[ONE General] (dylanger):
Hey Guys,

I've been doing some research and I've found quite a few interesting things with the modem for the OnePlus One, firstly I've found that the NON-HLOS.bin is actually a FAT file system that can be mounted, inside I've found the following files.

==========================================

-rwxr-xr-x. 1 root root 500 Apr 2 2015 adsp.b00

-rwxr-xr-x. 1 root root 488 Apr 2 2015 adsp.b01

-rwxr-xr-x. 1 root root 1 Apr 2 2015 adsp.b02

-rwxr-xr-x. 1 root root 5097872 Apr 2 2015 adsp.b03

-rwxr-xr-x. 1 root root 1332541 Apr 2 2015 adsp.b04

-rwxr-xr-x. 1 root root 1099162 Apr 2 2015 adsp.b05

-rwxr-xr-x. 1 root root 680 Apr 2 2015 adsp.b06

-rwxr-xr-x. 1 root root 936550 Apr 2 2015 adsp.b07

-rwxr-xr-x. 1 root root 120 Apr 2 2015 adsp.b08

-rwxr-xr-x. 1 root root 698928 Apr 2 2015 adsp.b09

-rwxr-xr-x. 1 root root 201008 Apr 2 2015 adsp.b10

-rwxr-xr-x. 1 root root 11700 Apr 2 2015 adsp.b11

-rwxr-xr-x. 1 root root 6105 Apr 2 2015 adsp.b12

-rwxr-xr-x. 1 root root 988 Apr 2 2015 adsp.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 cmnlib.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 cmnlib.b01

-rwxr-xr-x. 1 root root 111720 Apr 2 2015 cmnlib.b02

-rwxr-xr-x. 1 root root 4416 Apr 2 2015 cmnlib.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 cmnlib.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 isdbtmm.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 isdbtmm.b01

-rwxr-xr-x. 1 root root 24692 Apr 2 2015 isdbtmm.b02

-rwxr-xr-x. 1 root root 104 Apr 2 2015 isdbtmm.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 isdbtmm.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 keymaste.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 keymaste.b01

-rwxr-xr-x. 1 root root 18324 Apr 2 2015 keymaste.b02

-rwxr-xr-x. 1 root root 208 Apr 2 2015 keymaste.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 keymaste.mdt

-rwxr-xr-x. 1 root root 295824 Apr 2 2015 mba.b00

-rwxr-xr-x. 1 root root 84 Apr 2 2015 mba.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 mc_v2.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 mc_v2.b01

-rwxr-xr-x. 1 root root 131072 Apr 2 2015 mc_v2.b02

-rwxr-xr-x. 1 root root 12 Apr 2 2015 mc_v2.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 mc_v2.mdt

-rwxr-xr-x. 1 root root 916 Apr 2 2015 modem.b00

-rwxr-xr-x. 1 root root 904 Apr 2 2015 modem.b01

-rwxr-xr-x. 1 root root 4052 Apr 2 2015 modem.b02

-rwxr-xr-x. 1 root root 81920 Apr 2 2015 modem.b03

-rwxr-xr-x. 1 root root 177176 Apr 2 2015 modem.b06

-rwxr-xr-x. 1 root root 49500 Apr 2 2015 modem.b08

-rwxr-xr-x. 1 root root 48420 Apr 2 2015 modem.b09

-rwxr-xr-x. 1 root root 103384 Apr 2 2015 modem.b11

-rwxr-xr-x. 1 root root 110820 Apr 2 2015 modem.b12

-rwxr-xr-x. 1 root root 1590612 Apr 2 2015 modem.b13

-rwxr-xr-x. 1 root root 20748656 Apr 2 2015 modem.b14

-rwxr-xr-x. 1 root root 663520 Apr 2 2015 modem.b15

-rwxr-xr-x. 1 root root 139264 Apr 2 2015 modem.b16

-rwxr-xr-x. 1 root root 5376 Apr 2 2015 modem.b17

-rwxr-xr-x. 1 root root 8055360 Apr 2 2015 modem.b18

-rwxr-xr-x. 1 root root 3457568 Apr 2 2015 modem.b19

-rwxr-xr-x. 1 root root 73968 Apr 2 2015 modem.b22

-rwxr-xr-x. 1 root root 417451 Apr 2 2015 modem.b23

-rwxr-xr-x. 1 root root 5911268 Apr 2 2015 modem.b24

-rwxr-xr-x. 1 root root 953536 Apr 2 2015 modem.b25

-rwxr-xr-x. 1 root root 1820 Apr 2 2015 modem.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 playread.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 playread.b01

-rwxr-xr-x. 1 root root 134244 Apr 2 2015 playread.b02

-rwxr-xr-x. 1 root root 608 Apr 2 2015 playread.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 playread.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 tqs.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 tqs.b01

-rwxr-xr-x. 1 root root 786132 Apr 2 2015 tqs.b02

-rwxr-xr-x. 1 root root 159744 Apr 2 2015 tqs.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 tqs.mdt

-rwxr-xr-x. 1 root root 372 Apr 2 2015 wcnss.b00

-rwxr-xr-x. 1 root root 360 Apr 2 2015 wcnss.b01

-rwxr-xr-x. 1 root root 12596 Apr 2 2015 wcnss.b02

-rwxr-xr-x. 1 root root 61440 Apr 2 2015 wcnss.b04

-rwxr-xr-x. 1 root root 3084380 Apr 2 2015 wcnss.b06

-rwxr-xr-x. 1 root root 56 Apr 2 2015 wcnss.b07

-rwxr-xr-x. 1 root root 786432 Apr 2 2015 wcnss.b08

-rwxr-xr-x. 1 root root 41468 Apr 2 2015 wcnss.b09

-rwxr-xr-x. 1 root root 732 Apr 2 2015 wcnss.mdt

-rwxr-xr-x. 1 root root 180 Apr 2 2015 widevine.b00

-rwxr-xr-x. 1 root root 168 Apr 2 2015 widevine.b01

-rwxr-xr-x. 1 root root 156596 Apr 2 2015 widevine.b02

-rwxr-xr-x. 1 root root 908 Apr 2 2015 widevine.b03

-rwxr-xr-x. 1 root root 348 Apr 2 2015 widevine.mdt

==========================================

Running file on all of these files I receive:

adsp.b00: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), dynamically linked, interpreter *empty*, stripped

adsp.b01: data

adsp.b02: very short file (no magic)

adsp.b03: data

adsp.b04: data

adsp.b05: data

adsp.b06: PDP-11 UNIX/RT ldp

adsp.b07: data

adsp.b08: data

adsp.b09: data

adsp.b10: data

adsp.b11: data

adsp.b12: data

adsp.mdt: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), dynamically linked, interpreter *empty*, stripped

cmnlib.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

cmnlib.b01: data

cmnlib.b02: GeoSwath RDF

cmnlib.b03: data

cmnlib.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

isdbtmm.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

isdbtmm.b01: data

isdbtmm.b02: data

isdbtmm.b03: data

isdbtmm.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

keymaste.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

keymaste.b01: data

keymaste.b02: data

keymaste.b03: data

keymaste.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

mba.b00: data

mba.mdt: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), statically linked, corrupted section header size

mc_v2.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

mc_v2.b01: data

mc_v2.b02: data

mc_v2.b03: ASCII text, with no line terminators

mc_v2.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

modem.b00: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), statically linked, stripped

modem.b01: data

modem.b02: data

modem.b03: data

modem.b06: data

modem.b08: data

modem.b09: data

modem.b11: data

modem.b12: data

modem.b13: data

modem.b14: data

modem.b15: data

modem.b16: data

modem.b17: data

modem.b18: data

modem.b19: data

modem.b22: MMDF mailbox

modem.b23: data

modem.b24: data

modem.b25: data

modem.mdt: ELF 32-bit LSB executable, QUALCOMM DSP6, version 1 (SYSV), statically linked, stripped

playread.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

playread.b01: data

playread.b02: data

playread.b03: data

playread.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

tqs.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

tqs.b01: data

tqs.b02: data

tqs.b03: data

tqs.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

wcnss.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

wcnss.b01: data

wcnss.b02: data

wcnss.b04: data

wcnss.b06: data

wcnss.b07: data

wcnss.b08: data

wcnss.b09: data

wcnss.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

widevine.b00: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

widevine.b01: data

widevine.b02: data

widevine.b03: data

widevine.mdt: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped

==========================================

Now, I've been trying to discover how Qualcomm enforces things like NV write protection, so as an example I've used the IMEI number as its write protected.

Putting the phone into Qualcomm's DIAG mode and launching RF NV Manager, when I try and edit the IMEI Number and click "Write NV" I receive the following:

[IMG="NV Read Only Error"]https://onedefence.com/public/NV_ReadOnly.PNG[/IMG]

So from the above image I've found the name of the IMEI property is: NV_UE_IMEI_I

Running strings through the mounted NON-HLOS directory came up with the following:

----------------

modem.b18:	Read NV_UE_IMEI_I (%d) to NV failed.

modem.b18:	Write NV_UE_IMEI_I[0] (%d) to NV failed.

==========================================

Hmm, okay, modem.b18 looks to have strings referencing such action, looking at the header of this file I recieve the following:

==========================================

00000000 24 00 00 00 00 00 00 00 41 4d 53 53 00 00 00 00 |$.......AMSS....|

==========================================

After some googeling it looks like AMSS stands for Advanced Mobile Subscriber Software according to: http://www.acronymfinder.com/Advanced-Mobile-Subscriber-Software-(Qualcomm)-(AMSS).html

So this "modem.b18" file looks to be pretty interesting in terms of NV Protection, so I rna binwalk on the file and came up with the following:

==========================================

DECIMAL HEXADECIMAL DESCRIPTION

--------------------------------------------------------------------------------

15276 0x3BAC Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/mproc/smd/src/smd_dsm_mem

32076 0x7D4C Unix path: /node/core/cpu/latency/usec

40808 0x9F68 CRC32 polynomial table, little endian

44904 0xAF68 CRC32 polynomial table, big endian

118861 0x1D04D Unix path: /nv/item_files/modem/nas/roaming_policy_back

121432 0x1DA58 Unix path: /nvm/alpha/item_file/time/%s

124252 0x1E55C gzip compressed data, NULL date (1970-01-01 00:00:00)

127283 0x1F133 POSIX tar archive, owner user name: "_size", owner group name: "c"

269101 0x41B2D Neighborly text, "NeighborBmsk | wfwTcCfgInfo.shadowCellInShoBmsk) == 0) failed"

539266 0x83A82 Neighborly text, "neighbor cell CGI request(SIB1 decode)). max_num_rb_ca0=%d max_num_rb_ca1=%d num_rb_ca1=%d "

552073 0x86C89 Unix path: /modem/fw/lte/meas_ttl_ftl/src/lte_LL1_meas_ttl_ftl_main.c %u

553105 0x87091 Unix path: /modem/fw/lte/meas_ttl_ftl/src/lte_LL1_meas_ttl_ftl_ncell.c %u

928051 0xE2933 Certificate in DER format (x509 v3), header length: 4, sequence length: 2360

928298 0xE2A2A Certificate in DER format (x509 v3), header length: 4, sequence length: 2410

928324 0xE2A44 Certificate in DER format (x509 v3), header length: 4, sequence length: 2465

928402 0xE2A92 Certificate in DER format (x509 v3), header length: 4, sequence length: 2516

1618849 0x18B3A1 Unix path: /nv/item_files/conf/mcpm.conf

1619065 0x18B479 Unix path: /nv/item_files/modem/utils/mcpm/mcpm_nv_pwrdbg_cfg

1619159 0x18B4D7 Unix path: /nv/item_files/modem/utils/mcpm/mcpm_nv_cfg_src

1624136 0x18C848 Unix path: /node/mcpm/vdd/mss

1642544 0x191030 Unix path: /nv/item_files/modem/utils/mcpm/ut_results.txt

1656085 0x194515 Unix path: /nv/item_files/CoreCpu/CoreAll/Startup/Algorithm.txt datalen %d

1660936 0x195808 Unix path: /nv/item_files/modem/utils/mcpm/mcpm_ut_efs_scenario.txt

1674069 0x198B55 Unix path: /nv/item_files/modem/utils/a2/a2_pc

1679019 0x199EAB Unix path: /nv/item_files/conf/lte_a2.conf

1682872 0x19ADB8 Unix path: /nv/item_files/modem/utils/a2/enable_zuc_debug

1684052 0x19B254 Unix path: /nv/item_files/modem/utils/cfm/cfm_cpu_monitor_cfg

2086962 0x1FD832 Unix path: /nv/item_files/modem/nas/csg_support_configuration

2103480 0x2018B8 CRC32 polynomial table, little endian

2136200 0x209888 Unix path: /nv/item_files/modem/mmode/sms_only

2139448 0x20A538 Unix path: /nv/item_files/modem/mmode/sms_only

2139484 0x20A55C Unix path: /nv/item_files/modem/mmode/ue_usage_setting

2139528 0x20A588 Unix path: /nv/item_files/modem/mmode/voice_domain_pref

2139573 0x20A5B5 Unix path: /nv/item_files/modem/mmode/sms_domain_pref

2139616 0x20A5E0 Unix path: /nv/item_files/modem/mmode/lte_disable_duration

2139664 0x20A610 Unix path: /nv/item_files/modem/mmode/n_min_MO_call_soft_retry

2139716 0x20A644 Unix path: /nv/item_files/modem/mmode/n_maxSIB8

2139753 0x20A669 Unix path: /nv/item_files/modem/mmode/sms_mandatory

2139794 0x20A692 Unix path: /nv/item_files/modem/mmode/lte_bandpref

2139834 0x20A6BA Unix path: /nv/item_files/modem/mmode/tds_bandpref

2139874 0x20A6E2 Unix path: /nv/item_files/modem/mmode/device_mode

2139913 0x20A709 Unix path: /nv/item_files/mcs/mtf/cp_mutex_tracking_enabled

2139962 0x20A73A Unix path: /nv/item_files/modem/mmode/sd/loc_base_bsr_mcc_list

2140014 0x20A76E Unix path: /nv/item_files/modem/mmode/supplement_service_domain_pref

2140072 0x20A7A8 Unix path: /nv/item_files/modem/mmode/sms_over_s102

2140113 0x20A7D1 Unix path: /nv/item_files/modem/mmode/operator_name

2140154 0x20A7FA Unix path: /nv/item_files/modem/mmode/qmss_enabled

2140194 0x20A822 Unix path: /nv/item_files/modem/mmode/sd/1xcsfb_ecbm_status

2140243 0x20A853 Unix path: /nv/item_files/modem/mmode/get_net_auto_mode

2140288 0x20A880 Unix path: /nv/item_files/modem/mmode/custom_emerg_info

2140333 0x20A8AD Unix path: /nv/item_files/modem/mmode/manufacturer_name

2140378 0x20A8DA Unix path: /nv/item_files/modem/mmode/manufacturer_code

2140423 0x20A907 Unix path: /nv/item_files/modem/mmode/device_model

2140463 0x20A92F Unix path: /nv/item_files/modem/mmode/sw_version

2140501 0x20A955 Unix path: /nv/item_files/modem/mmode/cu_imsi

2140536 0x20A978 Unix path: /nv/item_files/modem/mmode/cmcc_imsi

2140573 0x20A99D Unix path: /nv/item_files/modem/mmode/imsi_mcc

2140609 0x20A9C1 Unix path: /nv/item_files/modem/mmode/imsi_min1

2140646 0x20A9E6 Unix path: /nv/item_files/modem/mmode/imsi_min2

2140683 0x20AA0B Unix path: /nv/item_files/modem/mmode/imsi_11_12

2140721 0x20AA31 Unix path: /nv/item_files/modem/mmode/reg_status

2140759 0x20AA57 Unix path: /nv/item_files/modem/mmode/mid_call_srvcc_info

2140806 0x20AA86 Unix path: /nv/item_files/modem/mmode/lte_do_irat_duration

2140854 0x20AAB6 Unix path: /nv/item_files/modem/mmode/volte_sr_control

2140898 0x20AAE2 Unix path: /nv/item_files/modem/mmode/extend_lte_disable_duration

2140953 0x20AB19 Unix path: /nv/item_files/modem/mmode/sd/manual_search_in_wrlf

2141005 0x20AB4D Unix path: /nv/item_files/modem/mmode/sd/1xcsfb_call_end_opt

2141055 0x20AB7F Unix path: /nv/item_files/modem/mmode/sd/buffer_int_srv_lost

2141105 0x20ABB1 Unix path: /nv/item_files/modem/mmode/scan_scope_rule

2141205 0x20AC15 Unix path: /nv/item_files/modem/mmode

2162755 0x210043 Neighborly text, "neighboring_cell_infoterface"

2163056 0x210170 Unix path: /nv/item_files/modem/mmode/tui/csg_search_sel_config

2172948 0x212814 Unix path: /nv/item_files/modem/mmode/qmi/tib_timer

2280344 0x22CB98 Unix path: /nv/item_files/modem/mmode/sd

2280645 0x22CCC5 Unix path: /nv/item_files/modem/mmode/sd/sdssscr_timers

2296124 0x23093C Unix path: /nv/item_files/modem/nas/exclude_old_lai_type_field

2302296 0x232158 Unix path: /nvm/alpha/modem/nas/lte_nas_eps_loci_Subscription01

2304028 0x23281C Unix path: /nv/item_files/modem/nas/geran_cap

2304063 0x23283F Unix path: /nv/item_files/modem/nas/lte_nas_lsti_config

2304108 0x23286C Unix path: /nv/item_files/modem/nas/lte_nas_ue_sec_capability

2304159 0x23289F Unix path: /nv/item_files/modem/nas/lte_nas_temp_fplmn_backoff_time

2304216 0x2328D8 Unix path: /nv/item_files/modem/nas/drx_cn_coeff_s1

2304257 0x232901 Unix path: /nv/item_files/modem/nas/exclude_ptmsi_type_field

2304307 0x232933 Unix path: /nv/item_files/modem/nas/exclude_old_lai_type_field

2304359 0x232967 Unix path: /nv/item_files/modem/nas/nas_lai_change_force_lau_for_emergency

2304423 0x2329A7 Unix path: /nv/item_files/modem/nas/nas_srvcc_support

2304466 0x2329D2 Unix path: /nv/item_files/modem/nas/mobility_management_for_voims_feature

2304529 0x232A11 Unix path: /nv/item_files/modem/nas/nas_config_feature

2304573 0x232A3D Unix path: /nv/item_files/modem/nas/aggression_management

2304620 0x232A6C Unix path: /nv/item_files/modem/nas/csg_support_configuration

2304671 0x232A9F Unix path: /nv/item_files/modem/nas/nas_l2g_srvcc_support

2304718 0x232ACE Unix path: /nv/item_files/modem/nas/tighter_capability

2304762 0x232AFA Unix path: /nv/item_files/modem/nas/nas_nv_classmark_ie

2304807 0x232B27 Unix path: /nv/item_files/modem/nas/sglte_nas_nv_config

2304852 0x232B54 Unix path: /nv/item_files/modem/nas/mm_backoff_remaining_info

2304903 0x232B87 Unix path: /nv/item_files/modem/nas/mm_backoff_remaining_info_subscription01

2304969 0x232BC9 Unix path: /nv/item_files/modem/nas/gmm_drx_cn_coeff_s1

2305014 0x232BF6 Unix path: /nv/item_files/modem/nas/isr

2305043 0x232C13 Unix path: /nv/item_files/modem/nas/emm_combined_proc

2305086 0x232C3E Unix path: /nv/item_files/modem/nas/avoid_guti_nas_security_check

2305141 0x232C75 Unix path: /nv/item_files/modem/nas/is_accepted_on_lte

2305186 0x232CA2 Unix path: /nv/item_files/conf/nas_mm.conf

2318399 0x23603F Unix path: /nv/item_files/modem/nas/gmm_drx_cn_coeff_s1

2329012 0x2389B4 Unix path: /nvm/alpha/modem/nas/lte_nas_emm_eps_native_context_Subscription01

2368472 0x2423D8 Unix path: /nv/item_files/modem/data/3gpp/global_throttling

2371696 0x243070 Unix path: /nv/item_files/modem/nas/vpmln_Subscription01

2379116 0x244D6C Unix path: /nv/item_files/modem/nas/ignore_uplmn

2379154 0x244D92 Unix path: /nv/item_files/modem/nas/imsi_switch

2379191 0x244DB7 Unix path: /nv/item_files/modem/nas/ehplmn

2379223 0x244DD7 Unix path: /nv/item_files/modem/nas/ehplmn_Subscription01

2379270 0x244E06 Unix path: /nv/item_files/modem/nas/ehplmn_Subscription02

2379317 0x244E35 Unix path: /nv/item_files/modem/nas/efrplmnsi_select_rplmn_after_hplmn

2379377 0x244E71 Unix path: /nv/item_files/modem/nas/forced_irat

2379414 0x244E96 Unix path: /nv/item_files/modem/nas/tdscdma_op_plmn_list

2379460 0x244EC4 Unix path: /nv/item_files/modem/nas/max_validate_sim_counter

2379510 0x244EF6 Unix path: /nv/item_files/modem/nas/t3245_timer

2379547 0x244F1B Unix path: /nv/item_files/modem/nas/t3245_timer_test

2379589 0x244F45 Unix path: /nv/item_files/modem/nas/efnas_config

2379627 0x244F6B Unix path: /nv/item_files/modem/nas/lpm_power_off

2379666 0x244F92 Unix path: /nv/item_files/modem/nas/reg_nv_items

2379704 0x244FB8 Unix path: /nv/item_files/modem/nas/vplmn

2379735 0x244FD7 Unix path: /nv/item_files/modem/nas/vpmln_Subscription01

2379781 0x245005 Unix path: /nv/item_files/modem/nas/ota_plmn_list

2379820 0x24502C Unix path: /nv/item_files/modem/nas/ota_plmn_list_Subscription01

2379874 0x245062 Unix path: /nv/item_files/modem/nas/ota_plmn_list_Subscription02

2379928 0x245098 Unix path: /nv/item_files/modem/nas/max_validate_sim_counter_Subscription01

2379993 0x2450D9 Unix path: /nv/item_files/modem/nas/max_validate_sim_counter_Subscription02

2380058 0x24511A Unix path: /nv/item_files/modem/nas/t3245_timer_Subscription01

2380110 0x24514E Unix path: /nv/item_files/modem/nas/t3245_timer_Subscription02

2380162 0x245182 Unix path: /nv/item_files/modem/nas/t3245_timer_test_Subscription01

2380219 0x2451BB Unix path: /nv/item_files/modem/nas/t3245_timer_test_Subscription02

2380276 0x2451F4 Unix path: /nv/item_files/modem/nas/efnas_config_Subscription02

2380329 0x245229 Unix path: /nv/item_files/modem/nas/efnas_config_Subscription01

2380382 0x24525E Unix path: /nv/item_files/modem/nas/ehplmn_Subscription03

2380429 0x24528D Unix path: /nv/item_files/modem/nas/ehplmn_Subscription04

2380476 0x2452BC Unix path: /nv/item_files/modem/nas/ehplmn_Subscription05

2380524 0x2452EC Unix path: /nv/item_files/conf/reg.conf

2388768 0x247320 Unix path: /nv/item_files/data/3gpp/ds_3gpp_multi_pdn_same_apn

2398084 0x249784 Unix path: /nv/item_files/modem/nas/roaming_policy_manager

2399600 0x249D70 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_phone_events.c

2400952 0x24A2B8 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_rat_capability.c

2402691 0x24A983 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_serving_system.c

2403391 0x24AC3F Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_set.c

2403796 0x24ADD4 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_sglte.c

2405068 0x24B2CC Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_timer.c

2405649 0x24B511 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_uim.c

2406472 0x24B848 XML document, version: "1.0"

2409544 0x24C448 XML document, version: "1.0"

2412177 0x24CE91 XML document, version: "1.0"

2414817 0x24D8E1 XML document, version: "1.0"

2428426 0x250E0A XML document, version: "1.0"

2445983 0x25529F XML document, version: "1.0"

2454264 0x2572F8 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_call_events.c

2454672 0x257490 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/mmcp/policyman/src/policyman_lang.c

2477930 0x25CF6A Unix path: /nv/item_files/modem/sms/mo_on_data_channel

2477974 0x25CF96 Unix path: /nv/item_files/modem/sms/enable_fdn_control

2478018 0x25CFC2 Unix path: /nv/item_files/modem/sms/store_to_sim_if_nv_full

2478067 0x25CFF3 Unix path: /nv/item_files/ims/qipcall_1xsmsandvoice

2478108 0x25D01C Unix path: /nv/item_files/modem/sms/telecom_smsp_fallback

2478155 0x25D04B Unix path: /nv/item_files/modem/sms/sms_rety_limit

2478195 0x25D073 Unix path: /nv/item_files/modem/sms/disable_lte_cb_dup_detection

2478249 0x25D0A9 Unix path: /nv/item_files/modem/sms/disable_pres_bc_alert

2478296 0x25D0D8 Unix path: /nv/item_files/modem/sms/cs_domain_fallback

2479896 0x25D718 Unix path: /nv/item_files/conf/wms.conf

2520837 0x267705 Unix path: /nv/item_files/cdma/1xcp/so73_cop0_supported

2522992 0x267F70 Unix path: /nv/item_files/conf/mc.conf

2577576 0x2754A8 Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/1x/mux/src/txccommon.c

2580976 0x2761F0 Unix path: /nv/item_files/modem/1x/device_only_dtx_params

2600608 0x27AEA0 Unix path: /nv/item_files/modem/1x/zz2_2_thresh

2609179 0x27D01B Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00216-M8974AAAAANAZM-1.8590.1_20141109_222100/b/modem_proc/1x/srch/src/common/srch

2643620 0x2856A4 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00216-M8974AAAAANAZM-1.8590.1_20141109_222100/b/modem_proc/1x/srch/src/irat/srch_1

3043613 0x2E711D Minix filesystem, V1, big endian, 15872 zones

4343588 0x424724 Unix path: /core/buses/icb/arb

4371547 0x42B45B Unix path: /work/home/jenkins/Daily_14001_env_pvt/MODEM/MSM8974.LA.4.0.2/msm8974/modem_proc/core/kernel/dlpager/src/dlpager_main.c:108 ret

4373870 0x42BD6E Unix path: /dev/core/mproc/ipc_router

4377059 0x42C9E3 Unix path: /node/core/cpu/bus

4382947 0x42E0E3 Unix path: /nv/item_files/therm_monitor/config.ini

4388268 0x42F5AC Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/crypto/environm

4388848 0x42F7F0 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/crypto/shared/s

4390088 0x42FCC8 SHA256 hash constants, little endian

4390952 0x430028 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/crypto/shared/s

4412692 0x435514 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/crypto/shared/s

4420004 0x4371A4 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/sfs/shared/src/

4423696 0x438010 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/sfs/shared/src/

4425522 0x438732 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/smecom/ixutil/e

4426560 0x438B40 Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00194-M8974AAAAANAZM-1_20140922_114854/b/modem_proc/core/securemsm/x509/shared/src

4438825 0x43BB29 Unix path: /nv/item_files/clock/clock_mss.ini

4457591 0x440477 Unix path: /node/core/bus/uart/pnocclk

4639460 0x46CAE4 Unix path: /nv/item_files/wcdma/l1/srch/wl1_srch_e1d_nv

4642188 0x46D58C Unix path: /nv/item_files/conf/wl1_srch_e1d_nv.conf

4648100 0x46ECA4 Unix path: /nv/item_files/wcdma/idle/w_idle_mode_opt

4660952 0x471ED8 Unix path: /nv/item_files/wcdma/l1utils/wl1_dsr_mode

4661972 0x4722D4 Unix path: /nv/item_files/wcdma/irat/wl1_atuner_config

4695666 0x47A672 Unix path: /nv/item_files/wcdma/rxd/wl1_rxd_rscp_thresh

4699576 0x47B5B8 Unix path: /nv/item_files/conf/wl1_rxd.conf

4727852 0x48242C Unix path: /local/mnt/workspace/CRMBuilds/MPSS.DI.3.0.c6-00241-M8974AAAAANAZM-1_20150120_025837/b/modem_proc/wcdma/l1/offline/src/mcalwcdma

4736620 0x48466C Unix path: /nv/item_files/wcdma/fet/wl1_fet_control

4739552 0x4851E0 Unix path: /nv/item_files/wcdma/cme/wcdma_cme_opts

4741766 0x485A86 Unix path: /nv/item_files/conf/wl1_cme.conf

---------------- SNIP TOO LONG ----------------

If anyone's interested I'll update the whole output

Cheers Guys :)