yashsingh1/xdaforums huggingface dataset:
[Android General] psyke83:
The Odin application is designed for various phones (you can see that it changes the model number in the application window when you feed it an .ops named after a valid Samsung phone codeword (europa, callisto, tass, cooper, apollo, etc.). Some older phones allowed EFS flashing (in which EFS was listed in the .ops file, such as apollo). The newer msm7227 phones (callisto, europa, tass, cooper) simply do not support EFS in Odin. I have tried flashing a valid bml5 and stl5 image (separately) to every possible slot (even past 10, as defined by the stock .ops file). I know that trying to flash EFS into an existing slot can have disastrous consequences; for example, flashing to slot 4 (arm11boot, which is bml8) will completely ruin the phone, making it unable to even accept a mains charge.

It is not "perfectly possible" to flash a bml5 to the phone (that is precisely what bricked my phone). The BML layer of the FSR (File System Remapper) driver is the block management layer, and it contains things such as bad memory mapping information that cannot be simply read & rewritten arbitrarily - it's more complex than that. Yes, you can extract the BML5 image for the purpose of extracting unlock information, but writing the same image back to the phone can have very unpredictable results.

Other bml devices appear to function differently than bml5 if they are not used by the phone as regular block (STL) devices (example: bml9 boot, and bml10 recovery). These partitions can be written to safely (which you can see in action when using my ClockworkMod port).

P.S. EFS will be visible in the arm11boot code, since the phone/baseband will actually access this partition for normal usage. That does not mean that it is available to Odin for flashing.
[Android General] kill3r000:
Da un cont si o sa ai de 5 beri de la mine. Multumesc si apreciez tot efortul. Eu nu m-am confruntat cu Unix, Linux pana acum, cu toate ca sunt in IT de multa vreme, dar asta e situatia. Omul invata pana moare, mai strica ceva, mai repara ceva. Cand il voi avea inapoi voi purcede la pasii descrisi. Pe card si pe PC le mai am si eu salvate (am si eu cap cateodata fara sa imi dau seama :P). Sa speram ca ma va contacta service-ul in curand sa imi spuna rezolutia lor la "problema".

Sorry, but this is adressed to all romanian speakers on this topic. It does not have relevant information for english translation!

Thanks tweakadje for all the effort!
[Android General] robilaur:
Mai ...spunetimi si mie va rog asa muran gura ... cum intru pe apt shell ala ? daca e nevoie dati un add pe mess la: laurentiu_gal si spunetimi si mie muran gura.

Short english translate ... "Explain to me how to do it like u explain to an idiot man"

Thanx best regards
[Android General] vampires.remembered:
Steps

1. Root your phone with: Universal Androot (I used this one) or z4root

2. Install application [.apk]: SU File Manager & Terminal (I used this one)

3. Run SUBFS (SU File Manager & Terminal)

4. Select Terminal

Enter this in Terminal:

su
dd if=/dev/block/stl5 of=/sdcard/stl5.rfs

5. Open /sdcard/stl5.rfs (or copy it to PC and open it from there) with winimage (free download) or similar.

6. Extract from it the file: mits/perso.txt

7. Open: perso.txt. You will find an 8 digit code. This is your Network Unlock code.

8. Insert an unaccepted SIM card (from a locked carrier). Your phone will ask you for the Network Unlock code.

9. Insert the 8 digit code (Network Unlock code) from perso.txt.

10. Thank tweakradje!

That's it!

All of the above applications and programs can be googled.

PS: This was done for Vodafone RO.
[Android General] tweakradje:
Thanks for your summary. I will change OP with direct link to your post ;)

Cheers
[Android General] BlocK240:
Just wondering if you could change the title of this thread so other people could reach it by google?

I'm pretty sure that not every owner of an android phone knows what efs is.
[Android General] robilaur:
Hey ...i have a little problem ... I did the dd if=/dev/block/stl5 of=/sdcard/stl5.rfs .... thing on my phone , reboted and after that the screen just flashes at SAMSUNG screen and does nothing. I tryed flashing with MoTafoca but nothing .....

Anyone can help me with some idears please. Im desparate
[Android General] robilaur:
tweakradje Mine still loops at SAMSUNG over and over again... what can i do?!
[Android General] tweakradje:
Your stl5 got corrupted I guess. Then it wont start properly anymore. I got the same problem after trying some things on my i5500 after I unlocked it succesfuly.

First try this tips: http://xdaforums.com/showthread.php?t=781149&page=190

from FDAD.

You still got your stl5.rfs? Then it must be possible with odin to flash it back. I have not found a way yet (see also info on above link) but it must be possible.

If rfs5 (efs) is corrupted you need to clear it first (also see link above).

Hope you manage with the know how on this board.

Cheers
[Android General] robilaur:
yes i have the file ... can u tell me step by step how to rewrite that file?
[Android General] tweakradje:
On the board I found numerous examples of the dd command to make a copy of the efs memory block. But they also use:

dd if=/dev/block/stl4 of=/sdcard/stl4.bin bs=4096

(stl4 is efs for Galaxy S)

Why the bs=4096 parameter?

Cheers
[Android General] tweakradje:
First you need it to boot properly. Try FDAD instructions first.
[Android General] robilaur:
still the same ...:(
[Android General] tweakradje:
If you have followed his instructions step by step I cannot help you any further. I don't have the know how. But there must be guru's here that can bring the phone back alive.

I couldn't wait for that. It is now being repaired. Will take 2 to 3 weeks :(

Sorry
[Android General] vampires.remembered:
bs=4096 parameter seems to be the block size...

Those instructions that you gave and i retyped worked for me on Vodafone RO. :)

It was to help someone who wanted "retarded proof" instructions...
[Android General] vampires.remembered:
Sorry to hear about your phones. :( It's always a risk doing experiments...

It wasn't going into download mode?
[Android General] robilaur:
can anyone tell me how to make tar.md5 file?

I have the original file saved on computer and im thinking if i can make that md5 file il reupload it with Odin and maibe i can fix it.
[Android General] Kapatagan:
same here, i followed the the same instruction here http://xdaforums.com/showpost.php?p=12190186&postcount=23 and just begun to suffer the rebooting problem as well.

I followed FDAD's advice here http://xdaforums.com/showpost.php?p=12172648&postcount=1900 on recovering but none works. can't use my phone now :(

Hope someone could help. Thanks in advance
[Android General] tweakradje:
Sorry to hear. Perhaps it has something to do with original firmware or not when doing the excercise. Perhaps the dd command is doing something too the filesystem we copy from. There must be something wrong with the commands used.

Is the command cat /dev/block/stl5>/sdcard/stl5.rfs a better one then the dd command?

Cheers
[Android General] robilaur:
Ok.... tell me something ...what is this file stl5.rfs exactly? Its the efs? and i think CP /dev/block/stl5 /sdcard/stl5.rfs is a better comand (copypaste)...id didnt tryed it
[Android General] boogiemanzor:
Do not try this as it will not be ok.

This is not right.

The only way to make a GOOD backup is:

dd if=/dev/stl5 of=/mnt/sdcard/stl5.rfs

That is the one and only correct way to back it up.

If someone uploads their stl5.rfs somewhere (someone who DIDN'T BREAK IT!!!), I can fix it for everyone else.

I also need them to tell me their IMEI in a PM so that I can remove it from the file and post the stl5 here.
[Android General] tweakradje:
Thanks for the info.

Can you post a mapping of bml versus opl slot number?

Do you say that efs/bml5 is NOT just an area of NAND Flash that can be written

in download mode?

Sounds very unlogical (apart from your own findings)

Cheers
[Android General] Oksi:
bml5.img method worked great for me

tweakradje, thank you very much for help with blm5.img method . It worked great for me.

Country: Portugal

Operator: TMN

Cell phone: Galaxy Mini S5570 with original TMN’s Android Froyo 2.2.1

Thanks, amigo! :)
[Android General] Darkshado:
Quick question: What is the codeword for the Gio (and if different Gio 5660M)? where would one find it?

My hypothesis is that since those partitions are not filesystems, they don't have the same bad block information that the STL partitions do.

Another of my guesses is that part of the EFS information is stored elsewhere on the phone. Looking at the contents of either stl5 or bml5, you won't be able to find your IMEI. Not in decimal, not in hex, nor in byte swapped hex form. NV item 550 is visible with QPST or QXDM (read-only so far) but isn't present in /stl5/nvm/num/ unlike many others. Other clue: notice how some places refer to stl5 as EFS

2

?
[Android General] tweakradje:
Nice one but: why is IMEI gets messed up then by some people when using he stl5 method?

Cheers
[Android General] Darkshado:
I don't know.

If the modem firmware tries to access EFS at the same time stl5 is mounted, there could be corruption and overflows, data might end up in unforeseen places.

Also, I haven't noticed if there were instances of phones re-locking themselves with the i5500, but I had that problem happen to me on the Gio. The solution resides in the CSC files:
[Android General] bazil58:
@tweakradje - post #334

First at all I want to thank you very much for your job and wasted time with explanations for all people from this forum.

My intention is to unlock my Samsung Galaxy Mini and I want to use your procedure for temporary root shown in EDIT2, but first at all, I want to be sure for my correct understanding so please help me with some clarifications.

1. Procedure for unlock and temporary root shown in post #334 is full aplicable for all Samsung Galaxy Mini ?? -post #382 say yes :=)

2. Files from archive RageAndAdb.zip (1x .exe and 2x .dll) must be locaded in PC root (c:\) ??

3. -put rageagainstthecage ELF executable in user writeable part of your phone is done by step 1 ???

4. Path folders shown in EDIT2 are identical for Samsung Galaxy Mini ??

5. ./rageagainstthecage -step 5 from EDIT2 - in steps 1-4 I reconize adb commands, but not "./rageagainstthecage" - is this the answer at command prompt of command from step 4 ??? [dot [.] before [/] exist ??].

6. Kies program must running or not during temporary root procedure?

7. -find proper block ... "00 ...... FF" - this search string/block is valid also for Samsung Galaxy Mini ???

8. Which is the safest method for rooting phone - using SuperOne Clock v1.9.1 or temporary root presented in EDIT2 ??

Is not hard to see that I'm newbie - Sorry for stupid questions but answers will be great help also for other newbies as I am.

Thank you in advance for any help !!
[Android General] tweakradje:
Hi,

- unpack adb zip file anywhere on your pc

- run adb from dos box (cmd.exe)

- now root first (needs to be!!)

- then follow unlock instructions

- don't run kies or sdcard in "usb mass storage mode" (unwritable /sdcard !!!)

- dunno about the proper search code but try it

- other people have unlocked gio/mini/apollo with succes

Cheers
[Android General] bazil58:
Thank you for prompt response.

All the best !
[Android General] tweakradje:
@subpsyke:

Do you remember Benjamins posts? http://xdaforums.com/showthread.php?p=12940862#post12940862

The ops file seems not to be very important when flashing a partition. He clearly stated the flash partition numbers from your debug log are not corresponding with the slot numbers in the ops file. The phone puts them at the right place when flashing with odin.

Have you tried flashing bml5 as stl2.img with odin to a i5500?

Some recovery mode info:

Booting Linux

RECOVERY MODE Key(back key) PRESSED

>> Recovery Boot

>> Recovery finished. Normal boot

>> Download Boot

arm11boot is a (fota) flash agent on the phone. It has another interesting mode. Dunno how to access it:

MODE1: (I know this one)

###########################

# #

# Emergency Dload Mode #

# (ARM9 mode) #

# RAMDUMP Mode #

MODE2: (what is this?)

>> Odin Mode

##################################

# #

# MDL Factory download mode #

Which KEY combo will start it at boottime?

In oemsbl there is this:

/mmc1/image/CEFS_M.mbn

0:EFS2

So you can put an EFS image on a sdcard in the image folder?

Cheers
[Android General] psyke83:
We later figured out that the atag information is inconsistent with the bml device mapping.

The OPS layout *does* matter. If you were to rename slot 4 (arm11boot) to "4, boot" and flash a boot.img (for example), your phone will hard brick (the bootloader controls basic phone functions such as charging and entering download modes). That has been confirmed with first-hand experience. The numbers have meaning to Odin, not the labels. You can rename "8, data" to "8, omgwtflol", and Odin will flash your data partition properly as long as it's named "omgwtflol.rfs" in the tar package ;).

The real partition layout is this (from bml1-14):

https://gist.github.com/1230684

From analysing bml dumps you can guess which of these entries should be accessed via bml or stl.

If the dump begins with FSR_STL, it's accessed via the block device driver (stl). Odin may be able to discern about this if the file is named *.rfs.

Otherwise (no extension or .img extension), it flashes directly to the bml part.

Doing that will overwrite the qcsbl, which could also brick. Edit: If you mean just to rename the name of the file in the archive and not change the .ops, it won't work. Odin will refuse to flash the file as it is not recognised.

Emergency download mode can be accessed with menu + power keys. Odin can recognise the phone, but flashing doesn't work (stays stuck at "setup connection").

I've seen RAMDUMP mode many times on my CM7 port. Rebooting to recovery can be a bit buggy, and if the phone freezes, it enters this mode. Not sure if it's useful to us, and I don't know how to get into it via keypresses.

This mode looks interesting, but I don't know how to enter it. I do know that if you use one of the custom jig cables intended to be used for the Galaxy S, it will cause our G5 to enter this mode (search on XDA and you'll find a report of that).

Interesting :)
[Android General] Llamaradaduke:
Problem writing my IMEI

Tweakradje:

First of all, I want to thank you for your excellent job! I´m trying to rewrite my IMEI following your instructions, using QPST. But when I try to write my original IMEI (353698040152773) i recieve an error message:

NvManager::writeToPhone( const string comPort ) -

QpstServer::sendSyncImpl - Error

*Code= 80004005

*Code meaning= None specified error

*Source= None provided!

*Description= None provided!

I've tried a lot of ways to write IMEI, bot i always recieve the same message. Maybe i'm not writing the IMEI numbers as i should? Can you help me with this?

Thank you very much!
[Android General] tweakradje:
Sorry. Don't have any experience with Qualcomm tools like QPST. I only know they exist.

Perhaps IMEI section is not writable via those tools. It shouldn't be too easy to change a IMEI for a phone.

Good luck.
[Android General] gahomii:
thannnnnnnnnnnnnks
[Android General] Llamaradaduke:
No problem, i'll search the way to do it. If i find something useful, i'll share it here. I will not surrender until my phone becomes a brick!
[Android General] Oksi:
Regarding to paragraph 7, I can tell you thatin my case the line (or block) "00 ...... FF" was different. I had to check all the blm5.img file looking for the 8-diggit number. & I found it in 3 ou 4 different locations.
[Android General] aileron79:
First of all, thanks heaps to tweakradje for the safe method described in famous post #334. However, I tried to apply those steps to a Samsung Galaxy Mini S5570 but I'm stuck finding the unlock code in the bml5.img file.

As someone mentioned the block before the code looked different on that phone, I just wrote a very simple script to scan the file for sequences of eight digits. In fact, there are 29 different ones of them - some indeed occur repeatedly, some are unlikely to be the unlock code ("11111111" for example).

If someone could tell me how the file structure looks like around the unlock code on a S5570 I could try to adopt that script and publish it here. Still, I have some questions.

- Once booting the phone with a locked SIM I just need to enter that number on the dialpad prefixed with the # character - right?

- How many retries do I have? What happens if I repeatedly key in a wrong unlock code?
[Android General] Oksi:
With my Galaxy Mini at first it asked for the PIN-number of the locked SIM-card, and only after apeared the window to insert the unlock-number. And I just inserted 8 numbers, without # character.

aileron79, if you would like to help other people by making the skript, I can send you by PM my BLM5.img file and my unlocking code, so you would be able to check it by yourself.
[Android General] aileron79:
Thanks, that would be very helpful. I just don't know if the BLM5.img is too large to be attached to an PM? My mailbox, unfortunately, does not allow attachments >5MB either (you can give it a try though, I'll send you a PM). If that does not work, i just need the sections containing your unlocking code, including some 50 bytes before and after that code.

Cheers,

:) aileron
[Android General] aileron79:
Alright, I did it. That script came up with some unlocking codes, the second one I tried was the right one.

Here we go:

<?
$inhandle = fopen("./bml5.img", "r");

$char_array = array("1","2","3","4","5","6","7","8","9","0");
$found = "";
$codes = array();

while(!feof($inhandle))
{
$char = fread($inhandle,1);
if (!in_array($char,$char_array))
{
if(strlen($found) == 8 && $found != "00000000")
{
$codes[$found]++;
}
$found = "";
}
else
{
$found .=$char;
}
}
ksort($codes);
echo "Results\n";
foreach($codes as $code => $count)
{
echo "$code: $count\n";
}
echo "\n";
?>

Note that you need to have PHP installed. If you do not know what PHP is, please google...

Save that code as findcode.php in the same directory on your (or another) PC where your bml5.img is located and execute by typing the following command:

php findcode.php

The script might take some time to complete.

In my case, the output was like this:

Results
00000003: 6
00000005: 5
00000765: 39
00009000: 22
00443958: 2
01400000: 22
05040001: 1
05040101: 3
07040015: 1
11111111: 1
20020000: 80
20040011: 5
30040011: 1
30040111: 5
31040015: 1
31040115: 4
34373131: 23
36183959: 29
37040012: 1
37040112: 5
38040015: 1
38040115: 22
52040011: 1
52040111: 5
53040011: 1
53040111: 5
75739000: 22
78040015: 1
78040115: 4

Some of those numbers did not sound reasonable to me, such as 00000000 or 11111111. Also, I skipped numbers which had other numbers in the list that were quite similar such as 53040011, 53040111, ... etc. So my first guess was 36183959. That was not the correct code, but my second try was 34373131 - and voila, the phone was unlocked.

That script works for all bml5.img-files, it does nothing else than seeking for sequences of exactly eight digits. One of those in the result set is your unlock code. As I said, just skip similar looking numbers first. I also skipped those with many zeros in them.

Note that I have no idea if the number of retries one has to correctly enter an unlock code is limited... Maybe someone could reply on that.

Conclusion: That script does nothing else than skipping through the file, that means you save the part searching the file manually in a hex editor.

Hope someone finds it useful.

Cheers,

:) Aileron
[Android General] DanL0403:
Has anyone else able to restore their IMEI number with this method?
[Android General] psyke83:
READ before asking questions. That method has a 50/50 chance of bricking your phone. Only use tweakradje's latest BML method.
[Android General] DanL0403:
BML for unlocking SIM maybe but for restoring IMEI too?
[Android General] psyke83:
There's no known way to restore your IMEI apart from sending it for repair.

It doesn't matter what your intention is - the problem is that you have a chance of bricking just by accessing stl5.
[Android General] DanL0403:
There are a few ways to restore the orginal IMEI number depending on the model of the phone and if there is a backup of nv_data.bin, /efs, stl5.rfs or etc. Even with no backup, there is still a way (search for qbanin on SAMDROID.NET).

It's interesting to know if anyone else was able to restore their IMEI using joseudp's Odin method.
[Android General] ThinksAmoral:
Yes! I just unlocked my Samsung using the supersafe method. :)

My bml5 file was in a separate 'block' folder.

I used Terminal Emulator to copy the file to my SD card:

$ su
# cat /dev/block/bml5>/sdcard/bml5.img

The file was a little less than 25mb in size. I then used xlv32 to read the hex file, found the code by searching the hex posted. It started on line #11C1C0A.

So thank you OP for the working method. :D
[Android General] Garuxa:
Excellent! Thanks for the tip with Terminal Emulator. I was able to unlock without any problem my I5500L using the supersafe method :)

Thanks! @tweakradje - @ThinksAmoral

:D
[Android General] MaGaRCaN:
I know that some people have had problems following #334 instructions.

After getting bml5 file, they tried to reboot and after that they have lost their IMEI. In one attempt they try to rewrite bml5 and they have a beautiful brick.

Are there any secure method to restore the IMEI?? Thanks!!!
[Android General] jaibobro:
hi , could you please post a step by step guide for dumbs like me?

i cant get it

thanks
[Android General] homeyg:
how to downgrade to 2.1

I have a gt-i6500(L?) that is soft bricked with no imie data, messed up time, and frequent reboots. I've tried the imie repair method listed here to no avail. One thing I've noticed is that there is a suggestion to downgrade the phone to 2.1 (i've upgraded it to 2.2). I have not been able to locate a working 2.1 firmware for north america however. I'd like to downgrade and try the imie repair again. Does anyone know where a 'stock' 2.1 firmware would be for this phone? Thanks for any help.

---------- Post added at 02:28 AM ---------- Previous post was at 02:13 AM ----------

Sorry, meant gt-i5500, not 6500
[Android General] viriimind:
Phone doesn't boot

After using stl5 method, I tried to reboot my phone(GT-I5500 or Europa) but it keeps flashing SAMSUNG logo at boot and go no-more further. Is it bricked? OR is there any way to fix it?

I brought this phone 2 days ago, it was network locked on 3(UK). I do not know the PDA version.

Please someone help me. Thanks!
[Android General] psyke83:
It's bricked. Bring it back to the store.

tweakradje, can you please remove the link to the stl5 mount method in your post #1, and censor the post itself? "Some times unsafe" is misleading - it's always unsafe, since there's a roughly 50/50 chance of an unrecoverable brick due to indeterminate factors that seem to vary from phone to phone. People are always going to ignore your warning on the first line and then proceed to brick their phone - laziness is human nature.
[Android General] tweakradje:
I am not sure that will work. There are many spinoffs of my unlock methods:

http://xdaforums.com/showthread.php?t=1204705

http://xdaforums.com/showthread.php?t=1139251

http://xdaforums.com/showthread.php?t=1244695

http://xdaforums.com/showthread.php?t=1033420

http://xdaforums.com/showthread.php?t=1192122

And all over the internet. I have mailed/warned users and OP owner in

each thread. But OP owners don't give about it. They don't care.

One option is to alert the Mods of XDA and ask them to change to OP of these threads.

I think my thread here states very clear what is the best method to do it. Users with bricks come to this thread perhaps after have followed instructions of threads mentioned above,

or anywhere on the net.

Cheers
[Android General] viriimind:
:eek: I brought it online and there is no warranty for my phone. Is there any other way to fix it? I also can still boot on Download mode.

pcode :gt-I5500YKAH3G

Cheers.