yashsingh1/xdaforums huggingface dataset:
[ZTE Axon 7 Guides, News, & Discussion] Velrix:
Ya, the issue you will face here is TWRP overwriting the original backup image with the second blob. The only fix is going to be finding the location of the IMEI inside that initial file and doing a manual change possibly without it being something the backup files would replace naturally. The problem here is the legality, while you are replacing the IMEI with the one original to the phone something like this being published would/could be used maliciously as well.

Has any of the users affected by this tried to roll back to a completely stock phone, removing TWRP?
[ZTE Axon 7 Guides, News, & Discussion] Controllerboy:
I am sadly affected by this mishap on an otherwise brilliant phone.

I have not tried this. I have re-flashed completely to stock, but didn't relock my BL and/or remove TWRP. I do not know a lot about these matters, but tbh I don't see why that would help us, flashing the stock recovery back would only change the recovery partition, amirite?

Here's a thankful plea from an affected user. Please share a valid EFS partition backup with [MENTION=7890973]tennear[/MENTION], [MENTION=6054963]Tebor[/MENTION], [MENTION=5672995]jcadduono[/MENTION] or myself. We are NOT going to mess around with your IMEI or other data, we just want to try to help out ourselves and provide a future reference for people who happen to be in the same situation. THANK YOU. ETERNAL RESPECT.
[ZTE Axon 7 Guides, News, & Discussion] celoxocis:
This is weird. I never run across this issue?

Are maybe only A2017G affected?

I'm still on Tenfar's TWRP and due to habits I always creat a full backup. Meaning I included the EFS partitions.

While working on my own Axon-7 CM bring-up I have probably flashed my CM (while working on my bring-up) and restored those affected partitions like 20x times and never experienced above problems.

I'm on B29 stock. I just went into about phone to see if my IMEI's are listed. Everything is fine.
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
I extracted my efs partitions to the sd card. Appears there are 5 blocks that make up the sdf block devices.

oot@ailsa_ii:/sdcard # dd if=/dev/block/sdf1 of=/sdcard/efs1.img bs=4096
dd if=/dev/block/sdf1 of=/sdcard/efs1.img bs=4096
512+0 records in
512+0 records out
2097152 bytes transferred in 0.015 secs (139810133 bytes/sec)
root@ailsa_ii:/sdcard # dd if=/dev/block/sdf2 of=/sdcard/efs2.img bs=4096
dd if=/dev/block/sdf2 of=/sdcard/efs2.img bs=4096
512+0 records in
512+0 records out
2097152 bytes transferred in 0.007 secs (299593142 bytes/sec)
root@ailsa_ii:/sdcard # dd if=/dev/block/sdf3 of=/sdcard/efs3.img bs=4096
dd if=/dev/block/sdf3 of=/sdcard/efs3.img bs=4096
1+0 records in
1+0 records out
4096 bytes transferred in 0.008 secs (512000 bytes/sec)
root@ailsa_ii:/sdcard # dd if=/dev/block/sdf4 of=/sdcard/efs4.img bs=4096
dd if=/dev/block/sdf4 of=/sdcard/efs4.img bs=4096
128+0 records in
128+0 records out
524288 bytes transferred in 0.008 secs (65536000 bytes/sec)
root@ailsa_ii:/sdcard # dd if=/dev/block/sdf of=/sdcard/efs.img bs=4096
dd if=/dev/block/sdf of=/sdcard/efs.img bs=4096
10240+0 records in
10240+0 records out
41943040 bytes transferred in 0.212 secs (197844528 bytes/sec)

Appears efs3 and efs4 are blank inside (just 00's). Efs, efs1, efs2 do contain data. Search all of them using a hex editor for either of the two imei's resulted in nothing. From past flashing, I know these are sometimes stored in a backward manner. Tried searching for that too with no luck. My guess is if the imei is stored in one of these files, it's in an encrypted manner.

Hash checksums for my files are below:

File: efs4.img
CRC-32: 95d0e631
MD4: 06be904db85f2f54e2cfe3ed65c11311
MD5: 06f49b34524d523cbd925c2fa6fa27bf
SHA-1: 7da5cedafe502f32a68ee9fb7a98433e71c2cf13

File: efs3.img
CRC-32: 9adc2b3a
MD4: 4075c3bfd61127e287dbb5c92a7e04fb
MD5: 778800e21d5e0d70ae337c730b2d5e18
SHA-1: 1ac72bb3eadcfa8af694ace9ebe096f97524424b

File: efs2.img
CRC-32: eecb36a2
MD4: 7d2f020ce6e3f1fcc8f2510fc60b5956
MD5: a009e1cf60afdb6e03b3cb65a5695e95
SHA-1: 76f9d21c1ef95983ff68c1ea8c771909b743fd7e

File: efs1.img
CRC-32: 518ab8df
MD4: e26a4c53061102537a868826e56e22e2
MD5: 913ac8e53227eb6eadbaf0054c2e9092
SHA-1: e9be6f2cd08e7a0fe2a7326920a920aefd064cb8

File: efs.img
CRC-32: 7603f894
MD4: 105bbc7d6d3d082c38d7bc25a7a3c02e
MD5: 3b89d12ee514bbaa4dae27fd180237c3
SHA-1: d8d260b860781c5da48f70c98c42c2c49d8f94f6
[ZTE Axon 7 Guides, News, & Discussion] Velrix:
I really hope I you didn't think I was implying anyone here needing this fix would be acting maliciously. I am just saying people could use it as so.

To answer your question, flashing recovery wouldn't fix that exactly, I mean getting a completely stock full image of the nand and re-flashing it.
[ZTE Axon 7 Guides, News, & Discussion] Loader009:
Well, /dev/block/sdf is a device and sdf1, sdf2 etc. are partitions of that device.

If you backup the device itself, you backup all partitions within that device.

I don't know what sdf3 & sdf4 are but it appears that they are not important (as you have already stated).

There should be no need to backup the whole device but it doesn't hurt.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
No, the issue is definitely present. You can examine your recovery.log in your backup directory to see for yourself. You should have a file named efs1.emmc.win that is 2mb and the text that I showed in the recovery.log file.

If you have restored your EFS data and you still have functional data and IMEI, consider yourself lucky. I honestly don't know how that would be possible.
[ZTE Axon 7 Guides, News, & Discussion] Loader009:
Someone in this forum said that turning off the phone, switch the SIM to the other SIM-slot, turn on and then do it otherwise again might help...

But I am not affected, so I cannot test this.
[ZTE Axon 7 Guides, News, & Discussion] celoxocis:
I've just double checked in the log.

I must have at some point in time been lucky to have switched to UDev's TWRP after having unlocked the bootloader.

As it reads:

ro.build.host=overrated
ro.build.tags=test-keys
ro.build.type=eng
ro.build.user=unjust

I doubt Tenfar's would have those flags.

I remember the subpartion restore being a bug that was fixed by TWRP. So Tenfar's build probably never included that fix. That warning should be posted in the thread he created too.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
[MENTION=2179192]gpz1100[/MENTION] the /dev/sdf "disk" contains 5 partitions:

sdf1 = modemst1 -> EFS data

sdf2 = modemst2 -> EFS data

sdf3 = fsc -> Unused?

sdf4 = ztecfg -> ZTE specific config stuff for stock ROM, unused in CM.

sdf5 = persist -> ext4 filesystem mounted as /persist, some device specific configs etc.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
Update: I have one good backup of the EFS partitions from a G user. I'd like to get another to compare.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
I have tried:

restoring stock recovery

flashing stock B02, B03, B05, B06 and B08

Flashing the small incremental updates

Flashing DrakenFX's twrp updates and bootstacks

I have swapped recoveries so many times, I can use tennear's tool with my eyes closed :p

Hell I've even tried flashing the U version firmware. (Nice boot animation by the way. Heaps better than the G version with the pictures :good:)

None of the factory firmware made any difference. Im guessing that none of the factory firmware makes changes to EFS related items

[MENTION=7890973]tennear[/MENTION], have you had a chance to look into how this little program works --> http://en.miui.com/thread-271552-1-1.html

I can restore my imei numbers with it but it still wont connect to cellular. Funny thing is, when I restore my own numbers, enter my sim pin after rebooting, my carrier logo appears with full signal minus the 4G icon but I cannot make calls. It then proceeds cycle between my carrier and emergency calls only.

All this flashing and wiping has kind of shown me how good the Axon 7 is. I haven't had a single error nor bootlooped. It just takes everything and always boots up.
[ZTE Axon 7 Guides, News, & Discussion] xtermmin:
Any idea what versions of TWRP this affects?

I know the first unofficial build (3.0.2-0) had an EFS issue, so Udev backported a fix and released a new unofficial build, 3.0.2-2.

Official TWRP build is 3.0.2-0, but I asked in the topic about the EFS bug and he said that the fix was included already.
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
So if sdf1/f2 is modemst1/2 which should get regenerated if wiped, then that means imei info isn't stored there. This suggests something else is getting wiped and/or corrupted. Perhaps if the source for these earlier twrp editions can be examined, it can be determined why this is happening.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
[MENTION=6054963]Tebor[/MENTION] no I haven't seen that tool. I would appreciate if you could get me a wireshark dump of the tool writing the IMEI.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
[MENTION=2179192]gpz1100[/MENTION] I'm not sure that modemst1/2 actually should get regenerated if wiped. I am not familiar with EFS on that level -- I've never wiped EFS on a phone before.

It is possible that the IMEI is stored elsewhere, but failure to read a valid EFS interrupts the code that bootstraps the modem and the IMEI isn't actually populated. I don't really know.

But I am pretty sure that most of the folks who corrupted their EFS data haven't corrupted anything else. It seems the issue is that modemst1 was flashed with the contents of modemst2, making it invalid.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
I'll see what I can do. I wont be back home for another 8 hours though. Bloody work :silly:
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
^^A number of motorola firmware packages contain the lines to format/erase modemst1/2 as part of the flash script. I can't imagine the axon7 being that much different. Both are based on qualcomm socs. If modemst2 is corrupted, perhaps the issue is more so just being able to properly format these 2 partitions so data can be regenerated.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
That very well could be. I don't see any harm in the affected users trying at this point.

[MENTION=4464865]Controllerboy[/MENTION] and anyone else ... you can feel free to try this. Just boot into recovery and "dd" out from /dev/zero to each partition, like this:

dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst1
dd if=/dev/zero of=/dev/block/bootdevice/by-name/modemst2

That, in combination with the IMEI utility mentioned above, may fix things.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
This was already tried

http://xdaforums.com/showpost.php?p=70111455&postcount=32

All it did was restore broken wifi
[ZTE Axon 7 Guides, News, & Discussion] tennear:
If you zero out the EFS partitions and then write your IMEIs back, does everything work again?
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
No. When I restore the imei's, as I said before, the phone display's my carrier name, shows signal bars but no 4G icon and cycles between that and emergency calls. I cannot make calls or connect to the internet
[ZTE Axon 7 Guides, News, & Discussion] tennear:
I've gotten a backup of modemst1/modemst2 from a user with a U model. I flashed them to my phone and rebooted. The IMEI didn't change. So it's definitely stored elsewhere.

It is therefore somewhat likely that if a valid set of EFS data is flashed to a G device, it may start working again with the original IMEIs intact.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
Tennear, that's good to hear. Now where to get good data from
[ZTE Axon 7 Guides, News, & Discussion] tennear:
I've got one. I just need to get permission to share it.

Now that we have verified it doesn't have the IMEI embedded, it's probably pretty safe to share. It's mostly just radio and GPS configuration and calibration data.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
Awesome news, ready and waiting if we get the go ahead
[ZTE Axon 7 Guides, News, & Discussion] Znuf:
Hi, I have a working EFS backup from my 2017G. Can i share here ? or in private?

Backuped with TWRP and restored with TWRP. Everything is working.
[ZTE Axon 7 Guides, News, & Discussion] tennear:
Do not trust anything created with TWRP. Run "dd" to get the files. It is safer.

It is safer to only share the files with users that are having problems. I am pretty sure the files don't have any sensitive information, but the exact contents of the files are not known.

I do have a copy of modemst1/modemst2 from another G device, and I have sent it to two users. We shall see if that fixes their devices shortly.
[ZTE Axon 7 Guides, News, & Discussion] Znuf:
Ok thanks for the infos.

If you need files, you can PM me.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
Hi Znuf

Thanks for the offer. I have PM'd you

---------- Post added at 01:47 AM ---------- Previous post was at 01:45 AM ----------

So after trying both tennear's and Znuf's modemst1/modemst2, still wont connect

Is it safe to assume the problem lies elsewhere?
[ZTE Axon 7 Guides, News, & Discussion] tennear:
I don't know enough about EFS to say for sure. But given that I used someone else's EFS and it worked just fine, I assume the EFS data is portable -- that is, it's not locked to your particular device. So yes, the problem must be elsewhere. I'll try to figure out what else might be the problem. Perhaps a radio log would help? "adb logcat -b radio".
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
In these posts by jcadduono he mention something about fsg

http://xdaforums.com/showpost.php?p=70142473&postcount=44

http://xdaforums.com/showpost.php?p=70144254&postcount=46

Perhaps that is the issue?

What would restoring a backup from another device's fsg do?
[ZTE Axon 7 Guides, News, & Discussion] jcadduono:
i'm pretty sure fsg partition is what has the imei configuration in some kind of encrypted format

modemst1 and modemst2 do get regenerated, but fsg does not, and when i wiped fsg both my IMEI became 0

i can still use data/call because my carrier doesn't blacklist 0 IMEI though

fsg is included in backup of EFS on official twrp but official twrp does not have any restore or backup issues so it is safe and I do recommend making a backup with it and saving it on your PC

i have another axon 7 that i bought for my brother, restoring his fsg to my phone did nothing, my phone can't read his fsg, so i assume it's encrypted in some way (another reason you guys don't see the imei on it)
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
Thanks jcadduono.

So it looks like that's it then. Game over
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
Not sure if it's fsg either. Those motorolas also had a fsg.img as part of the firmware. If this contained the imei then it wouldn't be part of a firmware flash.
[ZTE Axon 7 Guides, News, & Discussion] xtermmin:
The official Moto roms that I have do include a flashable fsg.mbn, but the official Axon 7 B20 rom does not include a fsg, so it could be that it's stored in the fsg on the A7 but somewhere else on Moto devices.
[ZTE Axon 7 Guides, News, & Discussion] Kevinkuensken:
Where can i find the efs folder?Im on twrp.
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
Was reading about a similar issue on the one+ forums. One user indicated wiping persist partition solved his problem.

https://forums.oneplus.net/threads/no-imei-and-no-efs-backup.322534/ post #18
[ZTE Axon 7 Guides, News, & Discussion] Controllerboy:
I'm trying that solution but it doesn't let me for some reason. When I enter "fastboot devices" it shows my device with serial number. When I enter "fastboot erase modemst1" I get "FAILED (remote:unknown command)". I have unlocked BL, "OEM unlock" ticked in Developer options, Debugging for apps and ADB enabled, /system/ mounted in TWRP before rebooting to the BL. Hmm..
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
This might have to be done via dd.

Tennear indicated above;

So /dev/sdf1, /dev/sdf2, and /dev/sdf5 would need to be zeroed out. Proceed with at your own risk.
[ZTE Axon 7 Guides, News, & Discussion] Tebor:
I dd'd all 5 and no change
[ZTE Axon 7 Guides, News, & Discussion] tron1:
Maybe there is help?

http://xdaforums.com/redmi-note-3/how-to/flash-recover-efs-snapdragon-t3406789
[ZTE Axon 7 Guides, News, & Discussion] Controllerboy:
Zero'd out sdf1, sdf2 and sdf5 paritions, doesn't seem to make a difference.

After trying all of these steps/advices/ideas, I think one thing that's really important is restoring the IMEI to our devices. I have zero'd out modemst1, modemst2, sdf1, sdf2, sdf5, flashed two versions of other users' modemst1 and modemst2 files, flashed B06 bootstack and B06 stocksystem, Cyanogenmod,... numerous times,...

The IMEI might have nothing at all to do with the EFS paritions in this device.

Nothing has worked so far.

I think that if we find a way to restore the IMEI numbers, the rest will kind of follow. My device identifies the mobile networks in the area, displays the signal strength (dBm), has a baseband and smallband, MAC address,... The only thing missing is IMEI and MEID. I'm pretty certain most (including my) providers doesn't allow IMEI 0 devices to connect to the network and that is the final step we need.

[MENTION=256766]tron1[/MENTION] I've already installed Qualcomm Drivers and QPST, booted into EDL mode, entered both

adb shell
su
setprop sys.usb.config diag,adb

and

adb shell
su
setprop sys.usb.config diag,serial_tty,serial_smd

but my device doesn't seem to go into DIAG mode. It connects as "Qualcomm HS-USB QDLoader 9008 (Port Number)" but QPST sees is as "*Download*" or "No Phone". The writedualImei tool from [MENTION=6054963]Tebor[/MENTION] and in [MENTION=256766]tron1[/MENTION] 's thread sometimes finds the port automatically, but always fails. Says "No DIAG Mode"

TL;DR if we manage to flash back our IMEI's and then erase EFS or restore another modem, I think we could make our devices work again. Anyone has an idea why I can't connect to it/get it in DIAG mode? ARe we using the wrong tools?

[MENTION=6054963]Tebor[/MENTION] I think you managed to connect to your device via that tool? Did you manage to restore your IMEI?
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
^^You're not supposed to do any of those commands in edl mode. Do them while in android itself (not twrp).
[ZTE Axon 7 Guides, News, & Discussion] rocco17:
I have restored INEI but I can not always have a call
[ZTE Axon 7 Guides, News, & Discussion] rocco17:
Can be a new backup of a functional A2017G, EFS partition made with the latest TWRP 3.0.3-0 arrange things ?
[ZTE Axon 7 Guides, News, & Discussion] djkuz:
Boot in to FTM mode (Power + Vol -) and you have ZTE Handset Diagnostic Inreface (Com...)

Try restored IMEI through it!
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
Any thoughts on how to read the msl/spc for this phone?
[ZTE Axon 7 Guides, News, & Discussion] tennear:
I don't know how to read the SPC.

I have my own tools for communicating with the DIAG interface. Sending zeros for the SPC does not seem to work. However, not sending the SPC at all does seem to work. So I suspect ZTE has simply disabled the SPC. But I cannot confirm.

Note I have A2017U model, unlocked.
[ZTE Axon 7 Guides, News, & Discussion] PlexBender:
I think I messed up my baseband.

I switched to the USA band in a test menu and my first sim card slot no longer works.

However I still have both of my IMEI and I can still get my sim card to work by switching it to the other slot.

I just flashed DrakenFX's B06 Bootstack and System but the problem still remains.

What should I try?

EDIT : After I dd'ed modemst1, my first sim tray is working again.

My IMEI wasn't affected.
[ZTE Axon 7 Guides, News, & Discussion] sinekm1:
I have found how to restore imei. From ftm mode update driver to diag from PC. I have found a small exe file(WriteDualIMEI_W_G_eMMC exe) that restore imei about 5 seconds. After I restored imei, cellular was no service. Then I flashed lineage os, and now I have fully working phone. I think lineage modem fix helped.
[ZTE Axon 7 Guides, News, & Discussion] Controllerboy:
I have no way of testing this, since I sent my device back and received a brand new one. I had found the tool you talked about, but at the time, it didn't work since it didn't detect my phone. I didn't manage to switch the device to diag mode. From what I remember, [MENTION=6054963]Tebor[/MENTION] managed to restore his IMEI, but even that didn't solve the issue. Maybe you're right that the LOS modem might have been the last step for him to fix the phone. Thanks for the information, anyways.
[ZTE Axon 7 Guides, News, & Discussion] gpz1100:
Can you provide a link to this tool? Thanks!
[ZTE Axon 7 Guides, News, & Discussion] Controllerboy:
http://www.mediafire.com/download/z681cvjyjhz163t/WriteDualIMEI_W_G_eMMC.rar
[ZTE Axon 7 Guides, News, & Discussion] tele_jas:
This is all I have ever backed up, for about the past 4 years.
[ZTE Axon 7 Guides, News, & Discussion] Felipe723:
Hello everyone, after updating my A2017, my IMEI appeared as totally different numbers from the originals of the phone, I tried to return to the original ROM, but I could not restore the IMEI, I had not backed up EFS. I tried changing the IMEI by following https://www.gizdev.com/repair-imei-snapdragon-device/, but to no avail. Anyone know what I could try to do?

Thanks.

(Sorry for my english I'm using a translator)
[ZTE Axon 7 Guides, News, & Discussion] nfsmw_gr:
On a previous phone I had I use an app called chameleon and overwritten my damaged imei with the one that was on the box of my device.

I can't provide any link because it's considered warez but if you google search it you should be able to find it pretty easily. :)
[ZTE Axon 7 Guides, News, & Discussion] Felipe723:
I have a A2017cn, and I lost my IMEI, I used A2017u, and I made a backup using twrp, not CN version I could not install twrp. IMEI appears on the cell phone with a different number, are 000039485642710 in slot 1 and 2. maybe it can help someone, and even me.

https://app.box.com/s/47ne1j5cd6mzxypb4ct8tkw09s1v4sri

---------- Post added at 05:50 PM ---------- Previous post was at 04:54 PM ----------

I tried to use the applicator suggested by you, it informs that only the mediatek media can be changed, yet I tried, but to no avail.
[ZTE Axon 7 Guides, News, & Discussion] Sui77:
Hi!

I also destroyed my EFS by messing accidently around with TWRP.

Might it be possible to restore a working EFS backup by adb and THEN changing the Imei by using the linked tool?

Should work
[ZTE Axon 7 Guides, News, & Discussion] pinkywinky:
So, I feel like this issue happens a lot when people flash the wrong bootloader/modem. Can someone create a guide for how to flash other versions to your phone? Something like where they remove the file that overwrites their IMEI.

I feel like one of the biggest issues with our phone is that people don't understand what they are doing. This is the first phone I messed with, and I messed it up a lot, but reading through the guides and all these posted helped me fix it a lot. More guides would definitely help. Expecially something that would show new uses all the things NOT TO DOA.

I would build a guide if I could, but alas I'm a newbie on this site, and I'm not allowed to. Mods raise me? Hint hint.
[ZTE Axon 7 Guides, News, & Discussion] madhits45:
It happened to me also. I was able to restore 1 of the 2 IMEI on my axon 7 after a flash mishap. I believe doing a full backup from my old phone and restoring it to a replacement caused the problem. I used the write dual IMEI but it wont write both IMEI, only 1. It seems even with 1 imei my phone still wont connect to the network correctly, but it maybe a bad modem file that is causing that. I am off to replace the modem now to see if that makes a difference because it could be the modem that wont allow volte.