yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
On my second phone, the phone doesn't exit RMM status: prenormal after a week. The firmware I downloaded is COB.

This is the second phone on a completely different firmware that demonstrates this, after the Open China.

I do not think it's an update pending issue. There is no newer Movistar firmware. I updated the first phone to BL3 because I had no choice on Open China.

This needs investigation. It's not an isolated incident, there may be a limited number of flash before the phone is locked down permanently.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
No, there isn't. I've been hit numerous times and it's always flipped back over in 7d.

Looking forward to your investigation though ?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
169 hours on the CHC S9+, Status: Prenormal

Firmware on both devices is updated to V3 BL.

I don't know where to go from here. This is worse than an FRP lock which at least we know the details of.

Both phones cannot be modified in any way like this.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Is there a pending system update?

Have you checked for updates?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] State.of.mind:
Thanks for this info. I will research this to see if I can get it to work on Verizon.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] lost_:
He said he's updated

I'm concerned it's BL v3 that came out with the August update. I too had to move up to v3 on my new 9600 (TPA Panama, date trick doesn't work). I'll wait 6 more days...
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
I've managed to get out of Status: Prenormal. It took several reboots and checking the Check Updates menu.

The problem appears to be Samsung's server controls the unlocking process now, so if you ping updates on a firmware that has an update, you will never get out of RMM lock if you flash to another firmware that doesn't have it. In my mistake, on the PEO firmware I flashed the CHC CSC, which apparently reset the counter and prevented me from escaping the jail. You need to fully reboot to see if OEM Unlock shows, even if it's already active, then reboot to download mode to verify the lock is gone.

V3 has its own problems. Neither the V2 or V3 odm.img.ext can be flashed with Odin on this bootloader, I got a bitlock error and the no error at all, just a corruption of the partitions that require complete reflash because the phone no longer charges. This can probably be avoided if I can flash odm.img.ext with TWRP but I don't know how to get it to read and go the right partition.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Amd4life:
Does this root/OEM unlock method still work on the latest G9650 firmware version-ARG4?

Thanks
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Yes it does, but you have to ping Samsung's server if there's an update available. RMM is not unlocked locally.

PEO is on V2. If I ping, no updates, I OEM unlock.

CHC is on V4. If I ping on CHC V2, flash PEO V2, no matter what it won't unlock until I go back to CHC V4, ping and wait 7 days.

OEM unlock has to appear first before RMM status is set to normal.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Not sure if it's this kernel but my bluetooth devices hardly every auto connects. I usually have to manually connect, anyone else experience this?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Scanned the web for a while with no answers so can you help me out with some more detail on how you did this? I believe the IUS CSC is still on the V1 bootloader with BL_G9650ZHU1ARBG but anyways, I am on BL_G9650ZHU2ARD3 which is considered V2 I assume.

So I extracted the odm.img.ext4 from the ATT CSC file for the SM-G965U1

CSC_OMC_OYM_G965U1OYM2ARF4_CL13087505_QB18460747_REV01_user_low_ship_MULTI_CERT.tar.md5

Do I just rename the odm.img.ext4 file to odm.img so I can flash it as an Image in TWRP?

And do I then flash to the "System Image", "Carrier Configs", or "Vendor Image" partition in TWRP?

Looks like I may want to use this as my CSC source instead for ATT features.

https://xdaforums.com/galaxy-s9-plus/how-to/g965u-att-stock-odin-files-firmware-t3774820

Thank you for the help!
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
img.ext4 can't be flashed with TWRP, it needs to be .zip, .rar or .img.

After extracting the img.ex4 I used SVAImgUnpack to convert the .img.ext4 to ext4.img

Unzip the SVAImgUnpack executable and move the odm.img.ext4 to that directory, then open cmd and type "SVAImgUnpack odm.img.ext4" and it will convert.

I flashed it to the Carrier Vendor partition in TWRP

However, I am in bootloop. It doesn't appear to be verity as flashing noverity didn't do anything.

I restored with TWRP backup but got this error restoring efs:

"Error opening: '/dev/block/sdd3' (Read-only file system)"

But luckily it seems I don't have any baseband:unknown or other horror story

I don't know how to get this to work?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Thanks! I tried your instructions and also got bootloops. I uninstalled magisk and tried re-flashing multiple .img files including the version from the CSC build I'm running with no luck after many wiping of cache's as well.

I've got the same error message in TWRP, I have a strong feeling this is partially why I cannot recieve any carrier updates because this EFS type of partition is read only. I've also restored a previous build in the past that got me back "working" but think it may be some of the reason for my many dropped calls in good service areas.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] lost_:
Curious and sorry for asking again, has anyone tried TekHD's Detonator CSC Changer that is meant for the Exynos? He built it using files from the Snapdragon 960U/U1.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
It doesn't launch properly because it was built for Exynos. Even the SM-G965N, which has the same processor, doesn't load that detonator. He needs to configure it for the SM-G9650.

Don't use the CSC flasher either, as Aroma Installer is broken and will mount your /system partition and corrupt it. To restore it, it's either reflash in Odin for RMM lock or you have to first backup the System then System Image, in that order. If you attempt system image first you will get E: failed to /mount system (invalid).

Either way, the problem is (imo) that odm.img.ext4 is signed, because it's bitlocked flashing in Odin. I've read that it's not supposed to be signed, but it obviously is, otherwise I'd have no issue flashing the same file from before on the V3 bootloader. But what doesn't make sense is the other firmwares on V3 don't work either and don't explain the error. The knox counter only looks at the increment, so why HU3 versus QU3 is a problem, I don't know.

partycyborg will need to disclose more details, then we can see if it's an issue with the bootloader. I badly need even the T-Mobile firmware because without it, I have no access to LTE-A or MIMO while in the United States.

I picked the PEO firmware because Wikipedia claims Movistar had US frequencies but it's still a limited firmware.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] lost_:
Thanks [MENTION=6788158]Teracotta[/MENTION]. Yeah, I need Tmo CSC as well. Was there a reason you got the 9650 instead of 965F?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
LTE band 14, 30, 46 71

4x4 mimo and 256 QAM

until we get a csc that allows access to RAT, I cannt confirm most of these. only carrier that uses 4+ bands is AT&T (2/25, 4/66, 5, 12, 30) and you have no band 30 on exynos 9810, so no advantage over S8+ US which has root. for the other carriers and 2x2 mimo, no advantage over the s7, since they use fewer than 3 LTE bands.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] KC69:
So , there is no way that these can be used with a G965U1 model, even one running BL1. Is that what im getting out of this thread? Admittedly i have Not read every page. just went through front middle and end. Really like the phone , just cant stand not being able to root it. first phone in 15 years that isnt rooted. Having a hard time Dealing with it . Patience is Not my forte.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] lost_:
Paging [MENTION=8360749]partcyborg[/MENTION], your assistance is needed :)
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Wow sorry to cause such a commotion! This is what I did:

NOTE: YOU HAVE TO BE UNLOCKED TO DO THIS, AS IT USES TWRP.

I dont know if it's possible without, it sounds like under v3 it's not. This is in line with what I've been seeing with Samsung lately.

I took the odm.img.ext4.lz4 from the csc (not HOME) of a VZW firmware. Rev doesn't matter, I chose the latest one so it would be most up to date.

Before you do this, TAKE A BACKUP!

All of the following was done under Linux, but the normal tools for doing rom work in Windows will probably work. I have no experience with it though I only use Windows for Odin or other Windows only rom tools so you're on your own if you don't want to use Linux.

First, I extracted it:

lz4 -d odm.img.ext4.lz4

I then converted the sparse image to regular one:

simg2img odm.img.ext4 odm.img

Finally, I copied that to my phone and flashed it using twrp

adb push odm.img /sdcard/odm.img

The partition you want to write it to is called "carrier configs" or something like that. I'll check in twrp after posting this and update

If you guys have trouble with this, just post links to your csc archive and I'll pull it out for you, but there are simg2img utilities for Windows, and 7zip should be able to handle extracting a .lz4 IIRC
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Amd4life:
Would it be possible to get this file extracted and uploaded for USA TMOBILE XAA TMB?

I don't have a Linux box. I would really appreciate the help
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] lost_:
[MENTION=8360749]partcyborg[/MENTION], thanks for your offer!

Here are the latest multi CSC files:

https://1drv.ms/f/s!AkW3gDOBAqHLgYVH590g-18NDeCIsA

The OYN file is a multi CSC from SM-G960U (current latest August G960USQS3ARG8 )

The OYM file is a multi CSC from SM-G960U1 (current latest September G960U1UEU3ARH7) - this is smaller by 60 MB, less bloat.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Here is a compiled windows executable.

Unfortunately, I have the same issue as when I used the other .img converter, attempting to flash to carrier configs gives:

E:Cannot flash images to file systems
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
So flash the odm.img to carrier configs then?

I was following a previous post to flash to vendor image which just gave me bootloops.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Carrier Configurations is the /odm partition. It can't be written to with a .img file under the V3 bootloader, apparently?

Before CSC was its own partition I remember CSC will alter the NV values in the efs, so perhaps the problem right now is that efs is read-only.

When flashing odm.img.ext4 in Odin it goes 40% of the way before failing without giving me a reason, though when I attempt to flash cache I get

Set Warranty bit: Sparse
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Then do it by hand

WARNING! IF YOU SCREW THIS UP YOU CAN BRICK YOUR DEVICE

Like hard brick it if you write to a different device under by-name. Also idk what would happen if you wrote the sparse image to disk here so don't do that either.

1. Copy the extracted odm.img to you sdcard

2. Reboot to TWRP

3. Open terminal emulator then type this:

dd if=/sdcard/odm.img of=/dev/block/bootdevice/by-name/odm bs=1M

Then reboot again and you should have the CSC you want.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Here is the non u1 one. There should not be any actual bloat inside the odm image so let's start with that one:

NOTE: THIS IS NOT A FLASHABLE ZIP! i just zipped it for faster transport

https://www.dropbox.com/s/pdeuwucyfiafoa4/odm.zip?dl=1
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
No such directory detected.

ODM is mounted in TWRP and I can see it after booting in the root directory. But that path didn't connect to anything.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] PlagueBoy:
I could be wrong but what I used was: of=/dev/block/bootdevice/by-name/odm bs=1M

This will load the proper CSC at that point and time.

My issue is that I keep getting stuck back in prenormal status whenever I try to let the phone boot a second time.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Gboard decided to change dev into device again after I had already changed it back twice. I fixed the command it will now work as specified in my original post.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Bootloop. The actual output was:

writing '/dev/block/bootdevice/by-name/odm': No space left on device
21+0 records in
20+0 records out
25829120 bytes (120.0MB) copied, 0.085795 seconds, 1.4GBs

This is not good, it looks like the bootloader unlock only applies to the system partition. EFS and ODM are locked down. This is only possible now that ODM is its own partition.

RMM forces you to upgrade the bootloader and V3 apparently disallows flashing unsigned images to the ODM partition. There are still some experiments to be determined, but this if this is the case this is bull****. I will never buy Samsung again if I don't have control over phone!

Still need to experiment with G650 odm's.

EDIT: I just realized that this odm might be corrupted because the of the partition size determined by that PIT...Open China has the smallest odms so far so this might not mean much at all.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Yeah this has nothing to do with the bootloader and there is no lockdown on any other partitions. Odm is not even involved in the boot process so it would make no sense to have a bootloader involved in any way. As for efs that partition contains per device config data like the imei and some log data and other device communication so it literally can't be locked or your phone would not function lol.

If you read the output of the command it clearly shows that it wrote data and then tells you exactly what happened: it ran out of space. Something fishy is going on with your device then because this doesn't happen to me at all.

What does the following command return for you when entered over adb or as root? The first number should match mine as these partition sizes don't change.

[MENTION=303978]localhost[/MENTION]:/# df | grep /odm

/dev/block/sda24 158464 83500 74964 53% /odm
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
When I successfully wrote the odm in Odin on the V2 bootloader, it was to the COM firmware, not the CHC or TGY. This might explain why when trying to flash in Odin, the flash fails about 40% of the way through. It runs out of space and can't tell you because it usually flashes the pit first before the odm and omr.

When I look at the sizes of the odm's both CHC/TGY are 120/150 Mb while ATT is 168 MB.

The COM one is 350 MB.

I'm not going to flash the US PIT, but a larger G9650 PIT might do the trick. First I have to verify that I can flash TGY/CHC interchangeably.

df wouldn't work, saying "IS DIRECTORY", but /odm/dev/block/sda24 said "no directory found" as error.

I tried commands as root both as remote user within the adb shell, and using the terminal in TWRP.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
df | grep /odm
/dev/block/sda24 147072 89384 57688 61% /odm
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Yep it's the pit...I download the Puerto Rico firmware and extract the CSC, its odm is 350 MB. After flashing the pit I FINALLY have T-Mobile CSC, and unfortunately in the LTE menu I do not see Band 14 or 71. Possible it's still there, but unlikely. I will experiment so more to see if we can unlock it..

However, I am pretty sure there is 4x4 MIMO across 2 carriers.

Speed is much faster than the Exynos Galaxy S7, but I need to make stricter comparisons.

UE menu appears disabled. Not surprising because I only saw it on Exynos. But that limits the CA combinations.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Awesome. Any chance you could detail what you did a tad more? Not sure what you mean by flashing the .pit for example? Is that just the extracted non home CSC Odm.img file to carrier configs in TWRP?

So you flashed the Puerto Rico first and then immediatly after with the tmobile CSC odm.img? Or did you let it boot up w Puerto Rico first?

Are you getting any volte and wifi calling features?

Thanks!!
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
Flash the V3 PCT CSC in Odin (if you are on V3 BL), then flash the XAA odm from the internal SD card using partycyborg's commands. I have confirmed that using the PCT CSC will work even under the new bootloader.

Volte yes, wifi calling no. You might try ZTO CSC instead, owners of G935F used ZTO CSC to get wifi calling and that's an exynos platform

https://xdaforums.com/s7-edge/development/utility-flashable-csc-selection-30-t3392957

I won't do too many tests until my other phone is out of 7 day jail. My advice, stay away from china firmwares lol. even HK is china lol.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
I wouldn't trust anything but what's in ModemServiceMode, which you can enable if your carrier has it shut off. Let me know if you need the efs paths to twiddle and I'll happily provide them
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Do these multi CSC files come from XAA CSC ? Are they modified in some way to make them multi-CSC? I have the S9+ version so not sure the SM-960 S9 version is safe to use.

---------- Post added at 05:30 AM ---------- Previous post was at 05:26 AM ----------

Would you need to use the Tmobile CSC and not the XAA version to get wifi calling maybe? Are you using SVAImgUnpack.exe or simg2img to extract the odm.img file? Not sure if I can trust SVAImgUnpack.exe or not.

Thanks!
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
I flashed the PCT Puerto Rico CSC in ODIN successfully. I am on bootloader 2. When trying to then flash the odm.img I extracted from the XAA to carrier configs in TWRP I get an error "E:Cannot flash images to file systems"

https://updato.com/firmware-archive-select-model?q=SM-G965U1&exact=1&r=XAA&v=&rpp=15

In TWRP's console app I flashed using this command that was "partycyborg's" command. Thank you partycyborg!!

dd if=/sdcard/odm.img of=/dev/block/bootdevice/by-name/odm bs=1M

So phone came up ok and was prompting me if I wanted to enable wifi calling! Which I did but it kept asking me. I am on straight talk ATT and they dont support wifi calling or volte so I need to switch to cricket or attempt to get on a Verizon mvno. Problem is this 9650 is not considered to be supported by Verizon even though it is cause I used a SIM I unlocked on another phone with Verizon for months.

I used SVAImgUnpack.exe and simg2img to extract the XAA CSC and they were a binary compare.

simg2img.exe -i odm.img.ext4 -o odm.img
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
I used the simg2img executable I posted. Move the odm.img.ext4 to the folder, open cmd in the folder and type

simg2img.exe -i odm.img.ext4 -o odm.img

as for locked firmware CSC, I suspect that might be case, but I cannot test until I am out of 7 day jail.

3 days left ;)
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] riofrio1000:
hello I have the galaxy s9 + g9650 but I can not find any rom or how to root could you recommend me?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
You can start by reading the very first post in this topic.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] Teracotta:
After reflashing the phone with the PCT firmware, phone does not clear from prenormal status after 168 hours.

Clicking updates doesn't change this.

I think this confirms now that you can only OEM unlock on your original PDA/CSC. Or whatever PDA/CSC you first used to OEM unlock the phone.

I will test first flash whole new TGY, then try the PCT CSC, followed by carrier locked odm.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] riofrio1000:
tell me that room nomas can be installed I am new to this and I do not understand very well the publication I need help
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] locuras_86:
step by step

Hello everyone. I would like to know what would be the step by step to be root in the G9650. Would it be download mode and install the TWRP? Which one? Or I install the CROM and then the kernel? Could you explain me step by step? Thank you.

Hola a todos. Quisiera saber cual seria el paso a paso para ser root en el G9650. Seria modo download e instalar el TWRP? Cual de todos? O instalo el CROM y luego el kernel? Podrían explicarme paso a paso? Gracias.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] renuac:
Rmm status: Normal

oem lock: Off

Frp lock: Off

rooted

secure download: Enable

qualcomm secureboot: Enable

rp swrev: B3 (2,2,2,3,2) K3 S3

it's possible downgrade binary 3 to 1

and/or

3 to 2?

---------- Post added at 10:40 AM ---------- Previous post was at 10:14 AM ----------

ZARCHIVER EXTRACTED AND DECRYPT files: ext4.lz4
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] beachmiles:
Just got my cricket sim activated and no volte or wifi calling so far.

Extracted the g965U1 ATT CSC odm.img and flashed it to see if that would help, it did not.

I then compared it to the XAA version from the same build date and it's an identical hex compare.

In both cases the CSC automatically got set to CSC AIO which seems good but I cant get the use volte option in network settings like I could while using a straight talk sim. Although I didn't get volte then either.

So I'm wondering if I need to extract the dialer app from the ATT build or something else to get it working?
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Are you sure it's not working? Just because the normal icon and menus and notifications don't pop up does not mean it's not working. Normally I say just try to use the internet while on the phone, but since you have ATT together won't work as it always will be fine
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
The short answer is no, you can't, but the long answer is probably more what you are looking for ?

So while you can't ever downgrade your device (the marker is in an efuse so it's 100% permanent) if you are oem unlocked you can turn any firmware into any binary number to want ,?. For system (and any other filesystem partition) and boot/recovery this is easiest:

Just open the firmware file in a he editor, scroll down to where the binary version if located (it's close to the top), and ch and change the number into what you want.

BIG CAVEAT: Do NOT try this on the BL images, as I haven't fully tested this there and if you get it wrong you could hard brick your device. If there is ever a real reason to do this I'll prove it out.

The question I should have asked first is why do you even want to do this? There is no benefit to being at a lower rev (yes the higher revs stay rootable) and regardless You are unlocked already it looks like.
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] renuac:
Binary 1 possible bypass RMM state Prenormal to Normal Binary 3 fix all Bypasses
[Samsung Galaxy S9 & S9+ (Snapdragon) ROMs, Kernels] partcyborg:
Interesting... Where can I learn about those?