[Android Q&A, Help & Troubleshooting] mrz_hun:
I have as Samsung Galaxy S3 LTE (i9305) device which I bought in Hungary from T-Mobile.

I have upgraded it's firmware via KIES to a stock KitKat 4.4.4 which was pushed to Polish users. (I got the FW from the Samsung Live Updates site).

It operates fine, and everything works, but I have noticed that the battery is draining a bit more than with the stock 4.3 which I had on it previously.

I rooted the ROM and checked the logcat to find out what might be the culprit. I have made not made (and don't intend to make) any illegal modification of any kind (haven't unlocked, changed IMEI etc.)

I have seen several logcat logs on the net and this does not seem to be constrained to Samsung Galaxy S3 LTE devices only.

While digging around the logcat I found some strange entries related to 'kickstart' and SAHARA protocol.

I see the following in my logcat which happens every 5,10,15 minutes (even when not connected via adb):

12-11 10:14:23.486 I/kickstart( 2512): EVENT: SENDING --> SAHARA_HELLO_RESPONSE
12-11 10:14:23.486 I/kickstart( 2512): EVENT: sahara_mode = 2
12-11 10:14:23.486 I/kickstart( 2512): EVENT: m_comm->sahara_hello_packet_rx.mode = 2
12-11 10:14:23.486 I/kickstart( 2512): EVENT: helloRx.mode = 2
12-11 10:14:23.486 I/kickstart( 2512): EVENT: RECEIVED <-- SAHARA_MEMORY_DEBUG
12-11 10:14:23.486 I/kickstart( 2512): EVENT: STATE <-- SAHARA_WAIT_MEMORY_TABLE
12-11 10:14:23.491 I/kickstart( 2512): EVENT: 0x46980000, len=000C0000, "m9kefs1", ""
12-11 10:14:23.491 I/kickstart( 2512): EVENT: STATE <-- SAHARA_WAIT_MEMORY_REGION
12-11 10:14:23.491 I/kickstart( 2512): EVENT: Saving "/dev/block/modem/dump_path/m9kefs1"
12-11 10:14:23.491 I/kickstart( 2512): EVENT: Before rx_data()
12-11 10:14:23.501 I/kickstart( 2512): EVENT: Received: 16384 bytes
12-11 10:14:23.501 I/kickstart( 2512): EVENT: Wrote 16384 of 16384 bytes
...
12-11 10:14:24.051 E/kickstart( 2512): Received file "m9kefs1"
12-11 10:14:24.056 E/kickstart( 2512): Sync finish Received file "m9kefs1"
12-11 10:14:24.056 E/kickstart( 2512): 786432 bytes transferred in 0.567s (1.32 MBps)
12-11 10:14:24.056 I/kickstart( 2512): EVENT: num_debug_entries not >=0
12-11 10:14:24.056 E/kickstart( 2512): Successfully downloaded files from target
12-11 10:14:24.061 I/kickstart( 2512): EVENT: RECEIVED <-- SAHARA_RESET_RESP
12-11 10:14:24.061 E/kickstart( 2512): Sahara protocol completed
12-11 10:14:24.061 I/kickstart( 2512): EVENT: STATE <-- SAHARA_WAIT_HELLO

This happens with m9kefs1 and m9kefs2 as well. The number of bytes transferred is always the same for both.

After some digging around I found that:

"kickstart" (2514) is "/system/bin/ks -m -v -w /dev/block/modem/dump_path/ -p /dev/ttyUSB0 -t -1 -l"

which is started by "/system/bin/efsks -p /dev/ttyUSB0 -w /dev/block/modem/dump_path/"

which is started by "/system/bin/qcks s" from init.smdk4x12.rc

It seems that QualComm (or someone) is trying to update my RIL FW over the air constantlY. SAHARA seems to be a protocol used by QualComm.

My questions:

Is it normal that my phone tries to update m9kefs1 and m9kefs2 this often?

Who and why is trying to flash my phone firmware (qualcomm, provider, samsung) ?

Does this have to do with me flashing a FW which was not pushed by my provider?

I killed ks and qcks processes and appears the phone appears to function properly.

(I can't easily remove them from init.smdk4x12.rc since it's mounted into memory only and gets overwritten from boot.img on every boot).

Any help would be appreciated.