yashsingh1/xdaforums huggingface dataset:
[Motorola One Vision Questions & Answers] _bansal10:
okay i see.. even i am having problem with same scene... i have no clue what do i do.
[Android Q&A, Help & Troubleshooting] Rvilhelmsen:
Hi,

My friend bought a cheap fake chinese phone named S21+ Ultra 512Gb +16Gb with a MT6989 chip.

This device is running Android 6.

Is it possible to root this device and install a custom ROM, and if so, how?

Regards

Robert
[Android Q&A, Help & Troubleshooting] :
If phone's bootloader is unlockable, and if you find a Custom Recovery suitable to this phone, and if you find a Custom ROM suitable to this phone, then it's possible.
[Android Q&A, Help & Troubleshooting] keithgravylewis:
I have this phone now as a tester. Cannot find a recovery or rom. Have your friend had any luck?
[Android Q&A, Help & Troubleshooting] geoffins:
I also have an MT6989 phone and cannot find a recovery or Rom to try. Anyone else had any luck yet?
[Android Q&A, Help & Troubleshooting] smithju1986:
I too Have One of these And after Doing some backups I discovered that although the phone In setting says CPU 6989 It in fact is a MT6580 I also attaching scatter
[Android Q&A, Help & Troubleshooting] geoffins:
Yeah I found that the specs promised were all very wrong. Phone advertised 5G but was only 3G, advertised 1TB storage but was only 16gb storage, avertised 16gb ram but was only 2gb, advertised screen 7.1 and ended up being 6.8, advertised the MT6989 CPU but was actually the MT6580, advertised Android 10 but was actually android 8. They had some spoofing software installed by default that allowed them to change whatever spec they wanted to in the settings to say whatever they wanted. I found it eventually. I chose to send it back to them and get a refund for all those reasons (and have them pay return postage). Basically a criminal seller rip off merchant. Not worth the time and effort to use when the specs we so low anyways.
[Android Q&A, Help & Troubleshooting] smithju1986:
well I have successfully rooted it with magisk. you can use emmcboot with magisk and boot to recovery sideload the magic_patched then afterwards select the graphics test in recovery window and should see system updating and after that magisk should be there with full root access! enjoy hope this help out!
[Android Q&A, Help & Troubleshooting] chuy19312:
Do you have an tutorial for rooting those chinese phones? i have another chinese fake phone and i want to root it, also it could be good because i could test some things to make it stop putting fake specs, it says it's an n28u but on some apps says it's an kimfly mito a67, says it's 512 GB of storage but it's 8 GB storage, etc.

Edit: can you give me an link for the program you used on that image? please
[Android Q&A, Help & Troubleshooting] smithju1986:
well you can either just use the file if not I used a cracked miracle to get the boot emc
[Touch Diamond, MDA Compact IV ROM Development] rahujas:
Is there anyway of changing the ESN no. of HTC Diamond CDMA version just like we changed ESn of Touch (Vogue).

Please tell me how if there is any.

thanks
[Touch Diamond, MDA Compact IV ROM Development] tobeychris:
Yes, but it's illegal.
[Touch Diamond, MDA Compact IV ROM Development] MakuSoto:
the CDMA diamond does not use ESN anymore instead MEID is used. Even though you do see an ESN # but its a pESN.
[Touch Diamond, MDA Compact IV ROM Development] WarlockLord:
If I'm not mistaken on my reading of the technicals of MEID, the tower only verified the pESN in the verification process. And the way MEID converts to pESN, it leaves the possibility open of later on down the road having clashing pESN's. Technically, I think you only need to make sure the pESN needs to match up with whatever you're trying to change it to. Again, it is illegal. Just trying to provide the necessary technical info.
[Touch Diamond, MDA Compact IV ROM Development] cmrh:
Why would someone want to change their meid?

Why would someone want to change their meid?
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
any more information on this topic? i bought a Touch diamond cheap on ebay from the states nd want to use my telus vogues ESN/information on it... any ideas? i tried CDMA Workshop but it didnt work :(
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Of course it didn't work with CDMA Workshop. Diamond has no diag port atm.

There are already hacks for changing nvitems in diamond (such as ESN),

but due to security reasons and a high risk of bricking the phone, we won't publish them here, sorry.

Cya,

Viper BJK

P.S.:

Neither MEID nor pESN nor ESN is used anymore. It is a HWID.

As the change of these items is illegal, we won't discuss them here.
[Touch Diamond, MDA Compact IV ROM Development] -Mr. X-:
Diamond does have Diag port, i used it to hack my internal gps ;) dont know about you GSM guys but the CDMA deafeningly does have a diag port. used it a million times for CDMA workshop and QPST
[Touch Diamond, MDA Compact IV ROM Development] -Mr. X-:
if u change the MEID to the esn it will work.

i have cloned my MEID to my treo which origionally had an ESN and it connects to the network and makes calls no issues. i use my treo as my beater phone.
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Ahh, ok. My fault :) I thought both GSM and CDMA had diag port unusable without development tool :D

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] -Mr. X-:
nah Luckily, HTC left ours wide open via EPST

very nice of them i must say :D
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Yeah, that's really nice. But who know if the newer ones will also have diag port open.

If you need any feature added to QMAT for CDMA, let me know :)

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
alright so i found out how to read nvitems and which ones i want to edit but i cant get them to write to the phone... (QMAT says successfully written buh its still unchanged wen i display it, QPST says that there write-protected or read only)... any ideas? i did SuperCID it and tried the open sesame door folder trick to get access to the nvm folder buh those didnt work :(

QMAT EFS browser tells me all the files in the nvm folder are unrestricted but i cant write to it either... gives me an unknown error

I also tried doing Backup and restoring the untouched backup and QMAT came out with about 50 bad data errors.... so im guessing my only problem is that i cannot write nvitems... any ideas?

i feel like im so close lol :)
[Touch Diamond, MDA Compact IV ROM Development] ffyter:
Did you try using QPST? Open the NVM folder with EFS explorer and copy the $SYS.ESN file to your computer. Edit that like this post http://www.mobile-files.com/forum/showthread.php?t=34392 and copy it back to the phone. Let me know if it works.
[Touch Diamond, MDA Compact IV ROM Development] cmonex:
nah, CDMA got lucky again,.. they DO have normal usb interface, oh how much I envy them.
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
No did not work... there is no $SYS.ESN in my Diamond nvm folder... thx though
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
You need a correct SPC + SP to change, otherwise it won't work.

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] ffyter:
is there a $SYS.MEID ?
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
I know my SPC but how to i find the security password?

thanks in advance
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
SP is FFFFFFFFFFFFFFFF for Diamond.
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
Alright i sent both the SPC and SP but when i goto write the NVitem it still tells me its read only... im stumped... i think iv tried everything... unless theres something im missing... :(
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
I might have a look at it. But only for educational purposes :)
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
is there a type of mode the phone must be in?

I put the phone in diag mode (##3424 send)

Open up Qmat and goto the hardware forensics and use usb/com

Codes - Put in my SPC and SP and click send on both (Both accepted)

Go back to standard and use Write NVitem (Item 0000, Value is my 8 digit ESN seperated by spaces ex. 01 02 03 04)

CLick lets-go and tells me item is read only

I also tried everything thats in this post http://forum.ppcgeeks.com/showthread.php?t=36407

Am i doing something wrong?
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Well, first of all, values shouldn't be separated by spaces :)

For the fact that it is read-only ... well ... :D

Could be that this one is locked.

Cya,
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
locked as in no way to unlock? :( or are you trying to tell me something? lol :)
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
I think you have to unlock it by sending the MSL and the PS (FFFFFFFFFFFFFFFF). I still can't change the pESN with the CDMA Workshop 3.2.6 demo, though.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Not sure if this will help.. But I will try..

I used CDMA Workshop 2.7 to scan memory for esn using universal ram method.

I scanned locations 018E:0190 (I found that from another site)

CDMA Workshop reported

Scanning memory for ESN addresses:

ESN address has been found at: 018E:8C3C

ESN address has been found at: 018E:94B8

Then saved the results in a file: (File Contents)

ESN addresses:

018E:8C3C

018E:94B8

Is this the location to write directly to get around the lock..

Please note this is for testing reasons only...

I guess what I am asking is from QMAT docs does the value for item need to be something other than 0000 from your example that is why it is locked???

From docs

Example :

To write a new SPC, you would select „Write NVItem DANGEROUS“, enter as Item „55“ which is

the Item value in hex, and „303030303030“ as value (bytes in hexstring).

Now, your new SPC would be „000000“.

Also note how Read Esn displays your hex esn in reverse order. I am just not sure of the location where it is pulling the data from.
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
I used CDMA workshop to read all the NV items, and the ESN is written backwards in memory as far as I can tell. (maybe due to endian-ness?)

EDIT: With a "Memory/EEPROM" dump I found a third ESN at 018E:8D14...
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Changing the esn to zero in memory will enable change of the locked nvitem itself.

But as Memory is protected by MPU, this might be a no-go :D

Only further research will prove this issue.

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
So, what you're saying is, is that if we change the value in RAM to 00000000, then we can then be allowed to write to nvitem?
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
In theory, yes.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
A small clarification

I have 2 questions on understanding your program forgive me if they are basic questions:

1. Under the codes tab when I hit Read Esn i get:

0 - OK

xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

(I changed my esn to xx it is in reverse hex order)

Question: - does the 0 - ok mean that is the memory location that it got the data from. If not what is the memory location or the origin of the data?

2. Under the standard tab if you goto Write NV Item it is asking for Item and value. What does item mean? Is that refering to a memory location. Can you give me an example?

Thanks in advance and I am sorry if I am not using the correct terms so dont kill me with the comments...

BTW: Your software is great..... Very well done....
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
No ... it's just the nvitem 0, which is esn normally.

Each nvitem consists of 0x80 bytes data in general, so this is what you can see.

Memory is different ...

In fact, there are four ways to change in theory :

1. Download Memory (also named as such in my tool) and search for the esn.

Overwrite Memory location. (Either using QC tools or QMAT)

2. Overwrite EFS. This one might lead to a bricked phone, as dumped EFS

cannot be rewritten without correct fix.

3. If ESN is 0, then after sending correct SPC, ESN nvitem can be changed

4. If ESN is other than 0, sending correct SP will allow ESN nvitem to be changed

The fourth may not work with diamond, as for most phones, there is no SP anymore (it is set to FFFFFFFFFFFFFFFF).

Sorry, I can't tell you anymore than this ......
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
Where is that in your program? I can't seem to find it...
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Firmware Forensics -> COM/USB -> Save Memory To File -> DoIt

For further questions regarding my tool, see link below, as it is off topic here.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
QMAT stops as soon as it starts please see specifics below...

I have been trying to get a memory dump but QMAT stops. From the counters on the phone I can see it get some data (maybe only one try)(Less than 1 second). I am running Vista 32. Phone connection via usb, Connected through Qualcomm Diagnostics Interface (Com 5) Ver 1.0.0.6 5/1/2002. Looking for locations 0 - 02600000 to put in a file. I get the following

Problem signature:

Problem Event Name:	APPCRASH

Application Name:	QMAT.exe

Application Version:	1.0.0.1

Application Timestamp:	48f3f5f2

Fault Module Name:	StackHash_7dc0

Fault Module Version:	0.0.0.0

Fault Module Timestamp:	00000000

Exception Code:	c0000005

Exception Offset:	00000002

OS Version:	6.0.6001.2.1.0.768.2

Locale ID:	1033

Additional Information 1:	7dc0

Additional Information 2:	b4ee5de6a2322745523997a782b35692

Additional Information 3:	027b

Additional Information 4:	277e19c30fbd5f6bb531ec9e027c37c3

Any advise? If you need some more information please feel free to PM me in case it is off topic....

Running version 3.97
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Does anyone have an idea of the memory locations?

Or even better the memory range for a diamond?

I will do a memory dump and look for exact address...
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Status Update

Does anyone have any updates?

I have been able to locate the memory location.

I tried to write to it and it changed to 00 even when I read it after the write.

But it seems like once I disconnect and check it.. It did not not save it. Maybe I found the wrong location.

Any ideas???
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
After changing that in memory, you are able to write the nvitem.

Changing in memory will not change anything permanently.

That's how it works :)
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
So, what would I do to write to RAM as opposed to the nvitems? Different addresses?
[Touch Diamond, MDA Compact IV ROM Development] sequan:
- I have now found 3 locations that contain the data. (Hex versions of the data)

- Sent sp and spc to make sure unlocked

- I changed all 3 locations to all 00 00 00 00.

- I verifed all 3 are 00 by reading each location and they are 00

- Tried to nv write item 0000 value 00000000

- Received 0 - Item was read-only

How do you remove read only?
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
mhmm what radio version do you use ?

Sending SP before writing might help.

Also it could be that ESN is in simsecure. If the ESN in simsecure differs from original one, it could be that the nvitem is still locked.

Only reversing the firmware will tell you that.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
WOW

Hello thanks for all the help

My radio ver is 1.00.00F

Hardware Version: 0080

CPU: Qualcomm(R) 7501A

It is a Sprint Diamond (CDMA). I dont have a sim card so does this mean no simsecure?

I have started reading all of the work you have done with Qc and others on simlock and providerlock. Very impressive. But a little over my head I have done C and C++. I have never done any reverse engineering.
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
For what it's worth, I too have the same specs.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Making Head or tails

I found this post. I am not taking credit for it. I just dont understand it.

SPC is easiest on Diamond you can run that GetSPC and Get it. But ESN can not be Repaird you have to get rid of CID Locking by SuperCIDing it and then try to change NVM Item Value 1943 which Contains the MEID and then again Write Original Value this could Reset pESN which is corrupted in your Case i suppose. I have failed to superCID my Sprint Diamond and looking for Telus radio to actually SuperCID it.

Source:http://forum.ppcgeeks.com/showthread.php?t=40274

I thought the ESN was nvitem 0. I checked nvitem 1943 and QMAT told me bad parameter...

Does anyone understand this?

But I have something to add. I was told that Diamonds are based on MEID and not ESN. The values that are being displayed to me in nvitem 0 is actually my pESN. On the box that the phone came in is only the dec and hex meid. I also know that pESN is just a calculated value

Do I actually need to find my MEID and change that then the pESN would become my new value??

But that does not resolve the item being read only.....
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
i believe you have to change both... the MEID in hex is located at nvitem 797... thats something we need to experiment with once we actually find out how to write read only nvitems... wish i cud get my phone unbricked though
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
QMAT uses hex values, so the needed nvitem is 1943=0x797. So use 797 in QMAT.

Yeah, if ESN isn't used, pESN normally is. That could also work out.

ESN is real esn, and that is 0. pESN is MEID SHA1 hash. (pESN = pseudo ESN).
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
Looking in \nvm\num in my Diamond's EFS, I've found my MEID in a file called 1194. But I haven't found the pESN yet.
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Be careful with that file.. I unlocked my nvm directory (it was locked) a couple of days ago and looked at that file and every file in there. That is not your MEID. It actually is your HDR an Auth User ID.. Or at least that is what it is on mine. I looked at the hex values and mine contained the info sprint had put in there.

I think the answer is going to be writing nvitems that are read only.

Does anyone know what protects nvitems or how to change the properties of a nvitem.

---------------------------------------------------------------------------------------------

UPDATED

______________________________________________________________________________

I was able to answer my own question this is thanks of adfree and my fault for not finding it sonner... Sorry I am trying

NV items are stored as files in folder NVM.

If folder NVM is secured/locked...

There are different ways to force NV item change, without access to NVM through BitPim or EFS Explorer...

But you need to find them.

1 funny way is to dump CEFS and manipulate NV items "OFFLINE" on PC instead on high secured mobile.

But the problem is, to identify the NV items in Dump...

2. way is to make NVM folder visible.

Different methods on different mobiles...

But if u can dump CEFS, u can rename some NVM Strings... write back CEFS...

To dump CEFS look into QPST... Gang Bang uups I mean Gang Flash Image App...

But before check, if an folder NVM exists... But I think yes. Because this is an Qualcomm Standard thingie...

NOT tested, NOT confirmed on MSM7200. Need to be tested... on your mobile...

-----------------------------------------------------------------------------------

In my research I have found that this is dangerous.. Proceed with caution.

I will updated soon....

---------------------------------------------
[Touch Diamond, MDA Compact IV ROM Development] sequan:
NVItem Read only

I have come to the point that it has to be the read only nvitem.

This is what I have found:

1. Used CDMA Work to find all of the hex (pESN) locations. Found 13 of them.

2. Used CDMA Work to find MEID locations. Found 2 of them

3. Unlocked the NVM directory

4. Read all files in NVM/nam not able to find pESN or MEID. Used QMAT

5. Reset all pESN locations to 00

6. Verified that all pESN locations were 00 via memory read

7. Reset meid to 00

8. Verified MEID reset to 00 via memory read

9. Used correct SP and SPC

10. Used QMAT to try to write nvitems. Says is read only

11. Tried changing all pESN and MEID to 00. Then write NVitem failed read only

12. Tried write nvitem for meid Failed read only.

13. All locations in memory changed to new values not 00 after reboot.

This points me to NVItems that are read only.

Has anyone been able to write read only nvitems? What is the way to remove the MPU protection?
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
This one is really getting interesting. I will have a look at it shortly :)

Thanks for the info
[Touch Diamond, MDA Compact IV ROM Development] CranberrySauce:
Any updates...? :)
[Touch Diamond, MDA Compact IV ROM Development] DaveShaw:
Hi guys, can I just remind you all (Viper I know you know this already) of this site's point of view on changing your IMEI (which Wikipedia advises me is the same as the ESN on CDMA devices)?

http://xdaforums.com/showthread.php?t=276851

Thanks, and as V say's don't get us all in trouble :)

Dave
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
You're absolutely right.

I'm just checking that for interest. I guess HTC didn't leave this open, if yes, that would be a good point

to inform them how to harden it a bit :D

So there will be no "how to do" on this for sure, as we want this board to stay alive :D

Ok .... this will be the last update :

The nvitems itself aren't used as it seems, but regioninfo. Why the code still does exist, I really got no idea.

So Mods (Dave), from my point of view, this thread can be closed.

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] CashMoney18:
i dont want to get in trouble or anything but for educational purposes

When you say region info what exactly do you mean by that?
[Touch Diamond, MDA Compact IV ROM Development] sequan:
Could someone point us in the correct direction?

Maybe even PM me with some tips?

We are not trying to close the site. I love it.....
[Touch Diamond, MDA Compact IV ROM Development] hetaldp:
See what i was working with in Dark

http://www.mobile-files.com/forum/showthread.php?p=444973#post444973

Continue your Discussion there..
[Touch Diamond, MDA Compact IV ROM Development] cmonex:
regioninfo is a small page in the nand for radio, has some essential info stored there like PID, IMEI (for GSM devices), CID, secu flag, another flag...
[Touch Diamond, MDA Compact IV ROM Development] sequan:
QMAT

Does QMAT dump the radio? So that you can see the regioninfo that you are speaking of?
[Touch Diamond, MDA Compact IV ROM Development] gsm1999:
SPC Unlock

Does anyone know the specific SPC Address to the phone cdma diamond..

PLEASE DONT TELL ME USE THAT SOFTWARE Found everywhere.

I need the address.. Thx.
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
What address ?

1. Just read out EFS and dump nvitems. It is nvitem 85.

2. Another way is to use MFG Bootloader and Security Unlocked Device.

Just "pdump" HTC partition. You can find the correct page by using partition tool in QMAT.

After that, use QMAT to dump nvitems, have a look at nvitem 85 / 0x55.

If you were referring to memory addresses, due to MPU you either won't be unsuccessful,

or it will be different for each radio version.

Cya,

Viper BJK
[Touch Diamond, MDA Compact IV ROM Development] viperbjk:
Yep. Using "pdump" command and HardSPL.