yashsingh1/xdaforums huggingface dataset:
[Android General] Darkshado:
Custom recovery based method:

Flash CWM or a CWM-based recovery with Odin, then from a command line window:

C:\>adb reboot recovery

C:\>adb shell

mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs

cat /efs/mits/perso.txt

reboot

Proceed with the actual unlock.

On closer examination of the contents of my stl5 partition (safely dd'ed to the sdcard in recovery mode) there's a txt file named imeitool.txt in the same directory as perso.txt. Open that file in notepad and it looks empty, but it isn't really, you'll need a hex editor: there are 14 null values. Which conveniently matches the 14 digits found in an IMEI code, minus the Luhn check digit or SV code.

The question now: is this file of any use to us?

I tried changing the value in it to 35782304123456 instead (the first eight being common to the 5660M at least), but got no reaction from the phone. The change persists across reboots as well.
[Android General] tweakradje:
imeitool.txt is also 00's on working phone with good imei. imei is stored in one of the 761 files in /nvm/num

I can give you that section in zip and my imei. But I don't have the time to search for it.

If you found it you can replace it with your imei and get my stl5.rfs to change it for

dd-ing it back to your stl5 in recovery mode.

If your phone is still booting you can enter service menu by dialing: *#197328640#

Then select [6] COMMON and angain [6] NV REBUILD.

I have not done that (not nessecary) but perhaps that brings back the imei?

Cheers
[Android General] Darkshado:
About imeitool.txt containing 00's, I know, my 5660M Gio's IMEI is still fine.

My NV files have 728 entries instead of your 761, but that's to be expected.

I just searched for 6 digit serial number part in my NV files and did not find any matches.

I haven't dared try the NV REBUILD option in the menu, since I'd like to compare a working and a corrupt partition with Winmerge beforehand.
[Android General] tweakradje:
I used root explorer to mount / (aka root) as readwrite to make /efs folder all times.

So not the manual remount command. Perhaps that is a difference.

Cheers
[Android General] xdamaroc:
for people with the imei problem try this solution (it works for me):

-downgrade from android 2.2 to 2.1 using odin

-root your device using universal androot

-with adb shell :

su

dd if=/dev/block/stl5 of=/sdcard/stl5.rfs

dd if=/sdcard/stl5.rfs of=/dev/block/stl5

reboot

-upgrade to froyo

good luck
[Android General] tweakradje:
Yeah, I think stl5 file system is flagged "dirty" on some devices after the commands.
[Android General] ol1ver:
Gonna pickup my phone from the shop today, they added the simlock again (e.g. they flashed the original efs back.

I have a quick question though; when doing the mounting in recovery mode, does the phone still need to be rooted? I would say so, which means you'd have to su via the shell at least once to permanently accept su operations?

That said, I think a safer method, whilst in recovery mode, would be to execute the commands in succession, e.g. mount && cat /ets/persona.txt > sdcard/persona.txt && umount /efs. in 'dirty pseudo language'.

This all so that the partition access is reduced to a minimum. This should finish in microseconds.

I'd love to make a backup of the efs partition, in recovery mode, but very hesistant as I don't feel happy going back to the repair shop and tell them 'it broke again'.
[Android General] tweakradje:
Perhaps this will bring IMEI back

- Download QPST from link below and install

- Switch on Diag mode on USB (dial *#7284#, select [1]USB[*] )

- Reboot phone (now you need adb drivers from post 6)

- Start "QPST Configuration" as administrator

- "Add New Port..." that shows phone "SURF....." USB

- Then select from menu "Start Clients" the "RF NV Item Manager"

- Then menu File -> Read from Phone

- Item 550 (click hex checkbox) should be you imei

- 9 bytes that are swapped: 58 in imei shows as 85

- you can write your proper imei back

Qpst: http://www.multiupload.com/FPKEE5XTJK

Cheers

EDIT: good read about NV backup/restore - http://android-dls.com/wiki/index.php?title=NV_Items_backup_and_Restore
[Android General] russ18uk:
If you got access to the unlock code and the imei is the same as before, the code will be the same. When I bricked my phone I made a note of the code then when I got the phone back from service with a new board, entered the code in with a locked sim and now I'm unlocked. Took a week without my phone but at least it was free lol.
[Android General] ol1ver:
I was stupid enough to not write it down :S or rather, I wrote it down, but didn't save the file. After I thought it worked, i trashed it.
[Android General] ol1ver:
Extremly interesting, you reccon 'catting' bml5 is safer then mounting stl5 to copy persona.txt? I suppose getting bml5 to extract the efs from that might be safer (for backingup purposes)

I'd also think this still best be done in recovery mode/flight mode?
[Android General] ol1ver:
Whilst still searching, does anybody know if you can get root in recovery mode? I keep getting permission denied on su. But the phone is rooted in normal mode, su works (I told it to permanently allow su).
[Android General] tweakradje:
catting bml5 is all over this board. No problems found. Try searching /dev/bml5 here.

Cheers
[Android General] ol1ver:
from http://xdaforums.com/showthread.php?t=1233719

so not that convinced yet :)

Being the stupid experimenting fool I am, I did it, in airplane mode obviously just in case.

I catted the file, removed busybox, su, Superuser.apk etc (e.g. unrooted it just in case) and rebooted.

Everything seems perfectly normal, got bluetooth, wifi mac's imei ... and the file on my SDcard. So far, it works better then before :) BUT it has been done in flightmode.

On the S5660 (Gio) the file is only 9MB (9437184 to be exact).

So i went browsing through the dump. Since I also have vodafone and as in the first post, I know my network ID is 20404 I went searching for that sequence.

0286bf0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0286c00: 0100 0100 0001 3230 3430 3423 ffff ffff ......20404#....
0286c10: ffff ffff ffff ffff ffff ffff ffff ffff ................

Looks pretty exciting, scrolling up a few blocks gives:

sounds like perso.txt ... (there's quite some mentions of perso txt actually)

so lets go back to 20404 and go down some ...

I do find the mentioned 05 FF FF bit;

But no unlock code, not even further. I will search more :S
[Android General] tweakradje:
Are you browsing the stl5 file? You can easily view that with winimage.

Or the bml5 file (which should be much bigger than 9 Mb)

The hex sequence I gave is for BML5 only!!

Search 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 FF FF FF FF FF FF FF FF FF FF FF FF FF FF twice!!!!

ps: als je provider code 20404 is kunnen we net zo goed nederlands praten ;)
[Android General] ol1ver:
Dat verstaan andere dan weer niet :)

I don't have winimage, nor windows :)

Got the code, completely different location then the 20404 id though. Not even near by. What I did was open the bml5 image in vim and turned it to hexmode view. (Though i'm sure there's many better ways, such as hexdump -C | grep :p) Anyhow, I knew my 2 of the codes where 00000000. So I searched for ...0000 (or FFFFFF303030 in hex I suppose) and i found the codes surrounded by lots of ffffff's. thus ... bingo. There it was. I searched for the unlock code and there where many many references to this code.

Short story long, the bml5 image on the Gio (S5660) seems to be the safest way so far. I know dding the stl5 bricks it (first hand experience) so didn't have that image.

Btw, you can somewhat mount the vfat container that's hidden within the bml5 image. Find the MSWIN tag in the file with a hexeditor and use that as an offset for mount -o loop,offset=0xsomenumber. It'll mount but only 4 files seem to be visible and it seems heavily corrupted. Which sorta explains what the difference between rfs and bml is.
[Android General] hexio:
The bml5 method worked like a charm here. I'm writing to confirm it because the stl5 method bricked my first phone, which needed to be replaced, but with this new method everything went fine and I could unlock my (new) phone.

I used a slight variation to the methods explained here that might be of use to other Linux users like myself, so I'll explain it here. But all the credit goes to tweakradje, of course. Many thanks! :)

Phone details: Galaxy Europa (i5500) with stock Android 2.2 purchased recently.

PC details: Laptop with Ubuntu 11.04

Connection details: Standard wireless connection (wifi)

Steps:

1) Root the phone: I used Universal Androot

2) Install a SSH server from the market. I installed SSHDroid which is free (with ads)

3) Turn the phone into flight mode (not sure if necessary but I did it)

4) Turn on the ssh daemon with SSHDroid, allow root permissions.

5) Turn the wireless connection on and connect to the router, note the access details.

Now in the computer, connected to the same router.

6) Open a terminal, connect to the phone through SSH as root.

7) Once connected, run the command: cat /dev/bml5 > /sdcard/bml5.img

8) Copy the file to the computer. I used scp (copy over ssh) but any other method is good.

9) Use vi to view the file in the laptop.

10) Change to hexadecimal mode by pressing ESC :%!xxd

11) Press / and then enter the pattern ffff ffff ffff 3030 3030 3030

The code is there (8 digits) followed by 3 other sets of zeros.

Good luck!
[Android General] Darkshado:
I dd'ed bml5 from a live phone, works just fine. I also updated my post accordingly. :D
[Android General] ol1ver:
For safety reasons, I'd always recommend telling users to enable airplane mode (e.g. disable all radio's) as a safety precaution?

Btw, I noticed that in vim's hex mode the quickest way was to actually search for ffff 3030 :)

I guess the best way to search would be with a mode that doesn't put spaces/enters or ignores those during search and search for ffffffff3030303030303030 would be hard to miss then!
[Android General] psyke83:
I would not recommend anyone to perform a NV REBUILD under any circumstances. This will clear all calibration settings from the GSM and WCDMA profiles for the phone. The result is that HSDPA will no longer work - your phone will only work on EDGE.

I performed the NV REBUILD recently, and I need to send my phone for repair/replacement as a result.
[Android General] necrosy:
Hello,

Could someone make a backup of '3' logo firmware of i5500. I flashed mine with a firmware which contains russian language and got a NO IMEI brick on unlock try.

With best wishes,

Alexei
[Android General] psyke83:
The firmware/ROM updates do not contain your IMEI information, so it won't make a difference.

If you still need any particular ROM version, you can follow this excellent guide: http://androidforums.com/samsung-galaxy-europa-5/321656-manual-device-cant-updated-workaround.html
[Android General] tweakradje:
Did NV REBUILD get your imei back? What was the reason of this last resort method? Did you look in the service menu to get HSDPA back?

I think people with bad imei could try to dd /dev/bml5 (in FLIGHTMODE or adb reboot recovery mode) to sdcard and then dd it back. Perhaps that would clean the "dirty" flag on the BML5 FSR_STL file system?

Cheers
[Android General] psyke83:
I didn't lose my IMEI/IMSI details - it was my BT and wifi MAC address that got corrupted due to testing an early build of ClockworkMod that was flashing to the wrong bml devices.

I tried the NV REBUILD to attempt to restore the MAC address. The result: the MAC addresses remained corrupt, and the 3G became stuck on EDGE. I looked at all the service menu items and can't get HSDPA working again. It can be solved on other Samsung phones by writing new "RF NV" values, but our service menu doesn't appear to support inputting of new values properly.
[Android General] samsilver:
Test result for using dd on /dev/bml5 to recover lost IMEI

The above suggestion worsened my lost IMEI issue. I used

dd if=/dev/bml5 of=/sdcard/bml5.img

dd if=/sdcard/bml5.img of=/dev/bml5

in recovery mode.

Now, I get the Samsung logo reboot loop. If I used cat would it have resulted differently? Anyway this device is going back for warranty.

Background:

I tried the sometimes safe method and was able to get my 7-digit unlock code for my I5500 after completing the steps. The only difference that I did was that I did not do it via the adb and also I did it with a 3rd party SIM attached and the phone was in normal mode (with cell radio on). I simply used the terminal app that was included in the latest MAD firmware. After I got the unlock code, I rebooted and noticed that I have lost my IMEI and can not use telephony functions. WiFi, however, was running. The phone would also hang when shutdown and when turned on it reboots after 10-15 mins.

I tried to recover my IMEI by using the suggested

dd if=/dev/block/stl5 of=/sdcard/stl5.rfs

dd if=/sdcard/stl5.rfs of=/dev/block/stl5

But I could not complete the command because the first one resulted to an IO read error.

Too bad the cat /dev/bml5 method was just discovered a few days ago. That might have made the difference on my case. I hope the information above can be of use to some developers.
[Android General] psyke83:
Folks,

The instructions to backup bml5 seems safe enough (it worked fine for me), but I can confirm that re-writing the backup file to the bml5 device will result in a hard (unrecoverable) brick. My phone previously had corrupt MAC addresses and no 3G - now it power cycles (screen light on/off) before the SAMSUNG logo even shows. I can access download/emergency dload mode and flash roms, but it cannot boot.

I tried this only because I was trying to fix my 3G problem, and already committed myself to sending the phone in for repair anyway.
[Android General] necrosy:
I know this but i want to return this phone to '3' store as broken, so i need to flash original firmware back
[Android General] Ayaan0300:
Unlock Samsung Galaxy Europa i5500

I successfully unlocked my Galaxy Europa i5500 phone.

Credit goes to tweakradje. Simply follow the instructions at following thread.

http://xdaforums.com/showpost.php?p=17148825&postcount=334

i have attached screen shot, your location of code could be different.

please don't try this code as it was for my phone.

cheers
[Android General] necrosy:
Please if someone have original THREE UK FIRMWARE for Samsung Galaxy Europa please post it here or send me to email necrosy(at)gmail.com

Cheers, Alexei
[Android General] noureddine.am:
Thank you !

thank you so much guys, the bml5 method worked like a charm and i didn't even have to root my phone permanently. It's not even risky, i followed the post:

http://xdaforums.com/showpost.php?p=17148825&postcount=334

my phone is a Samsung galaxy gio, running froyo.

will be trying to unlock a galaxy mini soon.
[Android General] mikontara:
Please explain

Hello

I have got my second GT-i5500 yesterday. It was replaced as I bricked first beyond repair. Could you explain your instructions? I am trying to find safe way to unlock it. First phone was turning on and off in cycle after I got my unlock code and replaced sim. Thank you.
[Android General] Sliderule:
Unlocked Optus Samsung Gio Sucessfully

Many thanks Tweakradje.

Post # 334 is brilliant

I used the tempory root method of rageagainst the cage - your Edit 2

The tempory root does not install superuser so there's no point in the ADB su command and only one exit command is needed.

The blm5.img file is quite big (9216KB) so you won't find the number easily unless you use the right string. The one for the Gio is <FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 30 30 30 30 30 30 30 30>

The number was there 12 times.
[Android General] DebianUser:
Mine was 9MB... I found the key. I haven't had a chance to get a sim and unlock the phone yet though.
[Android General] scorpeeon:
does this work for galaxy ace?
[Android General] tweakradje:
Let us know. It can't harm anyway. I think it is bml5 too on Ace.
[Android General] ferreinf:
Worked like a charm using latest method, it took 5m... :-)

Thanks
[Android General] citroen666:
I need your help. I uncloked one phone. The second give me problem with the new method.

When I try to type "cat /dev/bml5>/sdcard/bml5.img" i have the this message : read-only file system. And before when i typed su I get the message on the phone : Unknown has been granted Superuser permissions

please help.. what i have to do
[Android General] RenzoR:
I managed to get the code out of the hex file,but my galaxy 5 won`t promt me for the code,it starts with "only emergency calls"

Any help?
[Android General] tlloyd1983:
Go to the dialpad and put in *#06#, if IMEI comes up blank like I think it will, then you have softbricked it. That is my guess, but try and post here.
[Android General] RenzoR:
With other sim card,with my sim card works fine.
[Android General] lypang:
Will this work?

mount -o remount rw /
[Android General] SPnewb:
Help with the method in Post # 334 by tweakradje

I messed up the perso.txt by using stl5 method and bricked the phone by uploading a different perso.txt using pull command. I bought another one and this time I want to be caucious, so I used the method in Post # 334 by tweakradje as quoted above.

However, when I typed "cat /dev/bml5>/sdcard/bml5.img", I got the same error message as in post #363. I checked the persion of the directory /sdcard, it looked like have r/w/x permission (see screenshot below), but it also shows that it is a mapping of /mnt/scard, so I go to the directory of /mnt and ls command showed that the directory /mnt/sdcard does not have any permission. I tried to use chmod to change the permission of the directory /mnt/sdcard but failed. What should I do now?

I also thought about using command "mount -o remount rw /" as in the stl 5 command, but because for the last phone, the file messup maybe happen when I unmounted the file, so I am a little hesitate to use it now.

Another question, I assume that the command "cat /dev/bml5>/sdcard/bml5.img" is to output/copy the file under bml5 (if bml5) is a directory or the file bml5 (if it is a file) to the file bml5.img on sdcard. In that case, if I just type "cat /dev/bml5", will the shell output the same content as if in the bml5.img (that way I could read the unlock directly from the window)? Is there any risk by so doing?

Thank you very much.
[Android General] tweakradje:
You have a sd micro memory card in the phone?

Disable USB Mass storage mode.

ps: the /mnt/sdcard folder should have rwxrwxr-x (775) permissions, in usb mass storage mode this is 000 or --------- !!

Cheers
[Android General] SPnewb:
Bravo, unlocked! Thank you very much, tweakradje.

Yes I had a sd card in the phone and the phone was in the USB debugging mode. However, each time I tried before, I tried when the Kies was open. After I succeeded getting the bml5.img, I opened Kies again and verified that once kies is open, the permission for /mnt/sdcard becomes d---------. See the following screenshot:

the last command group is when the kies is open, the first group (tried several times all the same result) is when the kies is closed. BTW, my /mnt/sdcard is slight different from yours, mine is d---rwxr-x (075).

Thanks again for your great help!!!:)
[Android General] ang3l:
Hi guys,

I need your help on this one! I installed cyanogenmod on my I5500 and now it does not ask for an unlock code when I insert a SIM card from another network. It just doesn't connect to the network.

Is there something I could do in this situation?
[Android General] tweakradje:
Dunno. Don't use that. Flash back to stock rom.

Do you have /system/app/Perso.apk/odex ?

Cheers
[Android General] ang3l:
I backed up my stock rom through ClockworkMod. Restored it but it stops on the load screen and never gets to complete. My original rom was GT-I5500YKA3IE (IRELAND) and as I can see it is impossible to find a copy of it online...
[Android General] tweakradje:
Does that matter? You can use any stock rom. Latest from Ireland is from O2: 2011-03-19 I5500XWJPJ_I5500O2IJP3_I5500XWJP3 (from "check fus" app)

Als you can look here: http://twitter.com/#!/SamKiesUpdates

This one is a good one: http://hotfile.com/dl/115678376/5a8ccd9/I5500XWJPL_ITVJP3_XWJP3.rar.html

pass: samfirmware.com

Cheers
[Android General] ang3l:
Thanx mate, O2 is installed now.

I'm stuck on another step though. In adb shell I try to write cat /dev/bml5>/sdcard/bml5.img but it gives me cat /dev/bml5>/Permission denied
[Android General] ang3l:
After trying this method, the phone just turns on for a second and then seems like restarting.. What does this mean?
[Android General] tweakradje:
No permisssions to write to SD card is due to KIES on your PC or "USB Mass Storage Mode" selected on the phone.

You should not have done the DD method. Very bad move. Read the first post of this thread. I have experimented with three methods: dd stl5, mounting stl5 and catting bml5.

Only bml5 method is 100% safe.

You can try to get a bml5 image and use odin to flash "one package".

Rename your bml5 image to efs2.img and flash it back. You cannot flash stl5 image

You can use some elses blm5 image, but you need to change your IMEI later on with QPST.

Last one is a couple pages back somewhere with instructions to edit IMEI.

Last resort is to send your phone for repair. A lot of people (including me) had to do that when searching for the proper unlock method.

Cheers
[Android General] psyke83:
It means you shouldn't have chosen that method. Your phone is bricked and needs warranty repair.

tweakradje, would you mind censoring the less safe methods, or putting a stronger warning? They're obviously not safe, even if you could reproduce the stl5 method on your particular phone.

The reason why some people have bricks and others not seems to be luck and timing. If the baseband is accessing the EFS at the time that the Android kernel tries to access (by the rild daemon), it seems to cause corruption. That's why putting the phone in airplane mode or recovery mode during the process can drastically reduce the chances of bricking.

---------- Post added at 01:34 AM ---------- Previous post was at 01:29 AM ----------

There is no way to flash EFS with Odin (even though it has an EFS button). If you modify the .OPS file and overwrite certain partitions (like arm11boot), you'll only make things even worse.

As I also mentioned, writing to bml5 from Android will also cause a brick (but ang3l has no option to do this since the phone will not boot past baseband initialization).

The only option is to get the phone serviced, or else take a chance with a JTAG repair (you can try those mobile unlock shops, but the chance of success is low).
[Android General] tweakradje:
Hi subpsyke,

After I have found several ways for unlocking samsung phones by experimenting some users have started their own thread here (and other places on the net) with mostly no reference to this thread.

The OP states clearly what method to use and which has the least risc. I try to warn users in other spinoff threads but I feel that is not my responsibility. I even e-mailed the thread starters. But none of them have corrected their OP's.

EFS by odin should be possible. That we don't know how (yet) is a challenge.

Take a look at arm11boot (or was it mibib) and you will see the flash partitions. EFS2 is mentioned like the others in the ops file. Problem is I have a perfect working phone so I am not going to risc bricking it for someone elses problem.

But I think it is perfectly possible to flash blm5 block into the phone, and change the IMEI afterwards.

Cheers