[Moto X Q&A] samwathegreat:
OK, I received the requested EFS backups, and I have bad news.

There was a question as to whether or not EFS was encrypted (see this post: http://xdaforums.com/showpost.php?p=53703806&postcount=177 ) but it definitely appears to be encrypted.

Upon analyzing the files, Here are my findings:

First, the first 16 bytes of both modemst1 and modemst2 are IDENTICAL for each unique phone. Not a single other byte matches between either of the EFS files from each unique phone. When I found the matching first 16 bytes (analyzing my own EFS partition), this is what led me to believe that I might have found the key - I thought perhaps a header was being used that set the SIM-LOCK status. This is definitely not correct, however.

Second, Comparing EFS files from the different phones results in NOT A SINGLE BYTE being identical. :confused:

Third, subsequent EFS backups (from the SAME phone) result in completely different data (not a single matching byte, EXCEPT for the first 16 bytes in each of the modemst1 and modemst2 partitions). EFS therefore seems completely randomized EXCEPT for the first 16 bytes which appear to be unique to EACH phone.

Unfortunately, playing with EFS is not going to get us anywhere :(

DON'T WORRY YET! I have another idea. AFAIK, the EFS partitions (encrypted file system) store the data located in NVRAM.

Fortunately, this means we have another option, but we are going to have to start all over. I believe that there is one or more NVITEMS that are responsible for the SIM-Unlock. This makes sense, because if EFS contains the encrypted contents of NVRAM, we should be able to read the raw NVITEMS, and do a similar comparision.

This also explains why erasing the modemst partitions (and hence resetting all NVITEMS to factory defaults) results in the SIM-LOCK being re-applied.

Here is what we need to do now.....

I will need [MENTION=5298002]yefonme[/MENTION] AND at least 2 other members (with SIM-Locked XT1056) to go to this thread:

http://xdaforums.com/moto-x/general/guide-flash-sprint-moto-x-to-page-plus-t2732342

and follow instructions 4 through 8 (DO NOT DO ANY OTHER STEPS!!!) (OR SKIP THESE STEPS AND USE CDMA WORKSHOP INSTEAD TO READ NVITEMS)

Try to use the NV tab and/or the EFS tab to read NV & EFS data.

(MAKE SURE YOU HAVE BACKED UP YOUR MODEMST1 and MODEMST2 partitions FIRST, just in case something goes wrong - you can restore them from custom recovery)

We will compare the NV items to try and see which NVITEM is responsible for the SIM-LOCK.

Be very careful. I don't have complete instructions on how to read the NVITEMS because I do not own a Sprint XT1056 -- I own the RW XT1056 which is why I need the data from individuals with Sprint variants. You MAY need to temporarily change RUIM config to "NV ONLY" in order to read the NVRAM data. Remember to switch back to the original setting or the phone may not function properly.

EDIT: It may be necessary to perform step 17 as well.

I will try to provide you with more detailed instructions when I have a bit more time. Unfortunately I'm out of time for now and will have to continue working on this later (perhaps this evening...).

Just be absolutely sure to be very careful and NOT change any values or write to the phone. I will not be responsible for anyone bricking their phone...