[Moto Z2 Force  Guides, News, & Discussion] TiberiumFusion:
Be extremely careful.... I lost everything trying to get TMO to provide service to my XT-1789-03.

First, I tried flashing it with the latest TMO rom, which is Oreo. LTE data worked. Talk & text service still not available (IMS not registered). Checking *#*#4636#*#* showed that VoLTE was now provisioned on the device (it is not on the Sprint roms), but like all services, it is a two-way street and you need both 1) the device's rom to be provisioned for VoLTE and 2) your carrier to add your device's IMEI to their whitelist of devices to actually provide VoLTE service for. #2 is usually happens automatically during the phone service "activation" when you insert your SIM card for the first time, but in this case it did not work. The "activation" process under the TMO rom was unable to convince TMO to provide VoLTE service. That meant I was right back where I started (4G data working but not talk & text) except now I had an ugly TMO rom instead of the proper Sprint rom.

The next thing I tried was flashing the various frankenstein combo roms as described earlier in this thread. So for example, the latest Sprint rom but with the latest TMO rom's NON-HLOS. Or the latest TMO rom but with the latest Sprint rom's NON-HLOS. I tried a bunch of different combinations. None of them were able to trick TMO into holding up their end of the bargain and providing VoLTE service to my device.

And here's where I mean I say I lost everything. Before flashing these franken-roms, I was going through my usual backup procedure of TWRP, Titanium, and manually pulling personal files off my phone. Unfortunately, I did the TWRP backups before the manual file pulls, and TWRP ****ed up, starting a comedy of errors that deleted everything on my phone. I told TWRP to switch the boot slot from A to B, since I was done making a backup of slot A and wanted to go back to slot B. I've done that 30 or so times before and never had an issue with it. Except this time, it didn't work. There was no error message. TWRP said the slot was successfully switched to B, except it was lying through a big grin. When I rebooted my phone, it rebooted into slot A instead, which contained the original RTM Sprint Nougat rom that my Z2 Force came with when I bought it in December 2017. That rom had been sitting untouched while I was booting from slot B for the last 5 years. When my phone erroneously booted into Slot A, Android did the most ****ed up thing I've ever seen an Android device do: it wiped /data/media, re-encrypted /data/media, enabled the forced TRIM bit on every single sector in the eMMC, TRIM'd the entire eMMC. This happened over the course of less than 5 seconds, and Android gives literally zero indication that it is doing this in the background during the boot-up screen. By the time you are back in control and try to see what has happened, your personal files are permanently gone.

The comedy of errors, except it's not funny at all:

1. TWRP lies about switching the boot slot from B to A. No error messages. Slot indicator says B is active, even though its not. (thanks, TWRP)

2. When the old stock Nougat rom in slot A boots, it sees that I have decrypted my /data partition and reformats it with encryption enabled (**** you, Google)

3. Lastly, because Google is pure evil, Android sets the force TRIM bit on the entire eMMC and accesses every single sector, permanently erasing all of my files.

#1 is a failure and a nuisance, but I could have recovered my data if that was the only thing that happened.

#1 followed by #2 is malicious. Part of Google's efforts to take as much control away from the user as possible. But, I still could have recovered by data when I dumped the eMMC over an adb pipe, since the sectors would not have been overwritten with 0's.

#1 followed by #2 and then #3 is just pure evil. There is absolutely no reason to force TRIM the entire eMMC after formatting a new /data partition in order to re-enable encryption. No. Reason. At. All. Whatever piece of **** programmed this behavior should rot in hell. I'm no stranger to data recovery or security, but my heart sank when I opened up the eMMC dump and it was literally 64GB of zeros.

And this is the worst part. I didn't lose all my files by flashing a risky rom without making a data backup first. That would have at least been poetic justice. No, instead, I lost all my files while I was backing up all my files.

At that point, there was no reason to be careful anymore when flashing things. All my personal files were gone, anyways. So I started flashing the franken-roms, trying every combination I could think of in order to try to get TMO to actually provide service to my device. Nothing I tried was able to convince TMO into holding up their end of the bargain and providing VoLTE service to my device.

Somewhere along the way, I tried flashing the latest Pie official rom from the "RETAIL" channel. After trusting TWRP to properly switch slots, this was probably the worst thing I could have done. My phone lost its baseband (bootloader says "Baseband: <not found>") and because I flashed a Pie NON-HLOS, now I could never go back to Oreo or Nougat since the modem would not work. I learned this the hard way. But I tried anyways, using flashalls to try to restore my baseband. It did not work, and it permanently broke the modem. Now the radios (wifi & data) were non-functional, no matter what ROM I used. I could not activate my phone, since I could not get past the god damn Android welcome screen, which requires an internet connection in order to press the Next button. Again, Google evil, but that's nothing new at this point.

And then somewhere along the way with my NON-HLOS flashing experiments, my bootloader got relocked again. This was a problem because I could not get past the god damn welcome screen in order to open the Settings app and check the "allow bootloader to be unlocked" option.

My phone was now a brick. The worst kind of brick. I've bricked all 3 of my phones before. I've fixed all of them before, but not this time. This time was the worst by far. The bootloader was locked, so fastboot was useless. The radios (wifi & data) were broken, so I could not get past the Android welcome screen. That meant 1) fastboot truly was useless since the bootloader could not be unlocked and 2) adb was useless as well since I could not get to the settings app to enable USB debugging. Because nash does not have a recovery partition (the recovery is actually a ramdisk inside the boot image) I also did not have access to TWRP because I had been flashing stock roms which only include the utterly useless and pathetic stock android recovery, which can't do anything right and refuses to flash anything that isn't signed by Google. It also refuses to flash anything when your baseband is gone, so I was triply ****ed.

When I say this was the worst brick scenario ever, I mean it. The phone successfully booted to every single level of its consciousness - preboot to bootloader to boot ramdisk to Android. I had access to every single level of user interaction - except every single level was locked out. Bootloader was locked. Recovery was stock and useless. Android wouldn't let me get past welcome without a completely unnecessary internet connection and the radios were borked. And this is why it was the worst: if my phone was more broken than it already was, it would actually have been repairable. If it was so broken that it only booted into the Qualcomm 9008 mode, I could blankflash it and fix everything. But it wasn't, and at this point, I have concluded that there is literally zero way to boot the nash into EDL mode without a jtag. I tried everything from edl cables to every single vol up + vol down + power button combo under the sun to spending hours trying to convince the Level III techs at Motorola to divulge the procedure to get the nash into EDL mode (which they summarily refused to do).

This all happened during a very, very long weekend in August. On Friday, I had a working phone and the only problem was TMO refused to provide talk & text service to it via VoLTE. I thought I could trick them into fixing that by doing all this flashing... By Sunday, I had lost every single file on my device and it bricked in the most asinine way imaginable.

This story is my warning to you and to anyone else who may try this. Do not flash anything from a different model's rom that is NON-HLOS or Pie related unless you are prepared for the worst.

The bottom line is that I don't think it is possible (anymore) to trick TMO into servicing any Sprint nash device. It's simply out of our control as customers.

This is because TMO blacklists the IMEI of all Sprint devices. Which works out just great because of their hostile takeover of Sprint. They assimilated tens of millions of customers and they blacklist all of those customers' devices. Stupid? No. Calculated. They force you to "upgrade" to a TMO-branded device in order to receive service. But I've been a Sprint customer for over a decade, and I don't feel like kissing the toes of the vile company who destroyed my happy experience with Sprint. None of us asked for this.

If you're a Sprint customer, TMO will **** you six ways from sunday, but they have no problems if you are a Verizon or AT&T guy. They do not blacklist the IMEIs of Vzw and Att devices. I have since picked up a Verizon Z2 Force and I plan to replace my XT1789-03's motherboard with the one in the Verizon device (model XT1789-01). This will solve two problems: 1) restore my cell service and 2) fix my phone, since my faithful Sprint nash's eMMC (and by extension, its motherboard) is useless since it has been bricked in the worst possible way and has also lost its baseband. Even if I could unbrick it (which I'm still trying to do), the radios are permanently broken, since we do not know of any NON-HLOS.bin that works with our phone on Pie (excluding XT1789-01 models, of course).

So, the plan is that I will port my phone number to a new SIM for the Verizon nash that I bought, which has an IMEI that is not blacklisted by TMO. I then disassemble the Vzw nash and my bricked Sprint nash, transplant the motherboard from the Vzw one into my Sprint nash's chassis (which is in significantly better physical condition, specifically the screen), and presto, my phone now has full cell service again by way of receiving a new brain transplant that is identical in every single way except it is stamped with an IMEI that isn't blacklisted by TMO.

I have not done this yet, but I will post here again when I have the results in case anyone (by some astronomical odds) is in the same position as me and is considering doing the same thing.

Also, props to anyone who reads this whole long ass post. Unfortunately, this is just the short version of the 200 hours or so of suffering that I've come upon as a result of simply trying to get VoLTE working on my Sprint nash. Don't make the same mistakes I did, and never trust your rom to do the sensible thing or to be upfront about what it is secretly doing behind the scenes. Android is not what it used to be ten years ago.