[HTC EVO 3D] Unknownforce:
I did make a bit of progress. However, it's still not quite right. But definitely steps in the right direction. I got rfg_1 slightly populated, but I had to do it manually. But, I can have it populate this from the already existing data though and make it an automated population to update rfg_1.

The problem is that the rfg_1 that's distributed with the updates differs SO much from the working rfg_1 that's found on phones. So even though I can fill in all the "details" it's not going to match what it probably "should" be... so there's definitely some process that I believe happens before sprint even receives the device to activate that populates rfg_1. They probably have a much different method for doing so, most likely some kind of program that has all the correct algorithms that generate all the correct info based on the device's ESN/MEID.

(This paragraph is informational, if you don't care to learn about it you can skip it)

A little more insight on the way this works though... NV is what stores much of the current activation information. It is a separate storage controller (Possibly ROM or RAM) but it's definitely separate from the emmc. Partition 19 is part of the EMMC, and is the radio_config. This is confusing because the two operate separately but also together on a lot of things... For example, the MSL is stored in rfg_1 (which is part of emmc p19) but also in NV. If I change the MSL via QPST or DFS, it changes it in NV, but not in the emmc p19(rfg_1) This is why when you do a activation after changing the MSL via DFS or QPST, it reverts to what's stored in emmc p19.(rfg_1) ##786# resets the NV. (and certain parts of 19)

Anyways... On to the not so confusing stuff... my first test run through, it reverted to 1.42_003, Sprint banner, Radio on. But hands free failed, no data. Tried QPST restore, DFS manually setting info... No luck anywhere. Phone would not activate, nor get a data signal at all...

Dug deeper and realized that the "secret" codes are also a part of rfg_1, and because they weren't there, the phone wouldn't talk to the tower properly because it didn't have it's "secret" handshake.

So, populated the secret codes, second time through, phone activated, data works. Looks like everything is good... Go to make a call... Error 16... :( Look at partition 19... Missing the phone number from it completely, even though activation worked and shows the proper info on the phone itself, it still doesn't have a number in the partition... So activation isn't quite working the way it should. (It populated NV, but not p19...) I'm looking at the partition now to see what else is missing from rfg_1 that I can find in here...

Anyways, I know that error 16 is fixable by Sprint. However, while I might be able to get sprint to fix error 16 and everything about the phone would work... if I was to reset via ##786# and re-hands-free it would break it again. So this is obviously not a good fix quite yet.

But definitely progress... I just have to spend more time with this partition. Basically what I'm doing now is using the current partition 19 to properly populate a working RFG_1 for the phone. Once I have that, I flash the "fixed" rfg_1, destroy partition 19 as it is, saving only what's necessary to save, reboot, re-activate, and drink beer.(Doing lots of the last step, as there's lots of time in between ;) )

It's just a long process of sifting through hex code that I have to figure out where it's supposed to go in the rfg_1 file, and where to read it from, from whatever information is actually available. As I said before, some people's phone do not have rfg_1 at all... it's vital to correct that first, without a working rfg_1, the fix will destroy the phone completely. And that's used if/when the phone needs to re-activate.

If anyone wants to try different methods to get rfg_1 to populate, I am definitely not opposed to people trying other methods, cause once I have a working rfg_1 and a way to populate it for all phones, it won't be far from release status.

In order to check your work, the offset where rfg_1 starts is 0x100000 inside partition 19. You'll have to first flash a blank one from one of the RUU releases. (rfg_1 is part of every official release, even though it's not used)

I can explain where to find MSL, MEID and other (very) important details that the phone needs for activation process. But unless you're very good with hex editing and have a knack for "reading" it, it won't make much sense at all.

For now, I'm going down the manual rfg_1 population road, as it seems to be coming together better than my last attempts at fixing this.

More to come.