[Moto G4 Plus Guides, News, & Discussion] HeethJain21:
Important

:

Now since Official Oreo is out, you can simply update to Official Oreo via fastboot and your IMEI will be restored.

This method will not work if you have restored other device's persist from some Youtube video or some Internet guide.

Read post #3 if you have restored some other persist and do not have a backup of your original persist.

For those who can't read this much, here is a better guide for you:

Hello everyone, this is a guide for solving the problem for IMEI = 0 on Moto G4/Plus which is caused after flashing stock ROM.

I got this problem last week and was constantly researching for the solution to this problem for the past 5 days and finally, I was able to get my IMEI back on my Moto G4 Plus (XT1643).

Note: I will be using stock firmware and stock ROM interchangeably in this thread as a lot of people consider it the same so don't get confused since I am by no means referring to the /firmware partition.

There are two common and major problems which occur while flashing custom/stock ROMs:

1. IMEI = Unknown and Baseband = Unknown

2. IMEI = 0

1st Problem:

Reason:

You flashed the firmware/stock ROM which wasn't meant for your device.

Solution:

Flash the firmware which is made for your device like XT1621 or XT1643, etc.

2nd Problem:

This is a major problem and there are two reasons for this:

1. Mess up your persist partition.

2.

fastboot erase all

command.

If your problem is caused by the first reason, it might be possible to fix it.

However, if the problem is caused by the second reason, I'm sorry I don't know if a solution to this problem exists.

Firstly you need to check if your device still has IMEI intact or not. For that use the following command through fastboot in the bootloader mode:

fastboot getvar imei

If the command returns an IMEI, it means that the IMEI is not completely lost and it can be recovered.

However, if the command returns IMEI as 0, then there are two reasons:

1. Either you flashed the bootloader that wasn't meant for your device. This can be solved by flashing the correct bootloader which is made for your device again by the command:

fastboot flash bootloader bootloader.img

2. If you have flashed the correct bootloader that is meant for your device and facing this issue, I'm sorry I don't think there is a solution to this problem. This problem is either caused by

fastboot erase all

command (which erases everything like IMEI from the device's motherboard or the place where IMEI is permanently stored) or some hardware issue.

Here is a little explanation:

Device specific or device unique IDs are stored in a separate place in the device like the motherboard or some other place which I am unaware of.

When EFS partition is created, it picks up the IMEI from that unique place in the device like the motherboard (or some other place which I am unaware of) where the IMEI is stored.

On every reboot, EFS partition is checked and if it does not exists, the Android system by default creates it.

When we flash stock ROM, we use the following commands:

fastboot erase modemst1
fastboot erase modemst2

These commands wipe the EFS partition and on rebooting, EFS partition is recreated.

But, in some cases, the EFS partition is not able to regenerate IMEI or the Android system is unable to recreate it and so we are left with IMEI = 0.

Here is a detailed explanation regarding this issue:

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------​

Solution:

I have made a youtube video for this which just shows how to fix the issue and does not goes into explanation of the problem as well as the solution. Here is the link: Moto G4/G4 Plus IMEI=0 fix

Pre-requisites:

You must be on Stock Nougat 7.0

You must be rooted (install Elemental-X kernel first and then flash Magisk otherwise you will have boot issues)

You must be on your own persist

Terminal app or adb drivers in PC/Laptop

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------​

Step 1: Check if there is a problem with persist

Note: The below commands are to be typed in a terminal app or adb shell.

Q) How to type in adb shell?

A) Open command prompt in the folder where you have adb and fastboot installed and type:

adb shell

So lets start now!

su

This command it to get root access for the terminal/shell. Grant the root access and you will see that the $ symbol is replaced with # symbol which means that root access has been granted.

ls -l /persist

If your presist has some problem, then you can see the following as the output.

athene_f:/ # ls -l /persist
total 176
drwxrwx--- 2 system system 4096 2018-10-21 07:40 alarm
drwxr-xr-x 2 mot_pwric mot_pwric 4096 1969-12-31 19:02 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2017-01-12 03:35 bluetooth
drwxr-xr-x 2 mot_tcmd bluetooth 4096 1969-12-31 19:02 bt
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 camera
drwxr-xr-x 2 root root 4096 2016-07-31 00:43 coresight
drwx------ 5 system system 4096 2017-01-12 05:21 data
drwxrwx--- 2 system graphics 4096 1969-12-31 19:02 display
drwxrwx--- 2 system system 4096 1969-12-31 19:02 drm
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 1970-01-01 06:48 factory
[COLOR="red"]drwxrwx--- 3 2951 2952 4096 1969-12-31 19:02 hlos_rfs[/COLOR]
drwx------ 2 root root 4096 1969-12-31 19:00 lost+found
drwxrwx--- 2 radio radio 4096 2016-08-04 20:26 mdm
drwxrwx--- 3 system system 4096 2017-11-09 16:30 misc
drwxrwx--- 2 system system 4096 1970-02-11 17:39 properties
drwxr-xr-x 8 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 public
[COLOR="red"]drwx------ 6 2951 2951 4096 1969-12-31 19:02 rfs[/COLOR]
drwxrws--- 2 mot_tpapi mot_tpapi 4096 2016-11-17 16:38 security
drwxrwxr-x 2 system system 4096 2016-07-31 00:43 sensors
drwxrwx--- 2 system system 4096 2018-09-10 18:13 time
drwxr-xr-x 2 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 wifi
drwxrwxr-x 2 mot_drm mot_drm 4096 1969-12-31 19:02 wmdrm
athene_f:/ #

You can see system instead of these red number if you flash Soak Test before flashing Stock ROM, so no worries, as the process will remain the same.

As it can be seen in the red part, the owner of

rfs

folder is a number (2951) which means that the system is unable to identify its real owner.

Also the owner of

hlos_rfs

folder is a number too (2952) which also means that the system is unable to identity its real owner.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------​

Step 2: Check for the key persist files

find /persist -type f

If you run the above command, you will see something similar to this:

athene_f:/ # find /persist -type f
/persist/coresight/qdss.agent.sh
/persist/coresight/qdss.config.sh
/persist/coresight/qdss.functions.sh
/persist/sensors/sensors_settings
/persist/data/sfs/6lgxCka66cxdsueYeHhCqx+j1DI_
/persist/data/sfs/VsxbuQew8Rbt0TRZjDAX8S9tV+M_
/persist/data/sfs/KfLHQpS5zKuygZcMelQOTtWzBvw_
/persist/data/sfs/R9+zCYj56-AHybZuQCWLm2H46E4_
/persist/data/sfs/NjJIuGH0j7kE08PFwp1yw+BminY_
/persist/data/sfs/7pU6SoXdsBUbDsxRiZOHNIjPVtw_
/persist/data/sfs/yLawqeQeY8AQGJmo46PVJbfYVxY_
/persist/data/tz/tz_counter
/persist/data/tz/tz_counter.bak
/persist/data/app_g/wv_usage
/persist/camera/focus/offset_cal
/persist/camera/ledcal/rear
/persist/factory/audio/temp
/persist/factory/audio/cnt
/persist/factory/audio/acc
/persist/factory/audio/f0
/persist/factory/audio/ref_diff
/persist/factory/fti
/persist/public/hiddenmenu/data/mobile_data_rx
/persist/public/hiddenmenu/data/mobile_data_tx
/persist/public/hiddenmenu/data/wifi_data_rx
/persist/public/hiddenmenu/data/wifi_data_tx
/persist/public/hiddenmenu/data/factoryreset_time
/persist/public/hiddenmenu/data/activation_date
/persist/public/hiddenmenu/life_calls
/persist/public/hiddenmenu/life_timer
/persist/security/18.bin
/persist/mdm/oma_dm_update
/persist/.bt_nv.bin
/persist/rfs/shared/server_info.txt
/persist/rfs/msm/mpss/datablock/id_00
/persist/rfs/msm/mpss/datablock/id_01
/persist/rfs/msm/mpss/server_check.txt
[COLOR="Red"]/persist/rfs/msm/mpss/dhob.bin
/persist/rfs/msm/mpss/shob.bin[/COLOR]
[COLOR="Green"]/persist/rfs/msm/mpss/dhob.bin.bak[/COLOR]
/persist/rfs/msm/adsp/server_check.txt
/persist/bluetooth/.bt_nv.bin
/persist/time/ats_1
/persist/time/ats_2
/persist/time/ats_12
/persist/time/ats_13
/persist/time/ats_15
/persist/time/ats_16
/persist/.twrps
athene_f:/ #

Note: The key files here are

dhob.bin

,

shob.bin

,

id_00

and

id_01

.

Your IMEI is stored in id_00 (first IMEI) and id_01 (second IMEI)

dhob.bin and shob.bin are responsible to create the EFS partition.

Note: If you do not have dhob.bin.bak, you will still be able to get your IMEI back (tested and confirmed working on Moto G4 Plus(athene)), however if you have some other device like Moto G5 Plus(potter) or Moto G5s Plus(sanders), you cannot get your IMEI back with this method however trying won't hurt.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------​

Step 3: Fix the your persist

For this step, there is also a TWRP flashable zip file which will fix the persist. So for those who do not want to type the commands manually, you can simply flash the zip file (Tested and working).

Downloads:

Link: https://www.androidfilehost.com/?fid=11410963190603873125

md5: 5aac75092fc84f46dd5c6bd443df0748

These commands will restore the owners of

rfs

and

hlos_rfs

folder back to their respective original owners (rfs and rfs_shared):

chown -R rfs:rfs /persist/rfs
chown -R rfs:rfs_shared /persist/hlos_rfs

Alternatively, you can also type:

chown -R 3012:3012 /persist/rfs
chown -R 3012:3013 /persist/hlos_rfs

You will see no output on typing the first command, however, you may or may not see any output after typing the second command (there was an output shown on my device but not on the other tested devices). I'm sorry I don't have that output stored, if someone who can see it, please repond so the thread can be updated.

3012 is infact the id for

rfs

folder and 3013 is the id for

hlos_rfs

folder so instead of typing their names, you can also type their ids.

Now, to check if the owners of rfs and hlos_rfs have been set back to their original ones, type this command:

ls -l /persist

If everything went fine, you should be able to see the following output:

The below output will be seen on a perfectly fine persist as well

athene_f:/ # ls -l /persist
total 176
drwxrwx--- 2 system system 4096 2018-10-21 07:40 alarm
drwxr-xr-x 2 mot_pwric mot_pwric 4096 1969-12-31 19:02 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2017-01-12 03:35 bluetooth
drwxr-xr-x 2 mot_tcmd bluetooth 4096 1969-12-31 19:02 bt
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 camera
drwxr-xr-x 2 root root 4096 2016-07-31 00:43 coresight
drwx------ 5 system system 4096 2017-01-12 05:21 data
drwxrwx--- 2 system graphics 4096 1969-12-31 19:02 display
drwxrwx--- 2 system system 4096 1969-12-31 19:02 drm
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 1970-01-01 06:48 factory
[COLOR="red"]drwxrwx--- 3 rfs rfs_shared 4096 1969-12-31 19:02 hlos_rfs[/COLOR]
drwx------ 2 root root 4096 1969-12-31 19:00 lost+found
drwxrwx--- 2 radio radio 4096 2016-08-04 20:26 mdm
drwxrwx--- 3 system system 4096 2017-11-09 16:30 misc
drwxrwx--- 2 system system 4096 1970-02-11 17:39 properties
drwxr-xr-x 8 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 public
[COLOR="red"]drwx------ 6 rfs rfs 4096 1969-12-31 19:02 rfs[/COLOR]
drwxrws--- 2 mot_tpapi mot_tpapi 4096 2016-11-17 16:38 security
drwxrwxr-x 2 system system 4096 2016-07-31 00:43 sensors
drwxrwx--- 2 system system 4096 2018-09-10 18:13 time
drwxr-xr-x 2 mot_tcmd mot_tcmd 4096 1969-12-31 19:02 wifi
drwxrwxr-x 2 mot_drm mot_drm 4096 1969-12-31 19:02 wmdrm
athene_f:/ #

As you can see here that the owner of

rfs

folder is

rfs

folder and the owner of

hlos_rfs

folder is

rfs_shared

folder, the problem has been resovled.

Reboot your device and the problem should be fixed and you will be able (hopefully) to get your IMEI back by either typing *#06# in phone dialer or in Settings>About Phone>Status>IMEI Information.

On rebooting, the system will check for the EFS folder and since it didn't exist earlier, it will be recreated by the system and therefore you will get your IMEI back.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------​

A huge thanx to NZedPred, rachitrawat, for doing in depth research in this problem and coming up with a solultion.

Also, I would like to thank Tyrantre who did a lot of research for this problem and has posted the workaround which was tried here in this thread here: Diag Mode with G4 for QPSD? which finally lead me to NZedPred's below thread as I could understand what was the problem due to which IMEI was set to 0 and why Diag mode wouldn't work.

Note: This thread was made with the help of the following guide which is confirmed to be working on Moto G5 Plus (potter) Fix Persist, resolve IMEI=0, Volte, 4G, Explanation, Requirements.

Note: This guide is made for G4/Plus and I have hardly done anything to fix this problem apart from making this thread, so all credits go to the respective owners who did research in this problem. This guide should work on other Motorola devices too as we aren't focusing on device-specific fixes that will only work on Moto G4 Plus.

Refer post #2 for fixing other issues faced after recovering IMEI.