yashsingh1/xdaforums huggingface dataset:
[Moto G Q&A, Help & Troubleshooting] xda7243:
Just wanted to throw in that I can try some commands out since I also ran fastboot erase all.

So far I've looked at hob, dhob and fsc. All are filled with zeroes of course. The only interesting thing I've found is that if I dd random data into the zeroed out hob partiton and reboot, the imei goes from 0 to unknown in the status menu (wifi also stops working). If I then dd it again with zeroes and reboot it's imei 0 again. Under fastboot it stays blank the whole time though.

Thanks for the work you guys are putting into this.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
I really want to send you my hob and dhob so you can try flashing it but the problem is that it contains my imei which is very personal. Thanks for your help though. :D

When you dd random data into hob it will change the imei to unknown because the hob partition contains encryption keys to decrypt dhob. Can you try dd'ing your imei into dhob and tell me what happens.

If that doesn't work I'll send you my encryption keys and try and encrypt your imei with it and put it in dhob. Then dd the encryption key used into hob. That might solve the entire problem :)

Please keep us updated, thanks for your help!
[Moto G Q&A, Help & Troubleshooting] xda7243:
Writing any data to dhob (or fsc) doesn't seem to change anything, I'm guessing since hob itself is empty.

Do you have a working imei in fastboot and android? If so and you want to send me those files with non-device-specific data removed I'd be glad to try them out. I'll also try encrypting my imei for dhob if you can show me how.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Thats the thing I don't know what part of the hob and dhob partitions contain the imei. Hob contains encryption keys and dhob contains a bunch of encrypted text I can't read. If I can figure this out our problem would be solved. Once the radio gets decompiled by [MENTION=5383643]bludotos[/MENTION] and once I take a look at the encryption methods used I can solve this problem.

---------- Post added at 01:35 AM ---------- Previous post was at 01:28 AM ----------

Can you extract and send me your blank hob and dhob partitions? I would like to inspect them.
[Moto G Q&A, Help & Troubleshooting] xda7243:
I would but in the hex editor they're just full of zeros the size of the partition, same as if I were to dd zeros into them. Nothing changes them after fastboot erase all unless I write to them manually.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Can you use a command to set the size of the partition. Hob is 512kb and dhob is 8kb

Once you do that try and dd the imei into dhob and put a bunch of zeros into hob.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Found something a bit interesting, look at the attachment. Why not try and replace all the "." with the real imei. Then flash it through fastboot. Are you willing to try that?
[Moto G Q&A, Help & Troubleshooting] xda7243:
The partitions are already the right size from the partition table and hob is already filled with zeros. I've put my plaintext imei in dhob but without knowing how it's encrypted, what format it's meant to be in or what other information is missing in the three partitions I doubt it's going to be read by anything.

Sure, which file is that?
[Moto G Q&A, Help & Troubleshooting] skyguy126:
That file is NON-HLOS.bin otherwise known as the radio. I used an ext4 unpacker and unpacked the file. That specific file is modem.b21 in the extracted NON-HLOS.bin

Use an ext_4 unpacker, search for modem.b21, do a search in HxD for "imei" and overwrite your imei there. Repack and flash the file through fastboot. Do this at your own risk... (But I doubt the radio would cause a brick...)

---------- Post added at 03:55 AM ---------- Previous post was at 03:28 AM ----------

So I want to gather up all my findings and create a new reply.

As many of you know /pds does not determine imei but it acts as sort of a bridge connecting the imei to the radio.

1. The imei is stored in dhob along with other data

2. dhob is encrypted which is why the nv write method does not work

3. The encryption keys that encrypt dhob are stored in hob

4. The radio mounts and unmounts hob and dhob on boot

5. hob and dhob are simple text files with no filesystem

6. The radio contains methods to decrypt dhob by using the encryption keys stored in hob.

7. These partitions are accessible to copy in TWRP filemanager or any other recovery.

8. Once the imei is loaded into memory hob and dhob are unmounted.

9. Fastboot erase all deletes hob, dhob and fsc (I don't know what this is used for)

10. To attack this problem we must force the radio to decrypt and mount dhob on boot so we can further examine it.

Anyone else feel free to help out with this thread.
[Moto G Q&A, Help & Troubleshooting] xda7243:
I'm attaching a 7zipped text file with the strings from modem.elf. It should be easier to read and provide some more info on the partitions (lots of references to dob and dhob, none I saw for fsc.)

After playing around with it a bit more, it seems the modem.bxx files have a checksum. Changing one bit stops the modem from loading completely. The phone still runs, but the imei becomes unknown and the wifi doesn't work (same behaviour as writing random data to hob).

If anyone is interested in going through the modem file in IDA, I was able to open it by following these steps:

Extract all the files from the NON-HLOS.BIN ext4 volume

Combine all the modem.bxx files into a modem.elf file using revskills extraction>images>android mdm9k radio reconstruct (create empty bxx files if it complains that they're missing)

install the hexagon ida module from github in IDA

Finally edit modem.elf in IDA with processor type set to qualcomm hexagon.

This stuff is over my head, but hopefully it will be useful to someone.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Any help..

Hi guys.. Although i am not new to this flashing stuff and changing roms!! but ya v. much new to this hob dhob and fsc partitions... i blew my devices with that erase all command.. If u want i can provide you with images and any stuff u want... and will flash whatever u want to.. as this tablet is of no use! except for pics! and ya my WIFI IS WORKING PROPERLY and Bluetooth too. So please tell me how to extract these partitions.. and ya how to read encrypted keys and all.....

May God help us all may god show us true path to destiny....

And save me from spending $100 :( :(

---------- Post added at 08:39 PM ---------- Previous post was at 08:34 PM ----------

I am an Indian too bro... and spending INR 6000 on MB!! Don't u think buying a new phone like android one is more worthy which comes for around INR 500 less, with same specs and expandable storage too!!
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Gonna take a look at this tonight for sure. Thanks!
[Moto G Q&A, Help & Troubleshooting] rootr:
Yeah definitely but i didn't like my phone being useless and lying around....and also moto g beats one any day.....
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Unfortunately I do not know how to do all of this stuff with compiling and extracting. Is there a way you can make a step by step guide on what I need to do to modify the code?

Edit: Found some really interesting things, there is an nv write method to write imei. The variable is called "NV_UE_IMEI_I" I think...

Will update when I make some more finds...

Can you find a way to read all the text strings from motoboot.img like how you did with the radio.

Can anyone, anyone at all try this command "fastboot setvar secure no" <--- Do this at your own risk.

If this works please tell me!!!
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Once we figure how to modify the radio I will surely ask you for help...
[Moto G Q&A, Help & Troubleshooting] hunterhere:
check this out if you can take something from this thread...

http://xdaforums.com/showthread.php?t=2166542

http://www.rimweb.in/forums/topic/3...rint-moto-x-any-moto-g-cdma-to-reliance-cdma/
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Command not supported SS attached :(
[Moto G Q&A, Help & Troubleshooting] xda7243:
I've been reading up some more on Qualcomm devices. According to a thread on gsmhosting where someone is trying to fix a different problem in modem.elf , all the bootloader files and at least the files in non-hlos.bin are cryptographically signed in a way that makes running modified versions of them next to impossible. If there is a solution to this IMEI problem I'd suggest we look at the three partitions that were erased and how they are accessed and modified by different binaries. Circumventing them seems to be a dead end.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Bro as u said u got ur MB changed on chargeable basis it means your warranty was void! May i know the reason for warranty void? I am asking this because in my case my warranty is not void due to unlocking the bootloader, the guy at the service center said "sir it will be done free of cost no charge if there is no hardware damage and tampering". It means either he don't know about this unlocking stuff or motorola in India is considering unlocked bootloader under warranty. So bro my query here is which point they stated to u in support of warranty void?
[Moto G Q&A, Help & Troubleshooting] rootr:
My earlier device was unlocked so it was out of warranty. But when they replaced it was locked again and they said my device now has additional 6 months of warranty. So its been like that since. BTW when I gave them my device they checked it up on their computer and said they cannot repair it under warranty and I have to pay for it as I had unlocked my device.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
So as u paid for the MB now u must be having 2 MB's one functional in device and other spare because paying means buying a new one without returning if i am not wrong. :)
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Gonna take a look at that tonight for sure...

Radio comm seems really, really complicated but it does have the NV write feature...

I might try it later if there are no other methods of modifying the imei.
[Moto G Q&A, Help & Troubleshooting] rootr:
They didn't give me my old MB back. Just fitted the new one.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
[MENTION=6122951]rootr[/MENTION]
[MENTION=6036514]skyguy126[/MENTION]

Bro there is thread on xda a developer suggested this file to me now after flashing the file the change is previously my both sim cards were showing imei as 0 by dialing *#06# now only first one is showing 0 and second one is showing NULL. It means we can edit these IMEI(S)...
[Moto G Q&A, Help & Troubleshooting] rootr:
I appreciate your effort but its still null....Even the guy above managed to change IMEI from 0 to unknown. But as skyguy said they are apparently encrypted. And in that case the only way to get back IMEI is to decrypt :/
[Moto G Q&A, Help & Troubleshooting] skyguy126:
We might not have to because the radio is already doing that for us... Let me take a look at this.

Do me a favor and ask whoever made the zip file how they managed to modify fsg.img?

Did some more research and I believe the bootloader, hob, and dhob are stored in a non volatile memory which is different than the emmc sdcard. This is why we need to be able to put the device into production mode of we want to mess with the boot loader. And when the radio gets decompiled we can take out the md5 checks so the radio will still boot. And then add one more line of code that writes the imei and the other information.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
And right now none of us know the way to put it in production mode!
[Moto G Q&A, Help & Troubleshooting] skyguy126:
I don't think writing the imei will be that difficult. Can someone explain how NV variables work to me because I don't know what they are as of yet. Those might solve our entire problem.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
OK I'll search some more threads and will let you know if i find something, i read a thread on unlocking the career the developer modified radio on nv ram. Gonna have a look at it today.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Just a guide on what nv variables are will do. I installed radiocomm and we might be able to write the imei using that.
[Moto G Q&A, Help & Troubleshooting] rootr:
They are configuration variables for Qualcomm boards. We usually access them in Qualcomm diagnostic mode. This mode is usually accessed by qcom engineers or at repair centers for editing board information directly. When I first started using diag mode I was almost sure I could fix the problem but unfortunately Motorola uses something else to access qcom boards unlike Samsung or Sony on which modifying board information is easier.

There are third party software which provide interface to read and write qcom board information but moto g is not supported by them at the moment
[Moto G Q&A, Help & Troubleshooting] skyguy126:
One question: is the imei part of these so called configuration variables on the board?

I am going to see if I can turn the secure flag off from fastboot get var all. This is similar to htc s-off.

---------- Post added at 07:22 AM ---------- Previous post was at 07:18 AM ----------

Can someone link me to the qpst tool?
[Moto G Q&A, Help & Troubleshooting] rootr:
Yup it is. And nv_550 is that variable. There are other variables, they hold radio information like power input signal amplification, radio band configuration that stuff. What bugs me is on other qcom devices nv_550 can be edited like in Samsung but on Moto g it shows variable not supported. But on my friends locked moto x I read nv_550 using DFS 3.0 tool and it showed its IMEI implying I guess nv_550 is supported on moto x but not on moto g. Motorola might have used something else for it or maybe its supported but write protected ( encrypted as in your case)

Sent from my XT1033
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Some times things are near us, but just keeps on revolving around... we all are in a same situation we are near destiny but lacking by just a point... May god help us!!

and ya i have also tried dfs tool it doesn't work on moto g due to encryption. All we need is the key to decrypt or to make this board DFS compatible.
[Moto G Q&A, Help & Troubleshooting] lost101:
I've assume you have already played around the the Xposed Module 'IMEI Changer,' but just in case:

http://xdaforums.com/xposed/modules/xposed-imei-changer-t2847187​
[Moto G Q&A, Help & Troubleshooting] skyguy126:
You might have just given us the answer... When you tried to read NV 550 did you already do fastboot erase all? I bet it is supported but since you did erase all that variable did not exist anymore thus giving you the unknown variable error.

For everyone else try and ask one of your friends to give you hob, dhob, and fsc partitions. Then use an nv write tool and change the imei to the one your phone should have. This might work. I'll try and create blank hob and dhob partitions for the rest of you guys. <------- that will be the most challenging part since they are encrypted.

---------- Post added at 05:50 PM ---------- Previous post was at 05:48 PM ----------

Can someone please link me to the qpst tool and the tool used for reading and writing nv?
[Moto G Q&A, Help & Troubleshooting] rootr:
Yep after i fastboot erased all. here's the link to qpst download. Make sure you have QCDiag driver installed and boot phone in BP Tools mode.

QPST Download
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Can you link me to the QCDiag and all the other drivers I might need as well?
[Moto G Q&A, Help & Troubleshooting] rootr:
Here you go for qcdiag drivers. First install drivers and then when you boot phone in BP Tools mode, device manager will show unknown device. Open its properties select manually choose and then in Ports it should be under Qualcomm. Remember to select Qualcomm QC Diag Driver.

QC Diag Drivers
[Moto G Q&A, Help & Troubleshooting] skyguy126:
I think I screwed up the driver installation. Can you please tell me step by step on what I need to do (maybe screenshots please).

Also where is the tool for reading and writing NV stuff.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Choose the highlighted download button and download driver, just run the setup file......

Edit: My moto g is showing my master (1st) imei in the barcode mode.. does it mean imei is there in the phone?
[Moto G Q&A, Help & Troubleshooting] hunterhere:
[MENTION=6122951]rootr[/MENTION]

Bro please help i have installed qpst and qc diag driver but this is what i m getting after booting my phone in BP tools mode, and the important thing is that i can't find any qc diag drivers in my pc!! SS attached.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Ok makes sense I downloaded the 64bit version. Let me try.

---------- Post added at 08:13 PM ---------- Previous post was at 08:08 PM ----------

Stuck again....

http://gyazo.com/883c32c0ff59d4441bba28b52526cd90

Thats what i see

When I click update driver software I don't see qualcomm under ports...
[Moto G Q&A, Help & Troubleshooting] hunterhere:
May god give u success this time.... I m attaching SS of my moto g.. U can see the difference between both the sim cards this difference came after flashing the modified fsg.img file. Hope it may help u....
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Same is the case with me... [MENTION=6122951]rootr[/MENTION] help us....
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Well pretty much here is my plan. If the NV write thing works I'm going to replace my imei with 0000000.... and so on. Same with the mac address. Then I will probally put hob, dhob, and fsc up for download and people who need it can flash it and use the NV method to write their imei.
[Moto G Q&A, Help & Troubleshooting] rootr:
Frrom this unknown drivers list select " Qualcomm QC Diag" interface. Then open its " properties" . Then " update driver " . Then click "I will manually choose drivers to install ". Then select "Ports" And then finally Qualcomm on left side. On right side it will display all qualcomm drivers then select Qualcomm Qc diagnostic driver. If Qualcomm is not there in drivers check for Motorola drivers, then select "Motorola QC Diag Port" on right hand side. :)

[IMG="QC Diag"]http://i.imgur.com/SlfRb4q.png[/IMG]
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Here are some screenshots: http://gyazo.com/85e050aa59ad9baceff727428677e5f4

http://gyazo.com/9d67059edc2b853719033cf1c7a4f6e1

Oh ya and if possible can you attach some screenshots to help as well [MENTION=6122951]rootr[/MENTION]

Ok I got that part working now how do I view and edit NV's
[Moto G Q&A, Help & Troubleshooting] hunterhere:
I think you are going right and you have got driver installed on com3.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Ok I was right about [MENTION=6122951]rootr[/MENTION] deleting the nv_550 variable because I found it on my phone. Now how do I edit this? Here is a screenshot: http://gyazo.com/4581212f0278eadbfee855d9c4803165
[Moto G Q&A, Help & Troubleshooting] hunterhere:
But how do we get to know wether this nv write thing is working or not and what about the radio, it also need to be modified to read new hob dhob and fsc (as i think)
[MENTION=6122951]rootr[/MENTION] as u have tested nv read method on motox (locked) can u please spare some time in testing your moto g as it is also locked. It will be a great help for all of us. Because i think if it can read it can write... Thank u
[Moto G Q&A, Help & Troubleshooting] rootr:
No it was displaying it for me too....but when you select this variable, it should its value in the eight fields on the right in hexadecimal. Is it doing that?
[Moto G Q&A, Help & Troubleshooting] rootr:
It doesnt matter if i check. skyguy is already doing that. And his IMEI is intact. if it works for him, then it works for all. :)
[Moto G Q&A, Help & Troubleshooting] skyguy126:
None of the NV's have anything in them... I think it's reading of the wrong port. It says COM1 in the box at the bottom. But in device manager it's showing up as COM3. Any idea on how to fix?
[Moto G Q&A, Help & Troubleshooting] hunterhere:
I didnt got ur point as the screen shot says u r going good and with this method we can write imei. Where have u stuck now?
[Moto G Q&A, Help & Troubleshooting] skyguy126:
When I do read from phone I get an error message. Those variables popped up when I clicked Read supported RF NV items.
[Moto G Q&A, Help & Troubleshooting] rootr:
First configure NV Manager which com port to use.It should be in some menu above. Then read variables.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
The com ports are blank.

Screenshot: http://gyazo.com/d6843614f36a0912d5af0bbae12f03e4

I dont have CDMA workshop installed either...

Any ideas on how to fix this?
[Moto G Q&A, Help & Troubleshooting] hunterhere:
I think it's time when you should check the read capability of nv ram on moto g as you have got right drivers installed on right com ports.

PS: do check your friends moto x and (post the SS if u can ) before u check urs to confirm nv is working and ports are correctly set. :)
[Moto G Q&A, Help & Troubleshooting] skyguy126:
The com isn't showing up in any of the qpst tools not just NV editor. I think its a problem with the drivers. Can you look up a guide or something on how to properly install them?
[Moto G Q&A, Help & Troubleshooting] joaoricardo.rm:
Compatibility

I don't have knowledge about this program, but I would say maybe you could run the drivers in Windows XP instead of 7. Cause of some compatibility issue maybe?
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Maybe, how do I do that? I know how to run exe files in compatability mode but not drivers.
[Moto G Q&A, Help & Troubleshooting] Tosgaba:
You should repeat bptools procedure to be recognised by qpst.

BTW i can test anything\anyway to achieve writing imei to our xt1032 :D
[Moto G Q&A, Help & Troubleshooting] skyguy126:
If your phone still has an intact imei, can you check if you can read the nv_550 variable in NV editor from qpst tools.

And maybe you can guide me on how to get qpst working with screenshots and stuff... :)
[Moto G Q&A, Help & Troubleshooting] rootr:
Sorry. Was night here. I missed on a lot. OK. I think the problem is with drivers. When I did it, I did using Qualcomm drivers and I thought Motorola would work. Even I don't have Qualcomm installed now. Give me some time I'll try to find drivers. Actually my final exams are going on and tomorrow is my exam so it will be better if you try getting help from other users. Mine might take a while but I will try my best :)

Sent from my XT1033
[Moto G Q&A, Help & Troubleshooting] joaoricardo.rm:
I meant run a XP virtual machine and install the thing on it. But will take double work, but looks like the Qualcomm driver is missing... I'll try to help find it too.

Unfortunately I take my phone to a repair store so I can't test.
[Moto G Q&A, Help & Troubleshooting] skyguy126:
No problem... Good luck with your exams!
[Moto G Q&A, Help & Troubleshooting] rootr:
It doesnt matter i did it in Windows 8.1 64 bit. Compatibility is not the problem. Its the drivers.
[Moto G Q&A, Help & Troubleshooting] hunterhere:
While installing drivers this i what i encountered "not intended for this platform" should i use xp now? Or some 32 or 64 bit problem it is? SS attached. I m on 8.1, 64 bit.
[Moto G Q&A, Help & Troubleshooting] rootr:
You need 64 bit drivers

Sent from my XT1033
[Moto G Q&A, Help & Troubleshooting] skyguy126:
Downloaded both 32 and64 bit drivers and qpst still doesn't recognize com3. Can you make a step by step guide with screenshots please. (Anyone who got qpst to work please help)
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Point the link to 64 bit drivers plz...
[Moto G Q&A, Help & Troubleshooting] rootr:
ok i uploaded my own drivers. These should definitely work. Please uninstall old drivers, restart and then install these.

Dropbox Link
[Moto G Q&A, Help & Troubleshooting] hunterhere:
Ok n best of luck for the exams :good: