yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] ytagger:
@eleotk Which mode does the device need to be in to use the SIM unlock tab? I can't get it to recognize the device
[Android Q&A, Help & Troubleshooting] eleotk:
enable Diagnostic (DIAG) mode .
[Android Q&A, Help & Troubleshooting] ytagger:
Doesn't seem to work. QFIL recognizes it in DIAG mode (901D) but not the Sonim tool
[Android Q&A, Help & Troubleshooting] haikkk:
Tried everything, flashed few times, also did wipe/factory reset from recovery. After sprint logo phone restarting. Is there any other version of firmware? Maybe this firmware is bad?
[Android Q&A, Help & Troubleshooting] eleotk:
Sonim XP8 Software update tool XP8 is valid
[Android Q&A, Help & Troubleshooting] eleotk:
Different models cannot be brushed with each other
[Android Q&A, Help & Troubleshooting] ytagger:
It worked fine for me
[Android Q&A, Help & Troubleshooting] ytagger:
@haikkk You're sure you have a XP5800 (XP5s), not XP5700 (XP5), right?
[Android Q&A, Help & Troubleshooting] haikkk:
Yes, i have XP5S 5800. Flashed again, no result. My phone bricked with this firmware. Can you please find any other version? I searched whole internet (
[Android Q&A, Help & Troubleshooting] ytagger:
You can always ask Sonim
[Android Q&A, Help & Troubleshooting] ytagger:
@eleotk Man you are too cool. 🏆Thank you. Do you have anything for the XP3?
[Android Q&A, Help & Troubleshooting] ytagger:
To install apps from the phone on models like the XP5s which require Sonim signature, install this app after rooting:

https://github.com/bavelee/PokeInstaller
[Android Q&A, Help & Troubleshooting] eleotk:
Version: 1.6.0

Date:

Modeified by: Zhubin

**********************************************

1、Change the way to check the validity of device.

2、Change WAP API to 6.0.

3、Add a display of IMEI in UI.

4、Support EDL.

5、change the way of mutli download.

6、Add 16-downloads in one time.

7、Change the way to find the devices.

8、change the way to read the image to support XP8 and XP5.

9. Change the way to analysis the build id of device to support XP8 and XP5.

10、Change the log format.

11、Add flash report.

12、Fix a bug when a device with low battery, tool can not operate.

13、Add version check.

13、change the method of report uploading.
[Android Q&A, Help & Troubleshooting] eleotk:
install app

no root

adb install xxx.apk
[Android Q&A, Help & Troubleshooting] ytagger:
I know, but then you need a PC every time you want to install an app
[Android Q&A, Help & Troubleshooting] ytagger:
What's this about?
[Android Q&A, Help & Troubleshooting] haikkk:
How to ask? Where?
[Android Q&A, Help & Troubleshooting] ytagger:
I don't know where you got it from, but the XP5s_Write_IMEI_tool_Test is full of malware
[Android Q&A, Help & Troubleshooting] eleotk:
XP5s_Write_IMEI_tool_Test

XP5s_Write_IMEI_tool_Test is full of malware，the earliest test software，Check SIMlock
[Android Q&A, Help & Troubleshooting] ytagger:
Does anyone have a QCN backup for a Sprint Sonim XP3800?
[Android Q&A, Help & Troubleshooting] haikkk:
Please, someone help me to restore my brand new XP5S 5800 phone. I flashed it with firmware from this forum and bricked my phone. This is not my first time flashing, i flashed tons of phone before, but this one is Qualcomm based and i do not have any boxes for its. I need other firmware, not 5SA.0.4-05-8.1.0-29.33.00_USER_PST.zip
[Android Q&A, Help & Troubleshooting] ytagger:
@haikkk I just had a similar problem with the XP3 and I was able to unbrick it by using the XP8 flash tool in EDL mode. You need to modify the testlogin file to allow XP5.

Unfortunately the IMEI was erased so I couldn't get service, you might have that problem
[Android Q&A, Help & Troubleshooting] haikkk:
Please, someone help me to restore my brand new XP5S 5800 phone. I flashed it with firmware from this forum and bricked my phone. This is not my first time flashing, i flashed tons of phone before, but this one is Qualcomm based and i do not have any boxes for its. I need other firmware, not

SO how to restore qcn if it does not switch to diag mode?
[Android Q&A, Help & Troubleshooting] haikkk:
So how to restore qcn, if it even can not switch to diag mode.
[Android Q&A, Help & Troubleshooting] haikkk:
Will someone help?
[Android Q&A, Help & Troubleshooting] apetrov1x5:
enjoying the phone except 2 things:

1) AT&T model can't share internet via hotspot (even though I am NOT on AT&T network

2) can't use second SIM card slot

Any solutions to these issues please?
[Android Q&A, Help & Troubleshooting] eleotk:
fastboot erase modemst1

fastboot erase modemst2

fastboot erase fsg

fastboot erase persist

fastboot flashing modemst1 modemst2.img

fastboot flashing modemst2 modemst2.img

fastboot flashing fsg fsg.img

fastboot flashing persist persist.img
[Android Q&A, Help & Troubleshooting] haikkk:
wrong commands, i get this "

fastboot erase modemst1

Erasing 'modemst1' FAILED (remote: 'unknown command')

fastboot: error: Command failed"
[Android Q&A, Help & Troubleshooting] eleotk:
Sonim XP8 Software update tool fastboot.exe
[Android Q&A, Help & Troubleshooting] stevecast2024:
Hoping someone might be able to point me in the right direction. I have what is supposed to be an unlocked XP8 purchased from Sonim. What seems odd is the firmware version. MPSS.AT.3.1.c15-00010-SDM660-AUS 200626-2127. Is AUS Australia? Or something United States? I use this on Tmobile but notice odd network issues. I'll go from solid LTE on band 66 to a random drop to 3G or completely no service out of nowhere without changing locations. Interestingly VoLTE works but there is no option in the firmware for WiFi calling. It's there a stock unlocked US Carrier firmware around? Or is AUS actually the correct firmware?
[Android Q&A, Help & Troubleshooting] haikkk:
Can someone help me to restore my XP5800? I bricked brand new phone with firmware form here.
[Android Q&A, Help & Troubleshooting] haikkk:
Hi. Can you please upload XP5SA.0.2-03-7.1.2-29.03.00 again? Tnaks.
[Android Q&A, Help & Troubleshooting] haikkk:
What a dead forum. I bricked my brand new phone from this forum and no one want to help.
[Android Q&A, Help & Troubleshooting] eleotk:
https://drive.google.com/file/d/1wzJtaHJdvLq-ZjkTCrO6y-ZtT8mc50Fh/view?usp=sharing
[Android Q&A, Help & Troubleshooting] haikkk:
How to flash this? There is no patch file inside.
[Android Q&A, Help & Troubleshooting] eleotk:
9008 or FASTBOOT，Or write 9008 rawprogram0 through Partinon file
[Android Q&A, Help & Troubleshooting] eleotk:
or EMMC to usb Edit EMMC ，EMMC TO USB contact VCC VCCQ CMD CLK DATO to the mobile phone PCB signal definition
[Android Q&A, Help & Troubleshooting] haikkk:
Can you show how to do this?
[Android Q&A, Help & Troubleshooting] eleotk:
Confirm what version of the mobile phone system is 7.1.1 8.1.1 sprint or ATT, sprint use the released version to download 9008 5SA.0.4-05-8.1.0-29.33.00_USER_PST.zip
[Android Q&A, Help & Troubleshooting] haikkk:
Is there any way to unlock sprint phone with firmware? I already flashed 8.1 version and want to unlock. I tried qcn backup restore, but did not work.
[Android Q&A, Help & Troubleshooting] eleotk:
XP5800 Sprint enable Diagnostic (DIAG) mode code *#*#0701#*#*

Flash tool

Username: testmulti

Password: testmulti123
[Android Q&A, Help & Troubleshooting] haikkk:
Thank you, but i get this error message. Failed send the simlock_get_status_CMD
[Android Q&A, Help & Troubleshooting] haikkk:
Hi dear, maybe you still have this file, can you upload somewhere?
[Android Q&A, Help & Troubleshooting] haikkk:
There is only rawprogram0.xml file inside, how can i get patch file for this? Or how to flash phone with only rawprogram file?
[Android Q&A, Help & Troubleshooting] haikkk:
Will someone help please
[Android Q&A, Help & Troubleshooting] Mr.PvT:
how to unlock sim card, ATT version XP880 thank all
[Android Q&A, Help & Troubleshooting] PsyberEMT:
Has anyone managed to capture the XP8 Android 10 update from Verizon? I recently picked up an unlocked AT&T branded XP8. Works fine with my VZW SIM, APNs are correct. Apparently AT&T loaded a proprietary software update application and it isn't hitting VZW's update server to get their latest update.
[Android Q&A, Help & Troubleshooting] joshnet3:
Maybe we can help each other? I have a Verizon XP8 with the Android 10 update. I've run into a problem however in that I can't seem to pull the ROM off it to have access to the boot.img to root it. I tried the EDM method with QSaharaServer but my computer says that it cannot execute the program because it is invalid. I downloaded it from the link in this forum unless something had changed. I would be more than happy to provide the ROM to you if I could just get it off the phone myself. If you know how to walk me through that to make it happen or help me trouble shoot, it's all yours!
[Android Q&A, Help & Troubleshooting] PsyberEMT:
Sure! I sent you a PM.
[Android Q&A, Help & Troubleshooting] joshnet3:
Replied
[Android Q&A, Help & Troubleshooting] jochu38@hotmail.com:
Let me know if you have any success with that, the magisk method doesnt quite work on my telus android 10 either. The boot img would be boot_a.img?
[Android Q&A, Help & Troubleshooting] jochu38@hotmail.com:
is it sonimexperience or experiance?
[Android Q&A, Help & Troubleshooting] ytagger:
It's experiance - do you think they know how to spell?? :)
[Android Q&A, Help & Troubleshooting] joshnet3:
I had success with Magisk root. Ended up using command line to pull boot.img's although Qfil also pulled images and then loaded them back up. My biggest issue was the QSaharaServer fail which did not occur if I loaded it within seconds of plugging the phone in in EDL mode. Wait longer and it will fail every time. Magisk had no issues.
[Android Q&A, Help & Troubleshooting] PsyberEMT:
For those who lost their IMEI and baseband as a result of flashing...were you ever able to get it back?

I took backups before flashing but inadvertently overwrote that backup with another after flashing a VZW Android 10 backup, hosing my modem and losing IMEI / baseband. Was able to get wifi back by returning to the ATT 8.1 image, but IMEI is toast.
[Android Q&A, Help & Troubleshooting] eleotk:
sonimexperiance.com
[Android Q&A, Help & Troubleshooting] otbtechoutlet:
Anyone have a fix for this issue after flashing? It says "Encryption Unsuccessful: Encryption was unsuccessful and can't complete..." and reboots itself.

It had a bootloop error to begin with.
[Android Q&A, Help & Troubleshooting] SpectralUA:
otbtechoutlet​

You may factory reset via recovery. Format data\cache then system will reencrypt.

Anyone can share xp8 qcn from Sprint unit? Tried from firmwares posted, but have "no sim, null imei" error. Original one losted with incorrect flashing, have no backup.

Also need dump of Android 10 updated phone. Im outside of US so unable to pull network upgrade.

If anyone can share the data please respond. I can get the binary from your phone myself if you agree. It will be enough to connect the phone to the PC, press a couple of buttons and give me access. No confidential information will be collected or leaked, i am only interested in firmware\system files from Sonim.
[Android Q&A, Help & Troubleshooting] otbtechoutlet:
I tried this but the phone booted up with the same result. There was no option to format data\cache. I've tried installing TWRP by flashing the modfified boot file earlier in this thread but the phone did not accept it. Is the phone bricked for good?
[Android Q&A, Help & Troubleshooting] SpectralUA:
"Wipe data/factory reset" option from original recovery.

Maybe you damaged parttable with reflashing. QFIL should restore it.
[Android Q&A, Help & Troubleshooting] otbtechoutlet:
So reflash the image with QFIL?

Edit: tried flashing with QFIL but get this error:

2021-05-16 08:14:24.543 08:14:24: ERROR: function: sahara_rx_data:276 Unable to read packet header. Only read 0 bytes.

2021-05-16 08:14:24.544

2021-05-16 08:14:24.545 08:14:24: ERROR: function: sahara_main:982 Sahara protocol error

2021-05-16 08:14:24.546

2021-05-16 08:14:24.547 08:14:24: ERROR: function: main:320 Uploading Image using Sahara protocol failed

2021-05-16 08:14:24.548

2021-05-16 08:14:24.548

2021-05-16 08:14:24.549 Download Fail:Sahara Fail:QSaharaServer Fail:Process fail

2021-05-16 08:14:24.550 Finish Download
[Android Q&A, Help & Troubleshooting] SpectralUA:
Look like wrong mbn loader used. Try another one (included in firmwares posted here)
[Android Q&A, Help & Troubleshooting] YnaGation:
Is there some way to get the wireless charging to work with a sonim xp8? I assume its possibly a system issue and hence me asking here, or are there specific chargers that only work for wireless charging for an xp8?
[Android Q&A, Help & Troubleshooting] ytagger:
I have been able to get back IMEI after lots of work, but not baseband
[Android Q&A, Help & Troubleshooting] ytagger:
I think the software @eleotk posted might help if we knew how to use them better. @eleotk can you please help us use the XP5s_Write_IMEI_tool_Test software? Just flashing the .qcn file doesn't seem to be enough
[Android Q&A, Help & Troubleshooting] Gand':
I flashed my XP8 with Smokey's update images_xp8a_att-userdebug-8a.0.5-11-8.1.0-10.54.00.zip with Sonim's tool.

The flash was successfull.

I patched it with Magisk 23 and pushed it with fastboot ; again, success !

But when i try to gain root access with Magisk, it says "Abnormal State; An "su" command that does not belong to Magisk is detected. Please remove the other unsupported su."

And i don't know how to get rid of this useless "su".
[Android Q&A, Help & Troubleshooting] Thecctech:
Well good to know well I have to wait as I'm not brave enough to embark I wish I can just pay someone to root it
[Android Q&A, Help & Troubleshooting] albert.r:
Thanks. I'm pretty rusty with Android, but I think long time ago the locked bootloader was checking the boot image to be signed with a key and if it was not able to verify/decrypt it, it was failing to boot. Did it change now? Or Magisk is able to sign the patched boot image with the same key as the original image?

-albertr
[Android Q&A, Help & Troubleshooting] smokeyou:
We are on the same page here! That's why I had related notes in the disclaimer. It does not seem to care but has not been verified either and I'm not an expert here so I cant say definitively.

According to Google.. It's not clear.. Or I'm not sure if Magisk would fall under "any root of trust" or "user-settable root of trust".

https://source.android.com/security/verifiedboot/boot-flow

We have a way to unlock the bootloader.. Just it's not really a safe way.. So I'm hoping we can avoid that.

The XP5s was tested without touching the bootloader first however that one seems to have some variations in the custom fastboot implementation.

Make sure to keep a boot image backup before testing and by all means avoid flashing the keymaster!
[Android Q&A, Help & Troubleshooting] albert.r:
[MENTION=1444903]smokeyou[/MENTION], maybe you can dump the image of the unlocked bootloader (is it a single eMMC partition or multiple partitions?) and share it with the forum, so we can flash it to our phones?

-albertr
[Android Q&A, Help & Troubleshooting] albert.r:
So, someone from SonimTech has confirmed that secure boot on XP8800 do verify both kernel and initrd files during boot sequence. So it looks like without unlocking bootloader we are out of luck? The phone will either go into boot loop or will trip “QFuse” and gets bricked. I'm not sure whether Magisk touches initrd or not, so beware of consequences.

-albertr
[Android Q&A, Help & Troubleshooting] smokeyou:
I guess to start with.. Secure boot and bootloader locking are 2 different things all together. Each does play a part in the others role but that is still 2 different topics. We have never had to disable secure boot for Magisk on any device that I know of - not even on a Pixel.

I wouldn't trust much of what they say unless you asked someone from the "Sonim Technologies (Shenzhen) Ltd" office where the phones are actually designed.. The US guys are only here to sell phones & make business relationships. Part of their relationship with carriers is to ensure the phones are locked to the carriers for where contractual agreements exist. They can and will tell you anything to prevent modification as it's not in their best interest. This is universal too if you take a look at other players, for example, Google said the Verizon Pixel bootloader was not unlockable - until people here figured out that was a lie :). Having a manufacturer provide "Fluff" is very common unfortunately.

At the end of the day - according to public sources - they have 1 (possibly 2) firmware engineers and I highly doubt they have spare time to reinvent the wheel. It's much easier to copy what Qualcomm gives them in the dev kit. Hence why the XP8 is branded with QC_Reference_Design in many places. They design rugged phones, not rugged firmware.

If your hesitant though then I would strongly recommend avoiding any steps in the thread here. This is still alpha essentially intended only for developers and advanced users. As far as I know, I'm the only one with a rooted XP8 still and my results may not apply the same in your case. I don't personally have time to test for every unique scenario that we may see in the wild.

The QFuse is a good point also. Every possible fuse has gotta be blown in my phone at this point :). Still works fine though. In most cases this is used for warranty verification only - rooting will void your warranty likely by blowing one of the QFuses. Because bootloader locking usually goes hand and hand with rooting this is where we typically see the QFuse blow. In short, don't expect Sonim (or anyone else) to replace a bricked phone!

---------- Post added at 11:06 PM ---------- Previous post was at 10:43 PM ----------

It's 2 parts or 4 in total for both a and b sides of xbl and abl

I'm not sure if I'm allowed to share it since I'm not technically licensed to own a dev kit. But since I do, I basically just compiled GSI using dev tools under snapdragon-high-mid-2017-spf. Completed signing with my own test keys and applied over EDL with ease. It's risky though because anything applied incorrectly to keymaster will hard brick the device. That's why I'm hoping to avoid this route because without having the Sonim private key, I cant provide it without also providing a keymaster.

That was a first stab though too. After further testing I came to the determination that a modified bootloader may not actually be needed since this does not impact secure boot directly. All in theory only.
[Android Q&A, Help & Troubleshooting] albert.r:
Hi [MENTION=1444903]smokeyou[/MENTION], thank you very much for your work and for answering my questions. Your help is much appreciated. I'm not concerned with invalidating the warranty, however I'm afraid that Magics can alter initrd and it won't pass verification during secure boot. It's unclear to me whether it will just go into bootloop and can be corrected by re-flashing original firmware, or can trip a fuse and brick the device. Basically, I want to take the risks of trying to root it, but only if I'm sure I can restore it to the working state if anything fails.

Right now, it looks to me that your device has a modified bootloader, and mine does not. So something that works for you, might crash and burn for me... I'll try to research more on secure boot and Magics...

-albertr
[Android Q&A, Help & Troubleshooting] smokeyou:
Hey [MENTION=3098018]albert.r[/MENTION]

I'm with you here yeah!! That's exactly where we are with testing.

The QFuse does not seem to do much if anything. It does have the potential to invalidate keys and such if the developer chooses to be an ahole. I'm pretty confident this will not be an issue though after everything performed on my device prior to the unlock with no apparent issues.

Backup and restore is fairly sound - Or carrier switching across Sprint and AT&T firmware was tested prior to unlocking the bootloader at least. We will definitely have to see if the patched boot.img gives us any trouble but we should be able to restore as long as we can still access EDL. A boot failure it does just that - it loops and loops - but hold down the power and vol buttons and you can get right back into EDL again. We need to be careful in terms of start sectors and partition sizes but for the most part we should always be able to re-access EDL to perform a restore unless we modify keymaster or provide a corrupt boot image in both A&B slots.

I learned the keymaster issue the hard way :). After a large number various flash/restore operations, the only issue I ever had was after accidentally nuking the keystore on one of the test devices.. At least it was free!

For 7.1 we also need to parse the GPT before doing anything as they could have changed the partition layout between versions. All my testing was done on 8.x.
[Android Q&A, Help & Troubleshooting] albert.r:
I can upgrade from 7.1.1 over to 8.1.0, so firmware will be the same as yours except for the changes you made to your bootloader. I need to research more on secure boot and Magics, since I don't quite understand how Magics can work if phone has secure boot enforced.

1. If that's the case, then Magics should not modify kernel and initrd/initramfs images, overwise protection will get tripped.

2. However, Magics needs to disable DM-verify, otherwise phone get's I/O errors while reading the files during the boot and it needs to be disabled earlier into the boot process. However, see #1.

So looks like a chicken and egg dilemma to me... I guess I must be missing something.

-albertr
[Android Q&A, Help & Troubleshooting] smokeyou:
Mine still says Secure Boot enabled if that matters. I never tried to disable that.

Wondering the same thing here myself. It seems that Magisk is able to cope with DM-Verity however I'm not sure how this works either. I'm used to Nexus/Pixel devices where my thought process is trying to follow the same basic methods just with variation around how to apply the patched image.

I had to disable DM-Verity in order to mount the system partition as rw.. Needed to remove pre-loaded apps manually over adb. I wonder if DM-Verity could be the determining factor for some kind of boot lock? Looking at the boot flow documentation seems to reflect this could be the case as it would hit "eio" and prevent boot if the boot loader is still locked. So keep that DM Verity option checked when patching in Magisk but be careful before you delete AT&T Device Help lol.

That's actually not a bad start though. Probably easier to force unlock the bootloader once you have su privilege.

7.1.1 should work also. It's just a matter of where to apply the patched boot.img since I believe 8.x is when they moved to the A/B layout. We would have to use FHLoader in read-only mode to pull the first several sectors from emmc to confirm. It's probably safer to start with 8.x though to ensure we have the A/B structure applied.. Then we always have B unmodified as a backup option.
[Android Q&A, Help & Troubleshooting] albert.r:
Do you mean we cannot remove any apps with Magics without tripping DM-verify and we need to keep DM-verify still enabled in Magics? But we should be able to get rid of AT&T Device Help (and other garbage) once DM-verify is disabled, correct?

Do you remember which specific options you have to change in Magics Manager for modifying boot.img?

-albertr
[Android Q&A, Help & Troubleshooting] smokeyou:
It's a default setting within the Magisk manager under advanced called "Preserve AVB 2.0/dm-verity".

I'm not sure though because if that's accurate then I should be getting a bypassable eio prompt currently and that's not the case.. In fact, when I re-lock the bootloader, the device boots straight into Android with no warnings whatsoever while still rooted with system apps removed.

I think most people use root based apps to remove system apps and these may not require the dm-verity modification.. I'm not sure. I just did it manually over adb and needed to mount the system before I could delete anything.