How do I found out if my KB2007 has DDR4 or DDR5? 2) The instruction link https://www.droidwin.com/convert-oneplus-t-mobile-metro-to-global-on-locked-bootloader/ , following these steps seems to still leave the device on Android 11 (because that is the rom that comes with the MSM tools). If we then update to Android 12, won't that disable the dual-sim again?

raven911 said:
I apologize, as I don't quite understand the original post. This seems to be trying to specify a way to get dual-sim on KB2007 with A12? Apologies for the dumb questions, 1) How do I found out if my KB2007 has DDR4 or DDR5? 2) The instruction link https://www.droidwin.com/convert-oneplus-t-mobile-metro-to-global-on-locked-bootloader/ , following these steps seems to still leave the device on Android 11 (because that is the rom that comes with the MSM tools). If we then update to Android 12, won't that disable the dual-sim again?
Click to expand...
Click to collapse
In os12 ofcourse your 2nd sim will disable by bootloader partitions and some other as i mention in another post
But good news is i can fix
But bad news no way yo unpack repack or rw after root

raven911 said:
I apologize, as I don't quite understand the original post. This seems to be trying to specify a way to get dual-sim on KB2007 with A12? Apologies for the dumb questions, 1) How do I found out if my KB2007 has DDR4 or DDR5? 2) The instruction link https://www.droidwin.com/convert-oneplus-t-mobile-metro-to-global-on-locked-bootloader/ , following these steps seems to still leave the device on Android 11 (because that is the rom that comes with the MSM tools). If we then update to Android 12, won't that disable the dual-sim again?
Click to expand...
Click to collapse
To answer your questions:
1) Check here: https://wiki.lineageos.org/devices/kebab/fw_update
By the way, 8T hardware has two major variables: UFS 3.0 / 3.1 storage, and lpddr 4 / 5 memory. Storage type doesn't matter to rom flash, but memory type does.
2) Yes! You're still on OOS 11 after change-brand flash, but then you can OTA to KB2005 OOS 12 directly.
And, because my final goal is to run LOS, I didn't put my sim in while my phone is on OOS, so I can't really answer if dual sim is available in OOS 11 or 12.
In LOS, I use magisk_hide_props_config module to add "persist.radio.multisim.config=dsds" into system prop to enable dual sim. You can also try this "https://forum.xda-developers.com/t/...bile-8t-kb2007-with-lineage-aosp-rom.4262669/", same stuff.
If your KB2007 is flash locked, you can try the following steps and see if it will work:
A. Use oppo_decrypt to get elf files from msm rom;
B. Use QPST (and the elf file) to flash magisk patched boot.img into your device under 9008.
C. Install magisk model and get dsds.
∆ The risk is in step B.
I'm not familiar enough with QPST and never succeed to get QPST work to do anything.

Mr Hassan said:
Unpack whole rom system vendor product odm
Its all in super.img
Click to expand...
Click to collapse
Err… Try use MsmTool readback?
Oppo_decrypt offers an option to enable readback. I haven't used it though.
Or can you change what you have to, directly on a rooted device, and check if it works?
I'm still confused. Aren't those img file raw disk images? Can't you mount and read them on any Unix-alike device? How do you usually do this with other devices?

IAAxl said:
Err… Try use MsmTool readback?
Oppo_decrypt offers an option to enable readback. I haven't used it though.
Or can you change what you have to, directly on a rooted device, and check if it works?
I'm still confused. Aren't those img file raw disk images? Can't you mount and read them on any Unix-alike device? How do you usually do this with other devices?
Click to expand...
Click to collapse
let me tell you msm have rb option
but you still not got my pov there,s no rw option in rooted device even after root
so how can i make dump or backup or for which purpose i need backup if i dont even modded something in rooted device
another option which left is unpack system.img vendor.img odm.img etc and modify then repack it
but there,s not way to even convert it to raw i try simg2img but not support by this
even if i able to convert it to raw i can do something
and no its not raw format men. its payload and super

Mr Hassan said:
let me tell you msm have rb option
but you still not got my pov there,s no rw option in rooted device even after root
so how can i make dump or backup or for which purpose i need backup if i dont even modded something in rooted device
another option which left is unpack system.img vendor.img odm.img etc and modify then repack it
but there,s not way to even convert it to raw i try simg2img but not support by this
even if i able to convert it to raw i can do something
and no its not raw format men. its payload and super
Click to expand...
Click to collapse
Okay I understand now..
The goal is to change sth inside vendor and other partition, but they can't be remounted read-write inside system.
And the img file can't be exacted or repacked.
Will you try to remount those partition in recovery ADB maybe?

IAAxl said:
Okay I understand now..
The goal is to change sth inside vendor and other partition, but they can't be remounted read-write inside system.
And the img file can't be exacted or repacked.
Will you try to remount those partition in recovery ADB maybe?
Click to expand...
Click to collapse
Yes now you fully understand
Yes i tried many thing
And yes in twrp also tried remount etc
I also pull files and edit but when i push
Its said device not have enough space
Its maybe need resize etc

Mr Hassan said:
Yes now you fully understand
Yes i tried many thing
And yes in twrp also tried remount etc
I also pull files and edit but when i push
Its said device not have enough space
Its maybe need resize etc
Click to expand...
Click to collapse
I don't know if this helps or not.
But there are some scripts to exctract partitions from SUPER, flash them and make -rw.
[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition
Disclaimer: Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything...
forum.xda-developers.com
[Closed] Universal SystemRW / SuperRW feat. MakeRW / ro2rw (read-only-2-read/write super partition converter)
Welcome to the one and only, the original, universal, System-RW / Super-RW feat. Make-RW / ro2rw (read-only-2-read/write super partition converter) by lebigmac Also known as: THE-REAL-RW, FULL-RW, EXT4-RW, EROFS-RW, EROFS-2-RW, F2FS-RW...
forum.xda-developers.com

Rootk1t said:
I don't know if this helps or not.
But there are some scripts to exctract partitions from SUPER, flash them and make -rw.
[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition
Disclaimer: Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything...
forum.xda-developers.com
[Closed] Universal SystemRW / SuperRW feat. MakeRW / ro2rw (read-only-2-read/write super partition converter)
Welcome to the one and only, the original, universal, System-RW / Super-RW feat. Make-RW / ro2rw (read-only-2-read/write super partition converter) by lebigmac Also known as: THE-REAL-RW, FULL-RW, EXT4-RW, EROFS-RW, EROFS-2-RW, F2FS-RW...
forum.xda-developers.com
Click to expand...
Click to collapse
I done manything even convert to ext4
In shel its showing rw
And also in root explorer get rw but still not edit anything

I also try similar approach using qpst. I can read/save qpst and qcn but i can't write back.

vortex91 said:
I also try similar approach using qpst. I can read/save qpst and qcn but i can't write back.
Click to expand...
Click to collapse
Could you please share what you find?
I'm really unfamiliar with QPST, any info could help.

So, I'm not need T-Mobile help to sim unlock my phone?
Just convert it to global, and it will be carrier unlocked?
Are I read this right?

Deleted.

General [ROM][Restore][Unbrick] Nothing OS v1.5.4 Global/EEA Fastboot ROM(Full ROM) & boot.img & QFIL ROM (EDL)

Update! : 2023/05/05 20:00 (UTC+9:00)
Fastboot ROM and boot.img for NothingPhone(1) are now available. v1.5.4 is available.
Sorry for my poor English, I'm Japanese...
News: The DSU has been restored in this version. It seems to be usable as long as it is non-root.
The content of this site has been changed because Global and EEA have merged. (Global)" section is for Global only.
I think v1.5.1 or later can be used for all types.
I selfishly want the EEA version.(White..!)
I'd like to do some verification and such.
reindex-ot.github.io
Re*Index. GitHub Pages
reindex-ot.github.io
Attention!
This fastboot ROM requires 'fastboot flashing unlock' and 'fastboot flashing unlock_critical'(Option)!
2023/02/13 0:44 (UTC+9:00)
Add QFIL ROM (⚠EDL Command or EDL Cable V1/V2 Required)
I haven't tried it myself; there is Firehose, so you can use it however you like.

ot_inc said:
Fastboot ROM and boot.img for NothingPhone(1) are now available. v1.1.7 is available. Sorry for my poor English, I'm Japanese...
reindex-ot.github.io
Re*Index. GitHub Pages
reindex-ot.github.io
Thx! AVB Delenda Est
Click to expand...
Click to collapse
Thanks

ot_inc said:
Fastboot ROM and boot.img for NothingPhone(1) are now available. v1.1.7 is available. Sorry for my poor English, I'm Japanese...
reindex-ot.github.io
Re*Index. GitHub Pages
reindex-ot.github.io
Thx! AVB Delenda Est
Click to expand...
Click to collapse
You should detail the version, only global, no EEA.
Thanks for your work

Pho3nX said:
You should detail the version, only global, no EEA.
Thanks for your work
Click to expand...
Click to collapse
oops... I forgot to write it down, so I got up to add it.

ot_inc said:
Fastboot ROM and boot.img for NothingPhone(1) are now available. v1.1.7 is available. Sorry for my poor English, I'm Japanese...
reindex-ot.github.io
Re*Index. GitHub Pages
reindex-ot.github.io
Warning: There is a problem with this version that makes the DSU Loader unusable.
GSI users should avoid this version.
Thx! AVB Delenda Est
Click to expand...
Click to collapse
Does falshing script is available inside the zip

Is there an OTA Full ROM?

ZeroSakura said:
Is there an OTA Full ROM?
Click to expand...
Click to collapse
If you flash this, you will get v1.1.7, which is effectively an OTA Full ROM. You may want to check with the previous version.

ot_inc said:
If you flash this, you will get v1.1.7, which is effectively an OTA Full ROM. You may want to check with the previous version.
Click to expand...
Click to collapse
Oh，thx

is there any instructions?

There is flash slot a and flash slot b bat files in zip
Do we need to run both scripts?

Bat file fails because it has a ./ command in front of the image name, Probably meant for linux.
Just remove it and run it. I merged both files and flashed both slots along with the Delta patched boot image.
Also, stock fastboot file cannot flash the big super image - it fails at 7/9
Edit - Used a short cable to flash super.img and it worked.
ROM works and boots fine. Everything good here.

pankspoo said:
There is flash slot a and flash slot b bat files in zip
Do we need to run both scripts?
Click to expand...
Click to collapse
Flash in either slot and it should work. I had integrated them in the past, but it became troublesome, so I separated them. Sorry about that.

JazonX said:
Bat file fails because it has a ./ command in front of the image name, Probably meant for linux.
Just remove it and run it. I merged both files and flashed both slots along with the Delta patched boot image.
Also, stock fastboot file cannot flash the big super image - it fails at 7/9
Edit - Used a short cable to flash super.img and it worked.
ROM works and boots fine. Everything good here.
Click to expand...
Click to collapse
I didn't prepare a script for Linux and there was a problem with the command description... Sorry.
How about super.img Flash with fastbootd? I have already compressed it with simg.

ot_inc said:
I didn't prepare a script for Linux and there was a problem with the command description... Sorry.
How about super.img Flash with fastbootd? I have already compressed it with simg.
Click to expand...
Click to collapse
It worked - Just had to use a Short cable to flash it. Longer charging cables dont work, I had this issue on my Mi11 Ultra as well.

日本語で悪い。
DSUが使えない問題があったりしたんで今まで自分がFastboot ROMを作る方法をPastebinに記しておいた。バックアップにはMagiskでのroot環境かSUが入ったGSIが必要になる。
Magiskの方法は、Magiskのパッチをしていないboot.imgが必要になるのでGSIの方法が簡単だったりする。この方法はimgが存在しない機種にも使えたりする。
この日本語の文章が読めた人は参考にやって見て欲しい。
Android Backup Images : Japanese - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com

ot_inc said:
日本語で悪い。
DSUが使えない問題があったりしたんで今まで自分がFastboot ROMを作る方法をPastebinに記しておいた。バックアップにはMagiskでのroot環境かSUが入ったGSIが必要になる。
Magiskの方法は、Magiskのパッチをしていないboot.imgが必要になるのでGSIの方法が簡単だったりする。この方法はimgが存在しない機種にも使えたりする。
この日本語の文章が読めた人は参考にやって見て欲しい。
Android Backup Images : Japanese - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com
Click to expand...
Click to collapse
因みにimgをFlashするbatファイルはこれ。参考にして欲しい。
必要なimgもそれを参考にすれば多分大丈夫。
super.imgはimg2simgでスパースイメージにしておくと処理が早くなります。容量も少し減るので時間があったらしておくと良いと思う。
Android IMG Flasher (Fastboot) - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com

Can i use this to downgrade to NOS 1.1.7 from NOS 1.5 A13

pankspoo said:
Can i use this to downgrade to NOS 1.1.7 from NOS 1.5 A13
Click to expand...
Click to collapse
I think you will need to wipe the data, but you should be able to get it back.

Got any newer roms .. Maybe A13 in Fastboot mode ?

Will there be EEA version of this?