[Proof of Concept] Help for those who lost 4G - EVO 4G Android Development

Apparently a number of folks lost their 4G keys. Kinda sucks when you are in a 4G market, and cannot take advantage since your 4G keys are hosed. Redsolar came up with a process for moving/editing your 4G key to a hobbled phone.
Further reading..
http://forum.xda-developers.com/showthread.php?t=716694
Some discussion made that once a phone is sent into either Sprint or Insurance for replacement the 4G keywould be rendered useless by Sprint. In a way I doubt that. It would be more prudent to invalidate the MAC address than the key. Since Wimax keys are generally used to en/decrypt the data. I believe that authentication fails because the network handshake is encrypted. But the initial connection is granted via the MAC address, then validation via the encrypted handshake. It would be easier to invalidate a MAC address than it is to do that with using the actual key (MAC=96 bits vs RAS key=2048). Hence smaller/faster hash table.
What I propose is that someone who has a rooted Evo that has either "lost", or severely damaged (but still accessable via USB by fastboot) their phone that will be going back to Insurance to pull their 4G key by redsolar's process. I in turn will hexedit the key to reflect my MAC address, load it on my borked phone, and see if once Sprint deactivates the phone donor if I would still have 4G. At that point we will know if Sprint is using the MAC address, or the actual key to allow/deny access to Wimax.
The thing is if it works it will have to be one donor key, to one borked phone. Redsolar already proved that two keys operating at the same time will not work. Maybe a repository? We have alot to gain and nothing to lose.
Anyone up for this?
Discuss.

I have a smashed evo that still can be accessed via ADB, even better, I never used 4G on it because at the time there was no 4G here. I am not sure about fastboot access at this time, but as I said ADB worked so I figure fastboot prolly does too. I work 48 hours this week, so not sure when I could try it.

SteelH said:
I have a smashed evo that still can be accessed via ADB, even better, I never used 4G on it because at the time there was no 4G here. I am not sure about fastboot access at this time, but as I said ADB worked so I figure fastboot prolly does too. I work 48 hours this week, so not sure when I could try it.
Click to expand...
Click to collapse
Awesome. If adb works so will fastboot, you just have to boot into bootloader.
Thanks!

That's easy enough then. I'll have to charge up a battery and go read that other post, unless you want to p[aste the commands I need to do in here.

Here you go!
1. Open command line window (cmd)
2. Make sure you have no PC36IMG.zip files in the root of your SD Card, or it will take a while to power your phone up
3. Power down your phone
4. Power it up while holding down the Volume Down key
5. HBOOT will attempt to scan for PC36IMG files. Let's hope you read carefully and don't have it on your SD Card root
6. Once HBOOT fails to find the file, use Vol Up/Down buttons to go into Fastboot mode
7. Connect the USB cable to your phone (and PC). You may have to install the USB drivers that come with Android SDK, but chances are if you are looking for this solution, you already have them installed and working
8. The FASTBOOT mode will switch to FASTBOOT USB (that's good)
9. Test your fastboot by typing "fastboot oem h" in command window you opened earlier (note, no adb, or adb shell anywhere, the command is "fastboot oem h". From here on all fastboot commands are issued in that window
10. If you see less than ~40 lines of output, you don't have a propertly rooted phone, and you need to do step 1 and step 2 (see above)
11. Dump your wimax data by issuing "fastboot oem saveprt2sd wimax -n wimax.bin" command (varies, anywhere between 7 to 8.5 MB, mine was 7MB)
12. Dump complete partition (~12MB) by issuing "fastboot oem saveprt2sd wimax -n wimax.bin -a" command
13. Reboot your phone
14. Pull the data files you dumped to a safe place ("adb pull /sdcard/WIMAX.BIN" and "adb pull /sdcard/WIMAXRAW.BIN"). Note the capitalization, it's important
PM me when you do it. I'll set up an account on my FTP box for you so you can upload it.

One major flaw to this attempt
0. The public/private keypair contains your phone's MAC address as part of your certificate's Common Name (CN), which is also most likely validated against the current mac on your phone
1 (corollary of 0). The phone must be an "activated and in service" phone for this to work. So if someone is keeping their broken paperweight and paying sprint the monthly fee for it - sure, this will work
2 (corollary of 1). Using a pair of keys from a deactivated phone will not allow you 4G access, sorry .
If through some miracle of Sprint's negligence the above is not true, I will tip my hat off to you
The negligence would mean that they are not checking anything but whether your public key is signed by HTC, and are happy with the actual MAC address that your phone provides them during authentication. That would be a major major flaw, since MAC address is so easy to change in fastboot.

If you read redsolar's thread, you'll see that I've tried this. It's worth it to try again, but for reference purposes, I have tried and failed.
Here's what I've tried:
I've cloned a friend's wimax certs, changed the mac to mine. It worked. Downfall, is that only one of us can be on 4G at a time. (There doesn't seem to be any checking of mac address vs wimax cert)
I actually purchased someone's wimax certs from a phone that is no longer in service, and changed the mac to mine. Didn't work. Flashed back my friend's certs, worked.
Conclusion, the certs are most likely blacklisted if the phone is not in service.

and cannot take advantage since your 4G keys are hosed.
Click to expand...
Click to collapse
Just curious as I no longer live in a 4G area. What causes this "hosing of keys"?

Most of us who lost it did it through a botched wimax update. It's believed to have originally been released by revoked and circulated for a while during the last Eclair update for evo (1.47)
When wimax was initially a pain to flash. It used a write_raw_image command which overwrote wimax partition and in most cases did so over the unrecoverable SSL key pair.
Sent from my PC36100 using XDA App

Hmmm.. I would be using my valid MAC address. Usually it is the MAC since like IP's only one can exist on a network. Though it is quite probable that Sprint's implementation of Wimax does do a key hash. From the original spec of Wimax, the MAC authentication is done first at connection, then an encrypted handshake follows. The only way to see that is by using a Service Monitor, and watch the transaction. But you can't see what happens after the encryption starts (but you can watch what goes on before and after). HTC can't recreate your Wimax keys because Verisign's algorithm uses a random seed generator. So even if you where to get the keys from both the proceeding, and post MAC addresses to do a compare the RSG would be different on all three keys. Verisign made it easy for makers of electronics that use key encryption, it's just a simple web interface that in the case of cellphone the engineer plugs in a starting MAC address, and the number of keys to produce, and the computer just spits them out to the flash table.
I'm still willing to try. Can't screw up my Wimax anymore than what it is.

redsolar said:
Most of us who lost it did it through a botched wimax update. It's believed to have originally been released by revoked and circulated for a while during the last Eclair update for evo (1.47)
When wimax was initially a pain to flash. It used a write_raw_image command which overwrote wimax partition and in most cases did so over the unrecoverable SSL key pair.
Sent from my PC36100 using XDA App
Click to expand...
Click to collapse
Very interesting. I lost mine on 1.47.651. Never used Unrevoke. Thats besides the point. I have a question which I'm sure I have asked before, but just want to make sure that the info I received was accurate.
I have backed up my Wimax partions (I have a wimax.bin that is around 8MB and another wimax.bin that is 12MB). If I ever lost or hosed my wimax, could I just push this partition backup onto the phone and I should get my wimax up and running again?
Thanks for any info!

wsantiagow said:
Very interesting. I lost mine on 1.47.651. Never used Unrevoke. Thats besides the point. I have a question which I'm sure I have asked before, but just want to make sure that the info I received was accurate.
I have backed up my Wimax partions (I have a wimax.bin that is around 8MB and another wimax.bin that is 12MB). If I ever lost or hosed my wimax, could I just push this partition backup onto the phone and I should get my wimax up and running again?
Thanks for any info!
Click to expand...
Click to collapse
If you followed redsolar's procedure, yes.

I would guess they are using a CRL (Certificate Revoked List) that is probably added once you deactivate the phone. I really hate that they didn't store the certs in a cert8.db and key3.db file on /system or something...

Related

G1 Security

Hi all,
I notice on t-mobile (uk) you are accessible to all other t-mobile users on their internal 10.x.x.x network.
I have two sims and can shell from my home machine into my G1 wherever it is and vice versa (which is great, but...)
However this also means other people can too, and I notice the JF image I'm currently running (1.41 - rc8) is permanently listening on port 5037 (i.e. adb)
ADB is a debugging tool, my hunch is this wouldn't be too hard to crash, and leading on from there to run an exploit on it.
adb is of course running as root, so if exploited it's game over....
all in all, I'm rather concerned some 1337 HaXor is gonna take over my phone.
sure I can kill adb, but it would be nice to not have it running at all unless asked for.
Can I remove it from a startup script somewhere?
TOP TIP, make sure when rooting your phone you don't leave telnetd running else you are asking for trouble!!!!!!
I'm surprised no one has commented on this matter yet (I noticed it this morning.)
This is truly something that T-Mobile would have to fix on their end. I haven't had a chance to try it out today, but when my brother gets here I'll be sure to give it a shot (he has a G1 as well.)
I haven't tested this, so I can't vouch that this is an accurate description of how the system behaves.
However, adb should ONLY listen on the usb port. Listening for an adb connection on an internet-facing interface is just crazy.
I don't see adb running as non-root being a big help either. You can still compromise most of the personal data on the phone and run almost arbitrary commands on the phone as non-root. You just can't change the system image.

Obtain MSL code on Linux/Unix

How to find the MSL for your Photon Q
chrisngrod posted a tool for getting the MSL from logcat (http://forum.xda-developers.com/showthread.php?p=31765156) but is in the form of a .bat script, which isn't very useful for Mac or Linux users. I'm a decently regular reader, but I guess I've never posted. So sorry that this isn't in the dev section.
I'm assuming a couple things here
You have the android SDK installed, or at least adb available to you
You have a Motorola Photon Q (on Sprint?) plugged into your computer and appropriate drivers installed (if needed--not sure)
USB Debugging is enabled on your device
You know what a terminal is, or at least how to use one
You are in the current directory of adb. If it's in your path, omit the "./"
Make sure your computer sees your phone
Code:
./adb devices
You should see something like
Code:
List of devices attached
T*******Y device
where *'s are numbers. If you don't see any devices, make sure nothing else is interfering (tethering apps on computer, etc)
Now, go to the dialer on your phone, and dial ##DATA#. A menu should pop up, tap on Data Profile, then the three dots at the top right, and finally Edit. Enter 6 random digits, and click Verify.
Now go back to your computer and run this
Code:
./adb logcat -b radio -d | grep "grde"
Hopefully you'll only see one line. If there's more than one, look for one that looks like this
Code:
09-21 21:56:38.837 360 360 E RIL-MOTEXT: NV Read 32, length 6, data length 6, grde - 313934333230
The last set of numbers is what we care about. Your MSL is encoded in the even digits (in counting i.e. 2, 4 ,6 ,8 ..). Mine happened to be hidden in some 3's. So this phone's MSL is 194320.
Test it out by going back to your phone and typing it in.
This worked for me, and I haven't found anywhere else that talked about doing it for the Photon Q, so please correct any incorrect information.
asinginglamp said:
How to find the MSL for your Photon Q
Now go back to your computer and run this
Code:
./adb logcat -b radio -d
Hopefully you'll only see one line. If there's more than one, look for one that looks like this
Code:
09-21 21:56:38.837 360 360 E RIL-MOTEXT: NV Read 32, length 6, data length 6, grde - 313934333230
The last set of numbers is what we care about. Your MSL is encoded in the even digits (in counting i.e. 2, 4 ,6 ,8 ..). Mine happened to be hidden in some 3's. So this phone's MSL is 194320.
Click to expand...
Click to collapse
I was able to do this with only the phone and connectbot. Putting in a false code and then looking over logcat for the NV Read 32, Mine was also hanging out with a group of 3s.
KitsunePaws said:
I was able to do this with only the phone and connectbot. Putting in a false code and then looking over logcat for the NV Read 32, Mine was also hanging out with a group of 3s.
Click to expand...
Click to collapse
Nice. I tried doing it with aLogcat, but didn't see anything. Didn't think to try connectBot.
with me it was between the 3's, i copied the msl.bat to the ADB-platform tools folder what i use for compiling-decompiling apk's, and it worked.
This Is Cray
Gojira-r32 said:
with me it was between the 3's, i copied the msl.bat to the ADB-platform tools folder what i use for compiling-decompiling apk's, and it worked.
Click to expand...
Click to collapse
err
i tried this method the only thing i see on the transcript using adb logcat is checksubsidylockpasswrdcomplete<>errorno=RIL_OEM_CDMA_GENERIC_FAILURE..
Like ive tried everything, any suggestions..besides call sprint
batzluminatti said:
err
i tried this method the only thing i see on the transcript using adb logcat is checksubsidylockpasswrdcomplete<>errorno=RIL_OEM_CDMA_GENERIC_FAILURE..
Like ive tried everything, any suggestions..besides call sprint
Click to expand...
Click to collapse
Do you get anything with adb logcat?
???
asinginglamp said:
How to find the MSL for your Photon Q
chrisngrod posted a tool for getting the MSL from logcat (http://forum.xda-developers.com/showthread.php?p=31765156) but is in the form of a .bat script, which isn't very useful for Mac or Linux users. I'm a decently regular reader, but I guess I've never posted. So sorry that this isn't in the dev section.
I'm assuming a couple things here
You have the android SDK installed, or at least adb available to you
You have a Motorola Photon Q (on Sprint?) plugged into your computer and appropriate drivers installed (if needed--not sure)
USB Debugging is enabled on your device
You know what a terminal is, or at least how to use one
You are in the current directory of adb. If it's in your path, omit the "./"
Make sure your computer sees your phone
Code:
./adb devices
You should see something like
Code:
List of devices attached
T*******Y device
where *'s are numbers. If you don't see any devices, make sure nothing else is interfering (tethering apps on computer, etc)
Now, go to the dialer on your phone, and dial ##DATA#. A menu should pop up, tap on Data Profile, then the three dots at the top right, and finally Edit. Enter 6 random digits, and click Verify.
Now go back to your computer and run this
Code:
./adb logcat -b radio -d | grep "grde"
Hopefully you'll only see one line. If there's more than one, look for one that looks like this
Code:
09-21 21:56:38.837 360 360 E RIL-MOTEXT: NV Read 32, length 6, data length 6, grde - 313934333230
The last set of numbers is what we care about. Your MSL is encoded in the even digits (in counting i.e. 2, 4 ,6 ,8 ..). Mine happened to be hidden in some 3's. So this phone's MSL is 194320.
Test it out by going back to your phone and typing it in.
This worked for me, and I haven't found anywhere else that talked about doing it for the Photon Q, so please correct any incorrect information.
Click to expand...
Click to collapse
The first command works..Recognizes dev, then the logcat command works ONLY when i leave off at the -d. When i do the process i see the RI-MOTEXTem Hook header type 0, requestcode 0x2000016...blah blah blah..how do i write the second part of the comand..?
msl
I ran into that error- OEMRequestunlock thingy.... I tried looking through myself with alogcat, but nothing... at the time I thought I fixed it by downgrading the android OS... then the .bat still didn't work... I figured out that that was because of the path statement not including the location of findstr.exe (grep in this linux example) but now I think that maybe the .bat file didn't work originally because of the path statement and I maybe didn't have to downgrade the OS, but if you're straight up doing it by typing the command into terminal and with grep no less and encountering the problem, then I'll bet it was necessary to downgrade the OS.
So what I'm saying is- you probably have to downgrade the Android OS to one that has the MSL in the ril. Also, it might not be showing up in aLogcat because you'd have to tell it to read the radio log (which is what the -radio switch does)
Hope this helps
I made one phone call to Sprint tech support and simply asked for my MSL, and the lady gave it to me. No questions asked.

Please help - flashing incomplete

So I was trying to just do a clean install. This phone had no mods installed.
I have done this many times and all went well. I am hoping that someone can help me understand what went wrong.
So working on linux, latest fastboot/adb (29.0.6-6198805) and the March image for blueline.
flashing radio and bootloader went fine. When I got to flashing the kernel it stopped after writing slot_a and rebooting into fastboot. I got the message "waiting for any device"
The phone displayed a warming (see pics) that the bootloader is unlocked and phone vulnerable and gave me an option to pause. after a few seconds it went into a "fastbootd" screen that I never saw before (see pic attached) which gave me options to restart or go back to bootloader. Either option breaks the flashing sequence which ends with error.
Re-flashing produces the same result.
Any suggestions what causes this?
Of course the phone does not boot anymore. But I can get to bootloader again using key sequence. Bootloader is unlocked.
Thank you!
Fastbootd happens part way through a flash-all beginning with Android 10. I assume you are using the flash-all script and now doing each command individually. If not, edit the flash-all to get rid of the -w to dirty flash and keep apps and user data. My guess though is that your path is referring to an older version of fastboot. If you have ever installed the apt version of fastboot, it becomes the first to load in your path. Instead, drop the March files into your updated platform-tools folder and ./ the flash-all command in terminal directly from that folder. In a pinch, you can also sideload the ota zip (which you will need to download separately of course) from fastbootd by entering recovery from there and sideloading. Fastbootd gets you into user space, so you should have adb sideload ability.
there are no older fastboot/adb installed i checked. I did each command individually. Reason is long but the person with long nails in the pic is my daughter who is in Europe and I was trying to troubleshoot her pixel through WhatsApp .
I tried to do this flashing using her Chromebook and the stock linux emulation. This may be the problem i will come back to it.
So all files (images + fastboot/adb) were placed in one directory and I ran ./fastboot....
I can try and move fastboot/adb to a bin directory. i doubt this is the problem though. I ran them from home directory before.
I can try a sideload. never done it though.
Here's what i think happens and maybe you can tell me if sideload may avoid this situation:
ChromeOS has to give permission to Linux to use USB for a specified device. It does not remember that device after being disconnected though. Therefore I suspect that during the reboot into fastboot the phone looses USB permission for a second and hence breaks the process.
With all the covid thing all she has available is her Chromebook. I have a linux machine but it's here across the pond.
So does a sideload involve any intermittent re-boots where I may loose USB permissions?
sliding_billy said:
Fastbootd happens part way through a flash-all beginning with Android 10.
Click to expand...
Click to collapse
I did not know that.
What is the "normal" sequence of events? In our case it got to fastbootd and the laptop seemed stuck into "waiting for any device" Am i supposed to press anything or it resumes on its own?
We tried choosing bootloader once and reboot another time but in both cases the process broke down. Are we supposed to wait longer or what?
metricusa said:
there are no older fastboot/adb installed i checked. I did each command individually. Reason is long but the person with long nails in the pic is my daughter who is in Europe and I was trying to troubleshoot her pixel through WhatsApp .
I tried to do this flashing using her Chromebook and the stock linux emulation. This may be the problem i will come back to it.
So all files (images + fastboot/adb) were placed in one directory and I ran ./fastboot....
I can try and move fastboot/adb to a bin directory. i doubt this is the problem though. I ran them from home directory before.
I can try a sideload. never done it though.
Here's what i think happens and maybe you can tell me if sideload may avoid this situation:
ChromeOS has to give permission to Linux to use USB for a specified device. It does not remember that device after being disconnected though. Therefore I suspect that during the reboot into fastboot the phone looses USB permission for a second and hence breaks the process.
With all the covid thing all she has available is her Chromebook. I have a linux machine but it's here across the pond.
So does a sideload involve any intermittent re-boots where I may loose USB permissions?
Click to expand...
Click to collapse
metricusa said:
I did not know that.
What is the "normal" sequence of events? In our case it got to fastbootd and the laptop seemed stuck into "waiting for any device" Am i supposed to press anything or it resumes on its own?
We tried choosing bootloader once and reboot another time but in both cases the process broke down. Are we supposed to wait longer or what?
Click to expand...
Click to collapse
I've never ran ChromeOS, but the reboot into fastbootd not retaining the connection would definitely be a problem. The sideload does no reboots until install is complete, so that would be a better way for sure. In reality the phone did at least one reboot into fastbootd. You'd need to try a flash-all with -w in place to see if it could pull off a clean install with the factory image and not lose track of the connection. No doubt it will lose track with individual commands . The normal sequence for factory flash now is just that... run the flash-all .sh it will go into fastbootd during install while terminal will continue to work. There are definitely some spots where nothing appears to be happening on the phone or terminal until reboot. Given the remote nature of your install, I do think a sideload (follow the directions on the pixel ota developers page where you DL the file) is the best option for you.
metricusa said:
there are no older fastboot/adb installed i checked. I did each command individually. Reason is long but the person with long nails in the pic is my daughter who is in Europe and I was trying to troubleshoot her pixel through WhatsApp .
I tried to do this flashing using her Chromebook and the stock linux emulation. This may be the problem i will come back to it.
So all files (images + fastboot/adb) were placed in one directory and I ran ./fastboot....
I can try and move fastboot/adb to a bin directory. i doubt this is the problem though. I ran them from home directory before.
I can try a sideload. never done it though.
Here's what i think happens and maybe you can tell me if sideload may avoid this situation:
ChromeOS has to give permission to Linux to use USB for a specified device. It does not remember that device after being disconnected though. Therefore I suspect that during the reboot into fastboot the phone looses USB permission for a second and hence breaks the process.
With all the covid thing all she has available is her Chromebook. I have a linux machine but it's here across the pond.
So does a sideload involve any intermittent re-boots where I may loose USB permissions?
Click to expand...
Click to collapse
I had the same problem with my PixelBook. My conclusion was ChromeOS does not forward the USB connection to the Linux container before the phone times out, but your theory about loosing USB permission may be correct. If you have developer mode enabled on the ChromeBook, try booting into Linux from a USB stick instead of running the Linux container. Unfortunately, I have no other solution.
dcarvil said:
If you have developer mode enabled on the ChromeBook, try booting into Linux from a USB stick instead of running the Linux container. Unfortunately, I have no other solution.
Click to expand...
Click to collapse
I agree but with my daughter abroad she can't do the USB stick thingy.
I'll explore the sideload. I'll have to test everything on my Pixel 3. I was trying to avoid that. I have both a Linux machine and a Chromebook here.
And yes, the permission is lost quite fast during a phone reboot. I tested it. I do however find it amazing that a Chromebook is capable of doing such advanced tasks.
I'll try again tomorrow and report back.
metricusa said:
I agree but with my daughter abroad she can't do the USB stick thingy.
I'll explore the sideload. I'll have to test everything on my Pixel 3. I was trying to avoid that. I have both a Linux machine and a Chromebook here.
And yes, the permission is lost quite fast during a phone reboot. I tested it. I do however find it amazing that a Chromebook is capable of doing such advanced tasks.
I'll try again tomorrow and report back.
Click to expand...
Click to collapse
What if you get phone into fastbootd, then plug in so the phone is recognized, then "fastboot update image-blueline-qq2a.200305.002.zip"
Or just unplug it once it gets to fastbootd and plug it back in...if it becomes unrecognized, unplug and plug it back in again when needed?
wangdaning said:
What if you get phone into fastbootd, then plug in so the phone is recognized, then "fastboot update image-blueline-qq2a.200305.002.zip"
Or just unplug it once it gets to fastbootd and plug it back in...if it becomes unrecognized, unplug and plug it back in again when needed?
Click to expand...
Click to collapse
I'll try that.
Unplugging opens another can of worms:
The reason we are doing this is bc the phone suddenly has a problem charging. Opening the battery setting shows a red battery with the message "can't charge now". Also if plugged in while turned off the little battery shows a question mark.
Google offered to exchange it but shipping it back and forth from Europe is 140$ each way and I got a new phone for less. On top of this I risk having to pay import taxes on it.
So in short, if unplugged the phone dies.
The intent of doing this burn was to see if this issue is software related. As I said it happened suddenly after a simple restart. Battey was fine and after restart was not.
I have a feeling it's not the software though.
Wow, that is really high for shipping. I mean, I ship from China to the US for like 20 USD, beside the point though really. She knows no one with an ordinary PC to test? Or a local cell phone service center in her area that could evaluate it? I mean the battery could be dead, or it could have, ehehe, been dropped and a connection loose or something. Not trying to imply anything there, just saying there are many variables at play. I would say if getting to fastbootd and trying the update does not work, then she should really look for a repair shop. Depending on where she is it should be fairly cheap or even free for them to look at it.
wangdaning said:
Wow, that is really high for shipping. I mean, I ship from China to the US for like 20 USD, beside the point though really. She knows no one with an ordinary PC to test? Or a local cell phone service center in her area that could evaluate it? I mean the battery could be dead, or it could have, ehehe, been dropped and a connection loose or something. Not trying to imply anything there, just saying there are many variables at play. I would say if getting to fastbootd and trying the update does not work, then she should really look for a repair shop. Depending on where she is it should be fairly cheap or even free for them to look at it.
Click to expand...
Click to collapse
Well the option is through fedex/ups. Shipping USPS has resulted many times in the package being stuck in customs for weeks. And the price is not necessarily much lower.
Yes we looked into having it seen by a repair shop but normally we should have been able to do flash it ourselves. Plus it's a good experience for her to be exposed to some linux and the basics of hacking a phone.
Another reason is that this has a high chance of being hardware related so whatever we spend on repair shop is wasted money.
I got her a Samsung A51 and she is out of trouble for now. I have had several bad experiences with pixels so this time I am officially done with spending a fortune on them.
Update as of this morning: It is clear that the USB permission is lost while fastboot performs a reboot during flashing. We tried to quickly re-allow the permission but while the terminal waits for a device patiently it looks that the loss of link is long enough for the phone to decide that something went wrong and goes into fastbootd.
We also tried to flash just the boot.img in both slots . that went well apparently but did not change anything and the phone is still unbootable. Tried recovery but it went back into bootloader with the error that it cannot boot boot.img.
So next step is sideload. i have to figure how that works
fastboot reboot fastboot, select recovery, apply update from ADB, adb sideload whatever.zip
Seems if there is no way to keep the phone on without it plugged in that is a problem. What about a cheap wifi charger, will that keep it on? I mean the phone will technically reboot going from bootloader to fastboot (fastbootd) and the permission will be lost. At least a repair shop could use a proper computer to test it.
wangdaning said:
Seems if there is no way to keep the phone on without it plugged in that is a problem. What about a cheap wifi charger, will that keep it on?
Click to expand...
Click to collapse
The phone stays on while it is connected to usb. Never died in this process. The connection loss is because of permissions not power.
Latest update: adb sideload worked just perfectly phone is back in running condition.
The bad news, which was expected, is that we did not solve the battery problem so it's hardware related. See attached pic.
In any case: A million thanks for the help. You guys rock!
At least we found out that a Chromebook can do some of these tasks but cannot do the flashing.
I placed a question on Chromebook community about a possible way to give Linux permanent permission to USB. If I find out any good news I'll report back.
Thank you and stay safe!
metricusa said:
Latest update: adb sideload worked just perfectly phone is back in running condition.
The bad news, which was expected, is that we did not solve the battery problem so it's hardware related. See attached pic.
In any case: A million thanks for the help. You guys rock!
At least we found out that a Chromebook can do some of these tasks but cannot do the flashing.
I placed a question on Chromebook community about a possible way to give Linux permanent permission to USB. If I find out any good news I'll report back.
Thank you and stay safe!
Click to expand...
Click to collapse
Glad you got the device up. As for the charging issue, have you tried a different wired charger or a wireless charger? I assume you are converting power somehow in Europe.
sliding_billy said:
have you tried a different wired charger or a wireless charger?
Click to expand...
Click to collapse
Yes. Tried different charger and a battery pack and also charging through USB from laptop. Did not try wireless. Before I bought the new phone she was using the phone connected to a battery pack.
As you can see in the pic the battery is red and it says "can't charge" while confirming that it does receive power.
I Googled the issue and there are several reports about same behavior. I also did talk to a repair shop over the phone and they said that the power module goes bad and it is a known problem with pixel 2 and 3. He also mentioned that there is a class action lawsuit but I cannot confirm the info.
It doesn't really matter at this point.
My aim was to eliminate the remote possibility this problem was due to some software issue. We solved this and from now on it's a google issue. As I mentioned Google offered to exchange the phone. But with COVID we had to postpone some flights when we could have made the exchange.
I will contact Google and ask for some workaround the COVID crisis. I hope they will be cooperative. I don't see why not.
Thank you all for your help!

Unlock Screen through PC??

My wife dropped her Pixel 4a yesterday and completely broke the screen. You can't see anything except done bright green splotches and lines and it doesn't respond to touch. I bought her a new phone and synced her account, but because her Drive storage was full, the last months photos are not synced. I upgraded her to the 100gb plan and let the broken phone sit hoping it would automatically upload the missing photos but it did not.
So at this point my only options are to somehow connect it to my computer and get them, or replace the screen. I'd rather not pay $140 to replace the screen JUST to get a month's worth of photos.
My question is, can I connect the phone to the PC and remotely enter her PIN and then access the files?
I searched online but the two softwares I found say they will wipe data.
x_orange90_x said:
My wife dropped her Pixel 4a yesterday and completely broke the screen. You can't see anything except done bright green splotches and lines and it doesn't respond to touch. I bought her a new phone and synced her account, but because her Drive storage was full, the last months photos are not synced. I upgraded her to the 100gb plan and let the broken phone sit hoping it would automatically upload the missing photos but it did not.
So at this point my only options are to somehow connect it to my computer and get them, or replace the screen. I'd rather not pay $140 to replace the screen JUST to get a month's worth of photos.
My question is, can I connect the phone to the PC and remotely enter her PIN and then access the files?
I searched online but the two softwares I found say they will wipe data.
Click to expand...
Click to collapse
You MIGHT be able to get the phone to show up on Windows by mirroring it (either over USB or over Wi-Fi).
My phone isn't broken, but I can easily mirror the phone and unlock the lock screen and view it and control it using free software on Windows.
You can also mount the entire phone onto Windows as a drive letter over Wi-Fi if you have a webdav server on it.
Here are some screenshots of what I do, and I have some tutorials here on how to set that up if you need them.
if you didn't enable usb debugging before the accident, nothing can be done now
Nfury00701 said:
if you didn't enable usb debugging before the accident, nothing can be done now
Click to expand...
Click to collapse
Good point!
I assumed the op had already enabled USB debugging.
In fact, most people I know (including me) enable Developer Options the instant we get a new phone, and then we enable Mock Location and USB Debugging the second instant, so every Android device I've ever touched has had those two options set as the first things done.
But the user we're both trying to help might not have done that.
If he has any server (FTP, WebDav, SMB, etc.) set up to run at boot time, then he still has a chance (as most people set up one of those also, as far as I know).
If not, this is a lesson to the rest of us to have a failsafe plan if the screen won't work (my personal favorites are Vysor & WebDav).
I'm pretty certain I didn't enable the USB Debugging. Maybe I'll order a cheap screen from eBay just to get it working. Obviously it would be very low quality compared to OEM, but it's a fraction of the price and should get the job done.
Thanks for the replies!
Edit:
Well scratch that idea. Can't get a screen for under $130 now. The repair shop quoted me $140 I think and it's an OEM replacement. Still though, not gonna do it, at least not right now.
x_orange90_x said:
I'm pretty certain I didn't enable the USB Debugging.
Click to expand...
Click to collapse
Drat.
I am racking my brain trying to figure out a way you can access the phone from your PC (over Wi-Fi or over USB) without interacting with the screen, which I do all day, every day, but I'm already connected over a variety of servers that are either on the phone (e.g., WebDAV) or on Windows via adb (e.g., Vysor, Scrcpy).
I guess the lesson for anyone reading this is set up a wireless server now, as they're free, and they need ZERO software on Android.
x_orange90_x said:
I'm pretty certain I didn't enable the USB Debugging. Maybe I'll order a cheap screen from eBay just to get it working. Obviously it would be very low quality compared to OEM, but it's a fraction of the price and should get the job done.
Thanks for the replies!
Edit:
Well scratch that idea. Can't get a screen for under $130 now. The repair shop quoted me $140 I think and it's an OEM replacement. Still though, not gonna do it, at least not right now.
Click to expand...
Click to collapse
I dont know if this will work, and if you need the bootloader unlocked (for the TWRP stuff), but I would try the following.
Try to access the phone in recovery through adb. i think you would of had to have previously authorised adb from your PC to the device, for this to work.
NB: You can run TWRP, without flashing it.
Run adb through TWRP, and try accessing the photos/data. I would guess you wil need to unencrypt the phone first.
Run TWRP, unencrypt the phone and do a backup, and try viewing the contents through 7Zip on your PC
DiamondJohn said:
I dont know if this will work, and if you need the bootloader unlocked (for the TWRP stuff), but I would try the following.
Try to access the phone in recovery through adb. i think you would of had to have previously authorised adb from your PC to the device, for this to work.
NB: You can run TWRP, without flashing it.
Run adb through TWRP, and try accessing the photos/data. I would guess you wil need to unencrypt the phone first.
Run TWRP, unencrypt the phone and do a backup, and try viewing the contents through 7Zip on your PC
Click to expand...
Click to collapse
Sounds plausible, but I'm no expert on this topic. Remote-running TWRP sounds very promising. I'm willing to give it a shot if you can instruct me or provide me instructions to do so.
x_orange90_x said:
Sounds plausible, but I'm no expert on this topic. Remote-running TWRP sounds very promising. I'm willing to give it a shot if you can instruct me or provide me instructions to do so.
Click to expand...
Click to collapse
Its not what I would call "remote running". Its running it without flashing it.
The following is a log of my script. I copy the TWRP img file to g:\recovery and then run the following in a command prompt on windows.
Code:
>g:
>cd \recover
>PATH=%PATH%;"%SYSTEMROOT%\System32";"C:\Java\x86\Android\android-sdk\platform-tools";
>fastboot devices
08721KEC209540 fastboot
>fastboot boot sunfish_twrp201017-test5.img
Its probably an outdated TWRP, and I changed the return from fastboot devices for privacy
I defer to the extraordinary knowledge of DiamondJohn where all I want to add is that I searched EVERY similar thread on XDA and referenced over two hundred of them, sorted in LIFO order, over here:
What is the best XDA solution to control Android on the PC & recover data over Wi-Fi when the user suddenly has an unresponsive broken screen?
The OP "might" profit from reading some of them, particularly:
Tutorial : How to turn on USB debugging on device with broken screen, by MiroBiala, on Jun 28, 2017
[Tool][Windows] Control a device with a broken screen. Now with touchscreen support!!, by k.janku1 on Jun 17, 2014
[TOOL] ADB Data Recovery (recover data from a phone with broken screen), by FuzzyMeep Two, on Jun 26, 2013
Bear in mind that adb can remotely push buttons from the PC to Android over Wi-Fi if you happen to know the pixel location of those buttons on the Android device (but, of course, adb has to work first).
Good luck. You're in good hands with DiamondJohn (who knows far more than I ever will about this topic).

[GUIDE] Xiaomi Qin F21 Pro with US Bands

Xiaomi Qin F21 Pro with US Bands
LTE Bands 2, 4, 12, 13, 17, 66, 71 as provided by the US Qin F30 Kosher.
Things you need:
Windows PC (as far as I know this only works on Windows)
Qin F21 Pro with unlocked bootloader and TWRP installed.
See: https://forum.xda-developers.com/t/tools-mod-scripts-mlgmxyysds-qin-f21-pro-unlock-tool.4368277/
(This can be a headache, there are probably better ways to do this.)
See: https://forum.xda-developers.com/t/...om-firmware-root-playstore-certified.4405615/
You only have to follow this tutorial up to the point of installing the boot_2.img in TWRP you do not have to root if you don't want to. I do believe most of us with F21's probably have already done this entire tutorial though.
SP Flash Tool: See tutorial above, it comes with it.
ADB (and please know how to use it): https://www.xda-developers.com/install-adb-windows-macos-linux/
The files I provide with this link Which are: F30 files (from my purchased F30), my edited scatter file to show new partitions, SN Write tool with provided Database files.
https://www.mediafire.com/file/3fba0dugos3lkdv/F30_US_LTE_Bands_Package.zip/file
I WILL NOT BE HELD RESPONSIBLE IF YOUR PHONE DOESN'T BOOT, SOFT/HARD BRICKED! THIS TUTORIAL IS TO DO AT YOUR OWN RISK!
GUIDE:
1. Write down your F21's Original IMEI, Wifi Mac Address, and Bluetooth Address.
Go into your phone settings and scroll all the way down to "About Phone".
Here you will find your IMEI, Device Wi-Fi MAC address, and Bluetooth address.
WRITE THESE DOWN!!!!!!!! YOU NEED THESE LATER!!!!!!! I even included a txt file for you to do it in!
We want to write these down because we will need them for the SNwriter tool later.
2. Turn off your phone and boot into TWRP, you can do this by holding the heart/owl key (top left) and the * (star, bottom left) key, you will see the Douqin Logo. Keep holding until TWRP boots.
3. Plug the F21 into computer and TWRP will allow ADB connections. We are going to use ADB to pull/backup your modem and identifier files in case you mess up =)
DO NOT SKIP THIS STEP. WE WILL BE OVERWRITING THESE FILES - THEY CONTAIN THE IDENTIFIERS THAT YOU WROTE DOWN ABOVE.
Even though we will no longer be using these files, they are original to your phone, and I think its incredibly important to have a back up. I even included an empty folder for you to put them in!
Use the following ADB commands:
adb pull /dev/block/by-name/nvdata
adb pull /dev/block/by-name/nvram
adb pull /dev/block/by-name/nvcfg
Now find those files and put them some where safe!!!
(You can also use TWRP and copy the files, and put the on a USB stick or maybe some where else on the phone)
4. Turn off the phone again, you can do this from TWRP by going to Reboot and chosing Power Off.
5. Open SPFlash Tool and load the scatter file provided from my files "MT6761_Android_scatter - edited.txt". This will add the NVData, NVRam, NVcfg partitions to flashable partitions.
5a. Uncheck all the boxes we don't need and only check off nvcfg, nvdata, nvram, and md1img_a. These are the ONLY partitions we are flashing. (They should already be selected! BUT SO WILL THE PRELOADER, UNCHECK PRELOADER, I had to include it in the folder for the flashing to work, but we do NOT need to flash it!)
5b. Click the "location" portion of each row and find the corresponding file from the files I provided. (This should already be done!)
5c. When you got everything set up, click the Green Arrow Download button. With your phone turned off, hold the BACK button (top right) and plug it in. It will flash these files to your phone. KEEP YOUR PHONE OFF FOR NOW.
6. Open SNwrite tool on your computer, make sure ComPort says USBVCOM, and Target Type says Smart Phone.
6a. Open the System Config button and make sure ONLY IMEI, BT Address, and Wifi Address are checked off in the "Write Option" (top left) section.
6b. In the DataBase File section (at the bottom) and make sure "Load AP DB from DUT and Load Modem DB from DUT are checked.
6c. Click on the MD1_DB button and select the "MDDB_InfoCustomAppSrcP_MT6761_S00_MOLY_LR12A_R3_MP_V88_3_1_ulwctg_n.EDB" file located in the AP DB Base\\MT6761 folder (within SNwrite folder).
6d. Click on the AP_DB button and seelect the "APDB_MT6761_S01__W1947" file located in the AP DB Base\MT6761 folder (within SNwrite folder).
6e. Click Save and go back to the main window, click on "Start" and a new window will pop up. Remember how I told you to WRITE DOWN all of these from your F21? This is where we need it.
IMEI_1 = your original IMEI.
BT Addr = Your Bluetooth Address (no colons!)
Wifi Addr = Your Wifi MAC Address (no colons!)
6f. Before you click OK be sure to have your phone at the ready. You will need to, just like with SP Flash Tool, hold the back button as you plug it in! Click OK and plug in your phone with the back button held. Wait for the bar to progress and the green PASS signal to light up.
6g. When its done, your original identifiers will be flashed to your phone! Another window may pop up making you think you have to flash again, just close it as long as you saw that Green PASS signal you are good.
7. TURN ON YOUR PHONE AND ENJOY US LTE BANDS!!!!!! 2, 4, 12, 13, 17, 66, 71
These cover most of T-mobile and Verizon users!
Go back into your phone settings as in Step 1 and make sure your original IMEI, Wifi Mac Address and Bluetooth Address are there.
To confirm the bands, use the phone dialer and type:
*#*#3646633#*#*
This will take you into engineering mode (use at your own risk, don't mess with anything!) and click on Band Mode. Scroll thru the bands and you can confirm which ones are active. As far as which ones are currently being used, I am unsure of how to do that just yet. Will update when I know (was told there are apps that might be able to do this).
-----------------------------
Things to note:
AGAIN: BE SURE TO BACK UP YOUR FILES and write down your IMEI, Wifi MAC ADDRESS and BLUETOOTH ADDRESS! I cannot state this enough.
If you do not do the SNwrite tool (section 6 of the steps) you will have DUMMY made-up identifiers, and technically those will work for a while.. but you don't want to have the same ones as others, so please do section 6.
I cannot help you with unlocking your bootloader, that part can be easier and the tool I linked was not fun. There are apparently much easier ways, please look into them.
If you can unlock your bootloader, and install TWRP you can do the rest of these steps easy!
-----------------------------
If you would like to buy me a coffee: https://ko-fi.com/storymode
I'd like to thank:
Jbazt_katuforzs (XDA forums) for the Unofficial Qin F21 Pro firmware tutorial.
Sense_101 (XDA forums) who I couldn't have done this without, they helped me with learning ADB commands and knowing which files I would need to get this done.
mosheys (XDA) who told me about SNwrite tool.. which I knew about, but couldn't work before, and gave me the motivation to try again, really made this all come together.
jbriones95 (Reddit) who got me into Dumbphones and introduced me, through his videos, to the F21 Pro. The perfect phone for me!
eitokai (Reddit) who worked on tinkering with the F30 and made me believe I could do it too, and make progress - and everyone they thanked helped too!
Quick shout outs to Highpowers23 (Reddit), and 154FAviator (Reddit).
Lots of other random tutorials online where other people were trying to do similar things with their phones!!
-edits-
4/25/23: Fixed an issue where SPFlash tool was giving an Invalid Preloader error on Step 5a. I had to add the preloader file to the supplied download, but we do NOT need to flash the preloader. Edited step 5a to reflect change. Thanks to XDA user mosheys for pointing it out =)
amazing. looking forward to trying this out later tonight.
It worked! Amazing. Thank you for putting the time in to write this up.
Wow, and I always thought that network bands are hardware that can't be added...
How's that possible?
Hi
I have been using this flashed US Bands thing on my phone, and I notice there's few places that my phone just gets thrown off service, I can be in middle of a call and the call ends, etc
Also I miss a lot of calls due to it getting thrown off service in certain areas. (not talking here in basements etc, just random on street)
Anybody else experience such issues?
DEV845 said:
Hi
I have been using this flashed US Bands thing on my phone, and I notice there's few places that my phone just gets thrown off service, I can be in middle of a call and the call ends, etc
Also I miss a lot of calls due to it getting thrown off service in certain areas. (not talking here in basements etc, just random on street)
Anybody else experience such issues?
Click to expand...
Click to collapse
I'm sorry I haven't had any issues at all except for one time when I ran out of data unknowingly. What phone provider are you with? You might have to manually add their APNs to your settings.
shulemf said:
Wow, and I always thought that network bands are hardware that can't be added...
How's that possible?
Click to expand...
Click to collapse
That's what they'd like you to believe! It can be mostly true, but since the F21 has a US clone, the F30, I was able to make it work via their files. Next thing I really want to try is adding more bands if possible. But it involves hex editing perhaps which I'm no good at.
CatStoleTheCrown said:
That's what they'd like you to believe! It can be mostly true, but since the F21 has a US clone, the F30, I was able to make it work via their files. Next thing I really want to try is adding more bands if possible. But it involves hex editing perhaps which I'm no good at.
Click to expand...
Click to collapse
If you figure this out . Love my f21 so much since I used your guide
Can someone post a step by step video on how to do this
Will this work on f22 pro also?
Hi there! Thanks so much for the guide and the files
I followed all your instructions with my brand new F21 pro unlocked that I got from aliexpress, 64/4 version. when the phone arrived, it was already unlocked and had TWRP installed. So I went to follow your tutorial from that point. I specifically bought this phone to use on Verizon for a family member that does not use smart phones so this would be big upgrade for them, since most of the options for Verizon basic phones are bad choices.
Anyway, I consider myself fairly intelligent and computer savvy, I followed your instructions exactly and got no errors both times. first, I got the green checkmark after downloading the files then I did the imei writing I got the green PASS with 0 errors
so I go to turn the phone on, the system now appears "kosher." the Chinese play store is gone, etc. the system is telling me there is a software update which I ignore... when I plug the SIM card into the phone, I am not getting any cellular reception, however the phone does see that sim belongs with Verizon. my phone number shows up in the about section, as well as the original imei and Mac and bluetooth address. so it appears my writing to the phone was successful, but for some reason the bands are not active. I can do wifi calling with Verizon but not over cellular.
I really dont think I did anything wrong but I do have a question was the sp flash tool supposed to only say "download" in the drop down box from the first step?? was it supposed to be install and format??? I left it on download because I wasn't instructed to change anything and went about my business but I am just trying to figure out what went wrong.
again, I want to reiterate, the Verizon employee said they did not see the imei I provided to them with my current sim already in the phone, so why could they not see the f21 pro with original imei and lte bands after your guide? was he lying because they do not want me to use this phone? he asked me if the phone was Samsung and I just said yeah, he was foreign and I didn't feel like explaining.
really trying to figure out what went wrong here. it's frustrating that you can get it to work but I can't. I successfully copied the imei, Mac and Bluetooth address so I dont think that is it. when I go to look at the bands in the developer menu, I do not see the bands you mention with a check box next them. does that mean they are not active??
I really dont want to have to return this phone or sell it because it was a gift and it is actually quite nice for the money. so I put the SIM card back in the old basic phone (sonim xp5) and naturally, it is working as it should... this is a LTE sim and both phones use LTE, so I do not see what the problem is
is there something that must be changed manually in the cellular settings after sim insertion such as LTE/ CDMA only or something like that? again I am on Verizon and I have decent coverage where I am trying this.
thanks
it worked ! Thanks for sharing this guide !
TweakBox Tutuapp​
moogpunk said:
Hi there! Thanks so much for the guide and the files
I followed all your instructions with my brand new F21 pro unlocked that I got from aliexpress, 64/4 version. when the phone arrived, it was already unlocked and had TWRP installed. So I went to follow your tutorial from that point. I specifically bought this phone to use on Verizon for a family member that does not use smart phones so this would be big upgrade for them, since most of the options for Verizon basic phones are bad choices.
Anyway, I consider myself fairly intelligent and computer savvy, I followed your instructions exactly and got no errors both times. first, I got the green checkmark after downloading the files then I did the imei writing I got the green PASS with 0 errors
so I go to turn the phone on, the system now appears "kosher." the Chinese play store is gone, etc. the system is telling me there is a software update which I ignore... when I plug the SIM card into the phone, I am not getting any cellular reception, however the phone does see that sim belongs with Verizon. my phone number shows up in the about section, as well as the original imei and Mac and bluetooth address. so it appears my writing to the phone was successful, but for some reason the bands are not active. I can do wifi calling with Verizon but not over cellular.
I really dont think I did anything wrong but I do have a question was the sp flash tool supposed to only say "download" in the drop down box from the first step?? was it supposed to be install and format??? I left it on download because I wasn't instructed to change anything and went about my business but I am just trying to figure out what went wrong.
again, I want to reiterate, the Verizon employee said they did not see the imei I provided to them with my current sim already in the phone, so why could they not see the f21 pro with original imei and lte bands after your guide? was he lying because they do not want me to use this phone? he asked me if the phone was Samsung and I just said yeah, he was foreign and I didn't feel like explaining.
really trying to figure out what went wrong here. it's frustrating that you can get it to work but I can't. I successfully copied the imei, Mac and Bluetooth address so I dont think that is it. when I go to look at the bands in the developer menu, I do not see the bands you mention with a check box next them. does that mean they are not active??
I really dont want to have to return this phone or sell it because it was a gift and it is actually quite nice for the money. so I put the SIM card back in the old basic phone (sonim xp5) and naturally, it is working as it should... this is a LTE sim and both phones use LTE, so I do not see what the problem is
is there something that must be changed manually in the cellular settings after sim insertion such as LTE/ CDMA only or something like that? again I am on Verizon and I have decent coverage where I am trying this.
thanks
Click to expand...
Click to collapse
Hey there,
The fact that the bands aren't checked off in engineering mode indeed means that the bands aren't active (I did it and the bands showed up) you should of course redo the setup carefully in case you might have missed a step.
About Sp flash tool all you have to press is the green download arrow at the top of the window. And remember to make sure to deselect the preloader partition.
And not sure if I understood you correctly but you mentioned that after you finished the process you got the full kosher version on the phone, that shouldn't be the case because we are only copying the necessary partitions from the f30 for the service to work(I might have misunderstood you on that last one).
Potential_Threat said:
Hey there,
The fact that the bands aren't checked off in engineering mode indeed means that the bands aren't active (I did it and the bands showed up) you should of course redo the setup carefully in case you might have missed a step.
About Sp flash tool all you have to press is the green download arrow at the top of the window. And remember to make sure to deselect the preloader partition.
And not sure if I understood you correctly but you mentioned that after you finished the process you got the full kosher version on the phone, that shouldn't be the case because we are only copying the necessary partitions from the f30 for the service to work(I might have misunderstood you on that last one).
Click to expand...
Click to collapse
I had prepared the phone for the user I bought it for thinking I did al the steps right. when I realized the phone wasnt working, I re did the tutorial. it wiped all the apps and work I had previously done on the phone such as adding the play store, certification, etc and various apps. it was ready to go... so when I did the tutorial again, starting at the step where you load the F30 files, the phone appeared "kosher" when I flashed it and was once again app less... that is what I meant. it looked like I had started over.
was there anything about the bootloader or the unlocking process that may have not been done properly by the seller of the phone? Again, the phone arrived to me already unlocked and with TWRP installed so I skipped all those steps thinking I wouldn't need to do them.
what did I do wrong if I erased all the apps and the kosher version got installed and wiped the stuff I had already done when I tried to redo the process ?? I'm literally just following the instructions on a brand new phone.
the only thing I could think that I did wrong was skip the unlocking process but I only did that because I assumed the phone was already unlocked. I would assume it's unlocked if TWRP was already installed.... am I wrong ?
moogpunk said:
the only thing I could think that I did wrong was skip the unlocking process but I only did that because I assumed the phone was already unlocked. I would assume it's unlocked if TWRP was already installed.... am I wrong ?
Click to expand...
Click to collapse
Do you mean you bought the version with the Google play store ("unlocked") and that's why you bypassed the other stuff?
moogpunk said:
I had prepared the phone for the user I bought it for thinking I did al the steps right. when I realized the phone wasnt working, I re did the tutorial. it wiped all the apps and work I had previously done on the phone such as adding the play store, certification, etc and various apps. it was ready to go... so when I did the tutorial again, starting at the step where you load the F30 files, the phone appeared "kosher" when I flashed it and was once again app less... that is what I meant. it looked like I had started over.
was there anything about the bootloader or the unlocking process that may have not been done properly by the seller of the phone? Again, the phone arrived to me already unlocked and with TWRP installed so I skipped all those steps thinking I wouldn't need to do them.
what did I do wrong if I erased all the apps and the kosher version got installed and wiped the stuff I had already done when I tried to redo the process ?? I'm literally just following the instructions on a brand new phone.
Click to expand...
Click to collapse
And now with the kosher version, are you following the steps to fully unlock it first?
nemoslumbers said:
And now with the kosher version, are you following the steps to fully unlock it first?
Click to expand...
Click to collapse
I admit I skipped the unlocking part because I bought the "google unlocked world" version from aliexpress, and so I assumed it was done. and in the developer menu it said the phones boot loader was already unlocked... and the phone had TWRP already, so I assumed in order for TWRP to be there, it was unlocked already.
so I guess you are telling me that I shouldn't have skipped it because it wasn't truly unlocked then? okay, I will try it again.
I do not have the kosher version, I was referring to my f21pro phone after flashing with scatter f30 file.
also I just realized that when I was trying to unlock I was holding the wrong two "top buttons" I thought it was the owl button and the back button, not the camera button and the back button
moogpunk said:
yes. I skipped the unlocking part because I bought the "google unlocked world" version from aliexpress, and so I assumed it was done. and in the developer menu it said the phones boot loader was already unlocked... and the phone had TWRP already, so I assumed in order for TWRP to be there, it was unlocked already.
so I guess you are telling me that I shouldn't have skipped it because it wasn't truly unlocked then? okay, I will try it again.
I do not have the kosher version, I was referring to my f21pro phone after flashing with scatter f30 file.
also I just realized that when I was trying to unlock I was holding the wrong two "top buttons" I thought it was the owl button and the back button, not the camera button and the back button
Click to expand...
Click to collapse
Maybe give the two top buttons a try before trying the full unlock route? Only a suggestion! I also got the google unlocked world version and was going to try putting all of this on here this weekend. Hoping we don't actually have to go through the full unlock process and maybe it was just the wrong button combo!
nemoslumbers said:
Maybe give the two top buttons a try before trying the full unlock route? Only a suggestion! I also got the google unlocked world version and was going to try putting all of this on here this weekend. Hoping we don't actually have to go through the full unlock process and maybe it was just the wrong button combo!
Click to expand...
Click to collapse
I've read some conflicting reports about which buttons it's supposed to be. The actual readme says it's the top two buttons (Owl+back) and someone else, an administrator here actually, posted a photo circling the #+back button.... and someone liked that post assuming it was true
also, someone else said you can only get into TWRP by holding the Star and Owl button when the phone turns on then you have to immediately press the up and back button to boot into TWRP... which isn't entirely true... all you have to do is hold Star+Owl button to boot into TWRP...
I will admit I am new to the world of modding phones but not modding electronics which is why I felt confident enough to take on this project. I have modified many iPods with rockbox in my day and done physical modifications. I find this fun but it's teetering on extremely frustrating.
I am going to have to do the entire unlock process from the very beginning because I don't have any other choice, otherwise I am left with a phone I cannot use on Verizon. it will be waste of ~140usd. not the fault of the aliexpress seller, just poorly written instructions and dumb windows compatibility issues.
I cannot get the phone unlocked because I cannot get my computer to recognize the phone via usb. no amount of button combinations are letting my windows computer see the phone so I cannot unlock it.

Categories

Resources