[AT&T Samsung Galaxy S II Skyrocket SGH-I727] cschmitt:
Unlike other SG models, the Skyrocket does not use a nv_data.bin. Rather, the IMEI, lock codes, and radio calibration data are stored in three encrypted partitions, M9K_EFS1, M9K_EFS2, and M9K_FSG, which correspond to devices mmcblk0p18, mmcblk0p19, and mmcblk0p20. M9K_EFS1 and M9K_EFS2 are the active copies of the EFS, while M9K_FSG is the 'Golden Backup' referenced in the service mode. Note: The golden backup only exists if one is first created via the service mode menu.

The EFS is initialized on boot by this line in init.target.rc:

service kickstart /system/bin/qcks l

QC kickstart performs a number of operations, but the ones we are interested in are the EFS partition dumps into /data/qcks on boot:

dd if=/dev/block/mmcblk0p18 of=/data/qcks/temp.dump bs=1024 count=3072
chmod 666 /data/qcks/temp.dump
cat /system/etc/firmware/misc_mdm/image/efs1.mbn /data/qcks/temp.dump >/data/qcks/efs1.bin

dd if=/dev/block/mmcblk0p19 of=/data/qcks/temp.dump bs=1024 count=3072
chmod 666 /data/qcks/temp.dump
cat /system/etc/firmware/misc_mdm/image/efs2.mbn /data/qcks/temp.dump >/data/qcks/efs2.bin

dd if=/dev/block/mmcblk0p20 of=/data/qcks/temp.dump bs=1024 count=3072
chmod 666 /data/qcks/temp.dump
cat /system/etc/firmware/misc_mdm/image/efs3.mbn /data/qcks/temp.dump >/data/qcks/efs3.bin

The efs1.bin, efs2.bin, and efs3.bin files are created in /data/qcks as working copies of the EFS accessed by the radios during normal phone operation. Most likely this is done to restrict write access to the EFS partitions to prevent corruption and to make it more difficult to unlock the radios.

Further investigation reveals that efs1.mbn, efs2.mbn, and efs3.mbn located in /system/etc/firmware/misc_mdm/image are just 40 byte headers which are prepended to the EFS partition dumps in /data/qcks.

This is good news, because it means if we have a nandriod backup of the /data partition of the phone then it's not too difficult to strip off the 40 byte headers and flash the resulting efs1.bin, and efs2.bin back to mmcblk0p18 and mmcblk0p19 to restore the corrupted EFS partitions.

First, before messing around with the EFS (or attempting a USB unlock, which can corrupt the EFS) I would highly recommend backing up the existing EFS partitions to the sdcard, either through ADB or a terminal window. (adb commands shown):

adb shell dd if=/dev/block/mmcblk0p18 of=/sdcard/mmcblk0p18.bin
adb shell dd if=/dev/block/mmcblk0p19 of=/sdcard/mmcblk0p19.bin
adb shell dd if=/dev/block/mmcblk0p20 of=/sdcard/mmcblk0p20.bin

If things go south, these bin file dumps can be written back to the EFS partitions using dd to restore the original EFS state. (I've personally done this several times and it is successful.)

Disclaimer: This is an advanced task and you alone are solely responsible for any and all mishaps, or mayhem, bricked phones, etc. they might occur as a direct or indirect result of following this example. If you are in anyway unsure or unclear about any one of these steps, do not proceed!

Ok, Here are the basic steps to restore a corrupted EFS from a nandroid backup:

1. Find a recent nandroid backup, prior to the EFS corruption.

2. No nandriod backup??? STOP HERE, sorry out of luck.

3. Copy the nandriod backup over to another computer via USB, dropbox, or carrier pigeon ???.

4. In the backup folder, locate data.ext4.tar or data.ext4.tar.a if the data.ext4.tar is 0 bytes.

5. Open the tar file with 7-Zip, navigate to /data/qcks folder, and extract efs1.bin and efs2.bin from the archive to a local folder on the hard drive.

6. Open efs1.bin in hex mode with a file editor capable of handling binary files and delete the first 40 bytes of the file, then save it.

6b. Repeat step 6 with efs2.bin.

7. At this point check the file sizes. Before editing efs1.bin and efs2.bin should be exactly 3,145,768 bytes, after trimming the header they should be exactly 3,145,728 bytes. If the size is incorrect STOP and fix the problem. Do not flash an improperly sized file it will corrupt the EFS.

8. The next step is to push and flash edited EFS files to the phone, which can be done via ADB. These steps are critical, double check each command for typos before executing:

adb push efs1.bin /sdcard/efs1.bin
adb push efs2.bin /sdcard/efs2.bin
adb shell dd if=/sdcard/efs1.bin of=/dev/block/mmcblk0p18
adb shell dd if=/sdcard/efs2.bin of=/dev/block/mmcblk0p19

9. Reboot, and enjoy a restored EFS.

Questions? Ask!