[Motorola Photon 4G] peetr_:
I´ll start with writing, what happend to me, about some weeks ago.

Warning:

Never do this !!!

I wanted to flash the radio from the Photon 2.3.5 leak and I could not find the CWM recovery method (found later after this, thanks Olegfusion), so I took the bp.img and tear it apart with hexeditor to:

amss_sec.mbn

dbl_sec.mbn

osbl_sec.mbn

partition.mnb

RDL1.smg

Depacked full sbf with Motoandroiddepacker (from Skrilax_CZ), extracted headers and just changed mbns and cdt.bin (CG3.smg), later unlocked bootloader (CG42.smg) and tried to repack. Problem was, any try to include CG3.smg (even the default) failed when repacking, so I decided to not include this one.

After several tries I "succesfully" flashed my repacked sbf with radio, but everytime ended at 90% of flashing CG5.smg. I tried more variations, but nothing.

And ended up with Failed to boot 1 (when trying to start as locked) and after unlocking modem did not power up.

So my state now was, switched fuse with broken radio part. Cool :-)

My fuse now - cat /sys/firmware/fuse/ReservedOdm - 10000000000030001000100004000

Then I found the cwm method of flashing radio, thanks to Olegfusion, but this did not helped me. Always, modem did not power up. Only way, how to start Android was through fastboot option Boot Android (No BP).

So I had to find a way, how to fully flash the radio with RSD Lite.

Everytime I tried to flash full 198_7 sbf, it ended right before flashing the radio. Because it flashed the locked bootloader first and while restarting right before CG5.smg (radio) flashing, it writes Failed to boot 1.

I tried to make my own full sbf with unlocked bootloader, but MotoAndroidDepacker, does not accept CG3.smg

So I started thinking(lol):

When RSD Lite creates the image at the beggining, where it is stored?

I found it at C:\Users\--your user dir--\AppData\Local\Motosftemp (win7).

It was a surprise for me, when I found, it was just the depacked sbf with all smgs and firmware.hmg right after the creating image part was done.

This gave me the light of hope. :-)

So I tried to flash my sbf, took those smgs, then full sbf, changed smgs I needed and started with 2nd reflashing. But another problem, RSD Lite recognizes, when those files are changed and when not. If there are unchanged files, and you start 2nd reflashing without exiting RSD, it skips the creating image files. But when you change any, it´s starting over, and all those smgs are created again.

So I started to think about speed hacking it. :-)

I have depacked derpunlock.sbf, my.sbf and full.sbf in RSD temp dir and I thought, I need the leaked cdt.bin and radio.img, because of fuse switched (that was not the right combination). So I started with very slow full sbf flashing speed hacks. Many times.

The super clever speed hack method (lol):

Right after creating image files part, the phone restarts.

This is the time, you need to quickly change (overwrite) those needed smgs.

The right combination that helped me to flash full sbf with radio was CG3.smg (cdt.bin - not sure if it is needed, I took the one from the leaked 2.3.5 zip) and CG42.smg (unlocked bootloader).

That lets the flashing process continue when changing to CG5.smg (radio) flashing. No failed to boot 1.

So, the fuse is switched forever, but I have my radio working again. :-)

As I don´t need 4G, I don´t mind being unlocked.

Most of you don´t need all this, but someone could find it helpful.

Sorry for my English. :-P