Unlock Code Found Infuse 4G **Root Required** - Samsung Infuse 4G

***** IMPORTANT ROOT IS REQUIRED BEFORE PROCEEDING *****
TO ROOT YOUR INFUSE 4G GO THE FOLLOWING LINK AFTER ROOTING PROCEED BELOW
http://forum.xda-developers.com/showthread.php?t=803682
***** ALSO PLEASE READ CAREFULLY BEFORE ACTUALLY APPLYING STEPS *****
All right ladies and gentlemen, coders and non coders again I have personally found the unlock code NOT THE FREEZE CODE only the unlock code for your Samsung Infuse 4G by ATT hidden in the same files as previous Samsung phones.
This procedure is similar to finding the unlock code for the Vibrant 4G for those that have performed my steps in the past it should be a no brainer but if not please once again read everything carefully its not hard but just takes patience Of-course this all depends on your dedication and time but hopefully I have simplified it for you.
Steps:
1. Install "010 Hex editor" you can use trial does not have to be registered
2. Go to your Infuse 4G and open a terminal emulator (free on the Market) - (Root Required)
The following steps are credit to SS2006 on a different post
*** Dont forget the (su) command *** after the second line
_____
after opening a terminal emulator type the following
cd /dev/block <enter>
su <enter> <at this point your phone will ask for superuser access ALLOW it if you already haven't done so>
dd if=/dev/block/bml3 of=/sdcard/external_sd/bml3.bak <enter>
note: if you dont have an external SD CARD type the following
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
Go find the file on your SD Card or Internal Storage depending on your situation and transfer it to your computer
3. Open 010 Hex Editor
4. In 010 Hex Editor go to the Menus above and select VIEW>LINEFEEDS>SELECT CUSTOM>SET YOUR BYTES TO "32" Nothing Less
5. Locate the bml3.bak file you created and transfered to your computer and open it using the editor
(CREDIT TO FR0Z3N FOR CLARIFYING THE FOLLOWING 2 STEPS)
6. Using your keyboard select CRTL+F to search for a hex string, when the search window pops up select "Hex byte" in the Type field and then search for the following string below:
"FFFFFFFFFF0100000000" ALL TOGETHER, Then Hit the FIND ALL button to the right, some of you will get many results and others up to 10 results on your screen below
7. If you look at your Hex editor there are 3 window panes on the selected line (See Image Below)
e.g 4CCC60h <-- Offset
01 01 01 01 < -- Hex Keys
yyyyyyyyy <- ASCII text where your code is
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
8. Go through each result from the above search and you will see on the 3rd window pane (as shown on pic above) after the hex keys there is an 8 DIGIT CODE (Write this code Down) this is your unlock code NCK for your phone
Sidenote: SCAN THROUGH EACH RESULT AND YOU WILL SEE THAT IN YOUR RESULTS SOME OF YOU MAY GET UP TO 3 DIFFERENT 8 DIGIT CODES WRITE THEM ALL DOWN NORMALLY THE 8 DIGIT CODE THAT APPEARS THE MOST WILL BE THE ONE THAT UNLOCKS YOUR PHONE THE OTHER CODES MAY BE YOUR FREEZE CODE BUT I HAVE NOT TESTED THIS YET THIS 8 DIG CODE SHOULD SHOW ON AT-LEAST ONE MORE RESULT CHECK ALL YOUR RESULTS FROM THE SEARCH ABOVE( SOME OF YOU WILL HAVE YOUR CODE SHOWN AT-LEAST 2 TIMES AND SOME OF YOU WILL HAVE THE CODE SHOW MORE THAN 4 TIMES) YOUR RESULTS MAY VARY EVEN UP TO 39 RESULTS AGAIN SCAN THROUGH ALL RESULTS
**** TO INPUT THE UNLOCK NETWORK CODE DO THE FOLLOWING ****
9. Turn off your phone
10. Insert a foreign SIM card not attached to your current provider (e.g if you have ATT use a TMOBILE SIM CARD) and turn on your phone
11. You will be prompted to enter a Network Unlock Control Key ( Use the code above that you wrote down and type it in your phone exactly)
12. After entering your NCK please hit Unlock or GO button and you should see a screen that says "network unlock successful" and your phone should go in the main screen after your phone has been unlocked.
THATS IT FOLKS HAVE FUN
PS> If you entered an incorrect code you must of entered the wrong code or wrote it down wrong please read carefully and verify the code matches the results from above in at-least more than one instance
SHOULD ANYONE NEED HELP PM ME AND I WILL BE GLAD TO HELP
personally my INFUSE 4G has been rooted from day 1 and wi-fi tethering enabled and now it has been Unlocked

10. Insert a foreign SIM card not attached to your current provider (e.g if you have
Where can I go to get this SIM card?
Regards,
Jim Jep

JimJep said:
Where can I go to get this SIM card?
Regards,
Jim Jep
Click to expand...
Click to collapse
You can go out and buy any SIM card not attached to your phone example buy a prepaid SIM like SIMPLE MOBILE / TMOBILE etc.. put in any sim card that is not your carriers basically it does not have to be an International SIM if that's what your thinking
Hope this helps

This one works and is much easier.
Also no root required (it does root the phone temporary but returns it to stock without you having to do anything).
Click me.

Papi4baby said:
This one works and is much easier.
Also no root required (it does root the phone temporary but returns it to stock without you having to do anything).
Click me.
Click to expand...
Click to collapse
If you read through the posts of the link you posted no all get the code some get NULL some get nothing in this instance you actually see the code you are risking in changing file on your phone and possibly bricking your phone. My method is a simple file where your code is hidden.
To each his own, various methods I tried that link before I did mine and did not work so I tried my own method and what would you know It worked
Thanks again though for showing the options
Note: Please post your results thanks

Thankz Sanfranx415, your unlock instruction worked perfect for me. One thing i have noticed, Terminal Emulator didnt like back space, so be accurate with those commands, other than that yours is perfect. Thankz again.

Hi there.
Thanks for such a great and helpful post.I have a couple questions...what is the freeze code and what is the difference between this code and the freeze.
Once again thank you.

sweet, this works on this model as well
going to be unlocking mine right now

The freeze code is the code you would use if you tried too many times to unlock your phone
Sent from my SAMSUNG-SGH-I997 using XDA Premium App

fr0z3n said:
sweet, this works on this model as well
going to be unlocking mine right now
Click to expand...
Click to collapse
Go for it, as always I credit where credit is due thank you
Sent from my SAMSUNG-SGH-I997 using XDA Premium App

NGOPHUSAI said:
Thankz Sanfranx415, your unlock instruction worked perfect for me. One thing i have noticed, Terminal Emulator didnt like back space, so be accurate with those commands, other than that yours is perfect. Thankz again.
Click to expand...
Click to collapse
Yes terminal emulator can be sensitive but i'm glad your unlock was sucessful
Sent from my SAMSUNG-SGH-I997 using XDA Premium App

Re unlock code
Many thanks excellent hack I got there in the end without to many problems, just a quick comment it did return 4 codes 3 all the same 1 different however it was the single code that worked not the 3 the same! however for the faint of heart you do get 10 attempts again many thanks to all who contributed to this hack

Please see my reply in thread thanks man a great job and a great hack

Worked like a charm
Thanks for your tutorial. This worked like a charm.
I had three entries come up and they all had the same code. Verified on a T-mobile Sim.
First time the codedid not work the second time it went in. I must of fat fingered the first try

paul1994 said:
Thanks for your tutorial. This worked like a charm.
I had three entries come up and they all had the same code. Verified on a T-mobile Sim.
First time the codedid not work the second time it went in. I must of fat fingered the first try
Click to expand...
Click to collapse
Your welcome glad to help
Sent from my LG-P999 using XDA Premium App

I had only one code come up, and it worked perfectly.
I used my old T-Mobile SIM.
Thanks for the tutorial.
GREAT HACK!

Confirmation, it works thanks as much as useful this unlock

sanfranx415 said:
***** IMPORTANT ROOT IS REQUIRED BEFORE PROCEEDING *****
TO ROOT YOUR INFUSE 4G GO THE FOLLOWING LINK AFTER ROOTING PROCEED BELOW
http://forum.xda-developers.com/showthread.php?t=803682
***** ALSO PLEASE READ CAREFULLY BEFORE ACTUALLY APPLYING STEPS *****
All right ladies and gentlemen, coders and non coders again I have personally found the unlock code NOT THE FREEZE CODE only the unlock code for your Samsung Infuse 4G by ATT hidden in the same files as previous Samsung phones.
This procedure is similar to finding the unlock code for the Vibrant 4G for those that have performed my steps in the past it should be a no brainer but if not please once again read everything carefully its not hard but just takes patience Of-course this all depends on your dedication and time but hopefully I have simplified it for you.
Steps:
1. Install "010 Hex editor" you can use trial does not have to be registered
2. Go to your Infuse 4G and open a terminal emulator (free on the Market) - (Root Required)
The following steps are credit to SS2006 on a different post
*** Dont forget the (su) command *** after the second line
_____
after opening a terminal emulator type the following
cd /dev/block <enter>
su <enter> <at this point your phone will ask for superuser access ALLOW it if you already haven't done so>
dd if=/dev/block/bml3 of=/sdcard/external_sd/bml3.bak <enter>
note: if you dont have an external SD CARD type the following
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
Go find the file on your SD Card or Internal Storage depending on your situation and transfer it to your computer
3. Open 010 Hex Editor
4. In 010 Hex Editor go to the Menus above and select VIEW>LINEFEEDS>SELECT CUSTOM>SET YOUR BYTES TO "32" Nothing Less
5. Locate the bml3.bak file you created and transfered to your computer and open it using the editor
(CREDIT TO FR0Z3N FOR CLARIFYING THE FOLLOWING 2 STEPS)
6. Using your keyboard select CRTL+F to search for a hex string, when the search window pops up select "Hex byte" in the Type field and then search for the following string below:
"FFFFFFFFFF0100000000" ALL TOGETHER, Then Hit the FIND ALL button to the right, some of you will get many results and others up to 10 results on your screen below
7. If you look at your Hex editor there are 3 window panes on the selected line (See Image Below)
e.g 4CCC60h <-- Offset
01 01 01 01 < -- Hex Keys
yyyyyyyyy <- ASCII text where your code is
8. Go through each result from the above search and you will see on the 3rd window pane (as shown on pic above) after the hex keys there is an 8 DIGIT CODE (Write this code Down) this is your unlock code NCK for your phone
Sidenote: SCAN THROUGH EACH RESULT AND YOU WILL SEE THAT IN YOUR RESULTS SOME OF YOU MAY GET UP TO 3 DIFFERENT 8 DIGIT CODES WRITE THEM ALL DOWN NORMALLY THE 8 DIGIT CODE THAT APPEARS THE MOST WILL BE THE ONE THAT UNLOCKS YOUR PHONE THE OTHER CODES MAY BE YOUR FREEZE CODE BUT I HAVE NOT TESTED THIS YET THIS 8 DIG CODE SHOULD SHOW ON AT-LEAST ONE MORE RESULT CHECK ALL YOUR RESULTS FROM THE SEARCH ABOVE( SOME OF YOU WILL HAVE YOUR CODE SHOWN AT-LEAST 2 TIMES AND SOME OF YOU WILL HAVE THE CODE SHOW MORE THAN 4 TIMES) YOUR RESULTS MAY VARY EVEN UP TO 39 RESULTS AGAIN SCAN THROUGH ALL RESULTS
**** TO INPUT THE UNLOCK NETWORK CODE DO THE FOLLOWING ****
9. Turn off your phone
10. Insert a foreign SIM card not attached to your current provider (e.g if you have ATT use a TMOBILE SIM CARD) and turn on your phone
11. You will be prompted to enter a Network Unlock Control Key ( Use the code above that you wrote down and type it in your phone exactly)
12. After entering your NCK please hit Unlock or GO button and you should see a screen that says "network unlock successful" and your phone should go in the main screen after your phone has been unlocked.
THATS IT FOLKS HAVE FUN
PS> If you entered an incorrect code you must of entered the wrong code or wrote it down wrong please read carefully and verify the code matches the results from above in at-least more than one instance
SHOULD ANYONE NEED HELP PM ME AND I WILL BE GLAD TO HELP
personally my INFUSE 4G has been rooted from day 1 and wi-fi tethering enabled and now it has been Unlocked
Click to expand...
Click to collapse
Thanks. OMG. I did not think that this would work or that I could get 010 Hex Editor to work for me, but, all of you, just take a breath, read carefully, and it works. I just unlocked my Infuse and T-Mobile and Airtel (India) sim cards are both working. I turned off and on my phone multiple times, and low and behold, it still works. Amazing. Thanks for all your work. I will definately donate.

Worked like charm here. I just went into tmobile and they gave me a sim. just finished with an unlock successful. The reason I want it unlocked was to have free tethering (coming from an unlocked streak) but after the unlock when I go to settings it still says must have a plan or whatever at&t crap it says? Can anyone confirm that once unlocked you can tether and hotspots for free under at&t?
Thanks
Sent from my A500 using XDA Premium App

I just wanted to share if you unlocked and are on stock and try to tether or use hotspot and get the verifying crap or you need a plan message you need to disable the system apk tethering manager is the name I believe. To do so you need to be rooted.
1.be rooted
2. Use root explorer to navigate to /system/app and search for tether manager I can't remember exactly but if you go to the T's its the only .apk with tether in the name.
3. Make sure you mount as r/w
4.long press on the target .apk and select rename
5. Rename to "tether whatever.bak" so just replace the extension .apk to .bak. Select ok and your done
Now you can tether and hotspot for free, enjoy
Note: if unlocked on running infused rom the tethering.apk has already been removed
Sent from my infused machine

Related

[APP - Nexus, MT3G, Droid, Evo, Hero] Search2Play - Control Music with the Search Key

Hello all, I just completed an app I'd like to share with you all.
It's called Search2Play, it lets you play and pause your music by pressing a button on your device. On most devices, it is the search key. Currently, the Nexus & MyTouch 3G both use the Search key, whereas the Droid uses the Camera key. If you have physical keys (i.e. Droid, MT3G, G1, etc) then it will work when the phone is locked, but if you have capacitive keys (Nexus, Moment, Eris, Incredible, etc) then the screen must be on (lockscreen works, and fully unlocked of course).
It is available on the market under the name "Search2Play (Root Required)". It's totally free.
It requires root permissions to install. It also requires that you have a version of BusyBox that supports the "cp" command. Only Droid users probably have to worry about the busybox version, as most other custom ROMs have that already. Droid users, I recommend CyanogenMod for Droid or Bugless Beast as I know both of them have the right version.
It does not run in the background or install a service, just makes some changes to a few files on the /system partition.
The UI is very simple, just two buttons and some text explaining the app. Once you hit install, it will ask for permission to use root, you must hit accept or the app won't serve its purpose
The other button, "Restore", lets you remove the mod and go back to stock settings, where the search button brings up search, etc.
Supported Devices:
Nexus
Spica
Hero (GSM & CDMA)
Galaxy S devices (all US variants and probably the i9000 as well. It's not tested)
MyTouch 3G
Droid 1 (I've been told DX & D2 work as well, though I'm not sure how :?)
Evo (must be NAND unlocked or S-OFF)
Desire (must be NAND unlocked or S-OFF)
Free Version on Market:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Or click this from your device: Search2Play Free
See the Market to view a screenshot. Please give me some feedback. Thanks! Hope you enjoy the app :
FOR DEVICE REQUESTS SEE POST #3
Changelog:
1.4.1 thru 2.1:
Add support for Evo, GSM Hero, CDMA Hero, & Samsung Spica (thanks to Aasheet Kumar for the files I needed for Spica support!)
1.4:
Fixed rare root checking bug on some Droid ROMs, and maybe some Nexus ROMs too
1.6+ only now, sorry, it's not like any device this works for isn't updated to at least 1.6
1.3:
Now checks if the SD card is present on launch instead of just crashing if it's not there
Cleaned things up more
Merged some code between the donate & free versions
Better checks to see if it can be installed
1.2.5:
FINALLY stopped it from causing buttons to stop working. Checks for compatibility, and throws an error if it detects it can't run.
1.2:
Droid support!!
More should fix a few FC issues some people have seen. Let me know if you have problems.
1.1.2:
Fixes the not restoring bug
1.1.1:
Failed attempt at fixing the not restoring bug.
1.1:
Support for low res devices.
Now works with MT3G! Since it has a hard search key, it will even work when the phone is locked
Deletes files from SD card once done installing.
Cleaned up more code.
1.0.1:
Sets system back to Read-Only once finished installing
Cleaned up some code, if you have FCs let me know.
1.0:
Base release
If you want to request support for your device here's what I need. Note that your device must be able to be rooted and the system partition must be able to get read/write access from userspace. I.E. any Desire or Evo or any other recent HTC device with a NAND lock will not work, unless it has been NAND unlocked with an S-OFF bootloader, like via Unrevoked.. If your device has all that, get this info and send me an email at [email protected]
Run the command "adb shell mount" and tell me the output. I don't need the whole thing, just the line referring to the system partition. I.E. "/dev/block/mtdblock3 on /system type yaffs2 (ro,relatime)" is the line on the Nexus, it should be similar to that.
Then, run "adb shell getprop" and tell me the 1-4 lines related to the keyboard, like hw.keyboards.*.devname and tell me those lines. I.E the Nexus returns "mahimahi-keypad". Yours should be similar.
Finally, run "adb shell ls /system/usr/keylayout/". It should return a list of files all ending in ".kl"
Remember the keypad name from step 2? Good
There should be a ".kl" file matching that name (like mahimahi-keypad.kl). Pull that file with "adb pull /system/usr/keylayout/keypadname.kl directory" with directory being the folder you want to pull the file to and keypad name being the name from step 2.
Zip that file, and then send it to me please.
That should be it, if you have any questions or problems with this list hit me up on GTalk or email me. [email protected] for both GTalk & email.
Dear geniusdog
I just tried out your app.
I installed it, run it, pressed the install button, allowed root access and rebooted mynexus one. But after that reboot, my sell doesn't react on anypressed buttons anymore. I can only use the touchscreen...
I also tried to restore in your app, but there appeared a window saying that the app is not responding anymore.
How can I manually restore it? Is there a command or some files, I can edit?
Thanks for your help
bayoffire said:
Dear geniusdog
I just tried out your app.
I installed it, run it, pressed the install button, allowed root access and rebooted mynexus one. But after that reboot, my sell doesn't react on anypressed buttons anymore. I can only use the touchscreen...
I also tried to restore in your app, but there appeared a window saying that the app is not responding anymore.
How can I manually restore it? Is there a command or some files, I can edit?
Thanks for your help
Click to expand...
Click to collapse
Sorry for the issue. I have uploaded a new version of both apps that should fix the problem. If you can download the app and install it again, otherwise, PM me & I will give you manual instructions to restore it.
Also, just some technical details, the problem was caused because I had set it to create the directory on the start of the application. After that I removed it once you clicked the button & the install was finished. Because of that, if you clicked restore after install, it would fail to find the directory and then proceed to FC. Sorry for the trouble
Droid Support!!!!
Help!!!!!
I have installed V1.0.4, but my touch keys(back, Menu, Home and Search) don't work.
Then I have tried to restore it, but it's failed.
How could I fix it? Thanks.
My Rom is 2.1-update1 rooted.
hahabear said:
Help!!!!!
I have installed V1.0.4, but my touch keys(back, Menu, Home and Search) don't work.
Then I have tried to restore it, but it's failed.
How could I fix it? Thanks.
My Rom is 2.1-update1 rooted.
Click to expand...
Click to collapse
Hmm I dont have this issue, how does it fail? Does it just freeze, or does it FC, or does it say it finishes then do nothing? Also, what ROM, CM? Enomther? Please let me know so I can work on this.
Also, to fix it, download the attached file, & run the following commands (you must have ADB set up):
adb remount
adb shell rm /system/usr/keylayout/mahimahi-keypad.kl
adb push *path to downloaded file* /system/usr/keylayout/mahimahi-keypad.kl
Or you can just reflash your ROM, either way you'll get the same thing.
My phone is Nexus one.
My rom is Official v2.1-updated1.
When I execute the command as your indication.
"adb shell rm /system/usr/keylayout/mahimahi-keypad.kl"
rm failed for /system/usr/keylayout/mahimahi-keypad.kl, No such file or directory
What's wrong? And thank you for your quick reply.
hahabear said:
My phone is Nexus one.
My rom is Official v2.1-updated1.
When I execute the command as your indication.
"adb shell rm /system/usr/keylayout/mahimahi-keypad.kl"
rm failed for /system/usr/keylayout/mahimahi-keypad.kl, No such file or directory
What's wrong? And thank you for your quick reply.
Click to expand...
Click to collapse
Ok excellent that answers the second part of my question its failing to copy the file back over after deleting the original on certain ROMs.
You can just skip that step and go on to the "adb push" step. Also, can you run the command "adb shell cp" and tell me the output?
bingo! Thanks for your help. It's resolved.
On the other hand, I could get the mod.kl from SD Card, push again, Search2play will work, is that right?
hahabear said:
bingo! Thanks for your help. It's resolved.
On the other hand, I could get the mod.kl from SD Card, push again, Search2play will work, is that right?
Click to expand...
Click to collapse
Yes, but can you tell me what it says if you run the command "adb shell cp"
That will tell me if the issue is with the version of BusyBox on some ROMs.
Geniusdog254 said:
Yes, but can you tell me what it says if you run the command "adb shell cp"
That will tell me if the issue is with the version of BusyBox on some ROMs.
Click to expand...
Click to collapse
C:\N1root>adb shell cp
cp: not found
My god!!! It means there is not cp command in my phone?
hahabear said:
C:\N1root>adb shell cp
cp: not found
My god!!! It means there is not cp command in my phone?
Click to expand...
Click to collapse
Yeah exactly lol. Not sure if that was sarcasm or what, but thats what is causing the FC's and the failures some people are getting. And theres not a damn thing I can do about it.
I would recommend installing the CyanogenMod ROM, since it is fast, adds extra features, and supports cp Then the app will work just fine
Anyway. Thanks for your help. You are so kind. I will try new ROM later. And I will support your work. cu.
hahabear said:
Anyway. Thanks for your help. You are so kind. I will try new ROM later. And I will support your work. cu.
Click to expand...
Click to collapse
Thanks you very much for your support. Glad I could help you, if you have any other problems please email me, email listed in the market
Donate version now just to support me, added support for all devices to free version.
Please donate!
1.3 version uploaded
See changelog.
Any updates on newer phones?
KaliKot said:
Any updates on newer phones?
Click to expand...
Click to collapse
I can make it work for any phone without a NAND lock. Any requests?
I need to do the Galaxy S series, but the only one I can test is the Epic and I'm not sure if the others have different mount tables or not. Desire still has NAND lock so I can't do it. Not sure about Droid2/X. Just email/Twitter/PM me or post here with a request. I'll get back to you.

Samsung Galaxy S 4G Unlock Code Found

***** IMPORTANT ROOT IS REQUIRED BEFORE PROCEEDING *****
***** ALSO PLEASE READ CAREFULLY BEFORE ACTUALLY APPLYING STEPS *****
All right ladies and gentlemen, coders and non coders I have personally found the unlock code NOT THE FREEZE CODE only the unlock code for your Samsung Galaxy S 4G hidden in the same files as previous Vibrant phones.
Please understand this was a hard complex and still needs work procedure.
Of-course this all depends on your dedication and time but hopefully I have simplified it for you.
Steps:
1. Install "010 Hex editor" you can use trial does not have to be registered
2. Go to your SGS 4G and open a terminal emulator (free on the Market) - (Root Required)
The following steps are credit to SS2006 on a different post
*** Dont forget the (su) command *** after the second line
_____
after opening a terminal emulator type the following
cd /dev/block <enter>
su <enter> <at this point your phone will ask for superuser access ALLOW it if you already havent done so>
dd if=/dev/block/bml3 of=/sdcard/bml3.bak <enter>
Go find the file on your SD Card and transfer it to your computer
3. Open 010 Hex Editor
4. In 010 Hex Editor go to the Menus above and select VIEW>LINEFEEDS>SELECT CUSTOM>SET YOUR BYTES TO "32" Nothing Less
5. Locate the bml3.bak file you created and transfered to your computer and open it using the editor
(CREDIT TO FR0Z3N FOR CLARIFYING THE FOLLOWING 2 STEPS)
6. Using your keyboard select CRTL+F to search for a hex string, when the search window pops up select "Hex byte" in the Type field and then search for the following string below:
"FFFFFFFFFF0100000000" ALL TOGETHER, Then Hit the FIND ALL button to the right, some of you will get 2 results and others up to 10 results on your screen below
7. If you look at your Hex editor there are 3 window panes on the selected line (See Image Below)
e.g 4CCC60h <-- Offset
01 01 01 01 < -- Hex Keys
yyyyyyyyy <- ASCII text where your code is
h.t .t p / / i1201.photobucket . com /albums/ bb359/sanfranx415/unlock.jpg
8. Go through each result from the above search and you will see on the 3rd window pane (as shown on pic above) after the hex keys there is an 8 DIGIT CODE (Write this code Down) this is your unlock code NCK for your phone
Sidenote: THIS 8 DIG CODE SHOULD SHOW ON AT-LEAST ONE MORE RESULT CHECK ALL YOUR RESULTS FROM THE SEARCH ABOVE IF YOU HAVE ANY DOUBTS ( SOME OF YOU WILL HAVE YOUR CODE SHOWN AT-LEAST 2 TIMES AND SOME OF YOU WILL HAVE THE CODE SHOW MORE THAN 4 TIMES BUT YOU SHOULD NOT HAVE THAT MANY RESULTS )
**** TO INPUT THE UNLOCK NETWORK CODE DO THE FOLLOWING ****
9. Turn off your phone
10. Insert a foreign SIM card not attached to your current provider (e.g if you have T-mob use an ATT SIM CARD) and turn on your phone
11. You will be prompted to enter a Network Unlock Control Key ( Use the code above that you wrote down and type it in your phone exactly)
12. After entering your NCK please hit Unlock or GO button and you should see a screen that says "network unlock successful" and your phone should go in the main screen after your phone has been unlocked.
THATS IT FOLKS HAVE FUN
PS> If you entered an incorrect code you must of entered the wrong code or wrote it down wrong please read carefully and verify the code matches the results from above in at-least more than one instance
SHOULD ANYONE NEED HELP PM ME AND I WILL BE GLAD TO HELP
personally my SGS4G has been rooted from day 1 and wi-fi tethering enabled and now it has been Unlocked
Thanks, will try
This seems like it doesn't work. If you go to line 157028 you end up at offset 4CAC60h which is nothing but zeros. And if you go to offset 4CCC60h, there's no 01010101 value.
Ok is this BS or what? I noticed that no one else has posted here. I have tried every combination with these line #'s and I cant find any 8 digit code in the third section. con anybody tell me if this is legit?
doesnt work for me either
OMG! Sick it did work, i found it on a different line
w00t just unlocked mine!
fr0z3n said:
OMG! Sick it did work, i found it on a different line
w00t just unlocked mine!
Click to expand...
Click to collapse
Well can you share what line you found it on
I just unlocked two of them, its on different lines everytime.
Folowing are the instructions:
Open the file in Hex Editor
1.) Press - Ctrl + F
A window should open up
2.) Change the type to "Hex Bytes (h)
3.) Value: FF FF FF FF FF 01 00 00 00 00
4.) Click Find All, for me the code
the code is visible right after this, 8 digit code. For me it was repeared 9-10 times in the file.
Good luck
did it work?
No this is not BS and Yes Fr0z3N is correct I should have said look for this line value
Value: FF FF FF FF FF 01 00 00 00 00
You will find your code it takes patience but your code is there if you follow the instructions
Thanks Fr0Z3n for the clarification and more indepth analysis
Works for me, too. Thanx sanfran and fr0z3n.
Sent from my SGH-T959V using XDA App
hello, can you tell me if moving to Europe this device will work also on European 3G UMTS 900/2100 ? Thanks a lot
pipporobby said:
hello, can you tell me if moving to Europe this device will work also on European 3G UMTS 900/2100 ? Thanks a lot
Click to expand...
Click to collapse
Moving to europe has no barring at all- Once you unlock your Phone you can use it with any GSM provider in the world including Europe just switch out the sim Cards with the european SIM
The technology has not changed for 3G phones are still capable of the same frequencies its just 4G is now being used more common in the US depending on your carrier of-course either HSPA or LTE or WIMAX in the US but in Short to answer your question YES it will work
Have fun in Europe
Still no luck Ive tried it over and over the only numbers that I find that are on more than one line is 0123456789 and I doubt that is my unlock code. And I followed the instructions to the "T" Why is this not working? Also you said 2 to 10 results below and I get 160 results every time.
@droidboy: Is your Samsung Galaxy S 4G rooted?
Sent from my SGH-T959V using XDA App
sk8er_ said:
@droidboy: Is your Samsung Galaxy S 4G rooted?
Sent from my SGH-T959V using XDA App
Click to expand...
Click to collapse
Yeah I am rooted, I rooted through super one click v1.7
@Droidboy quick question did you try using any galaxy s unlock app from the market if you did and they alter your original files that came with your phone thus causing a different bak file to be outputed when you do the terminal commands as stated. You should revert if possible with the same program used or PM me and send me your bak file to see if I can help
Thanks. It worked!!
Sent from my SGH-T959V using XDA App
fr0z3n said:
I just unlocked two of them, its on different lines everytime.
Folowing are the instructions:
Open the file in Hex Editor
1.) Press - Ctrl + F
A window should open up
2.) Change the type to "Hex Bytes (h)
3.) Value: FF FF FF FF FF 01 00 00 00 00
4.) Click Find All, for me the code
the code is visible right after this, 8 digit code. For me it was repeared 9-10 times in the file.
Good luck
Click to expand...
Click to collapse
I followed these instructions after I downloaded the .bak file, used the CTRL+F to find the first instance then used F3 (Find Next) to find the other places where the code is.
Has anyone tried a AT&T sim card to see if 3G works just like it did for the Vibrant?

[REF] How to unlock SGS 4G or Vibrant 4G (IMEI Problems fixed)[Updated 11-19-11]

PLEASE KEEP POSTS ON TOPIC.
This method works on my Vibrant 4G. Please email me if it doesn't work on your Vibrant 4G or SGS 4G.
PRO App also works on Vibrant 4G/SGS 4G for anyone who doesn't feel comfortable with a hex editor
Please note the same information used to develop the app is in the guide for free... the app just makes it easier
ALL METHODS FOR NEWER PHONES REQUIRE ROOT... PLEASE GO GET ROOT ON YOUR PHONE AND THEN COME BACK.
Oh and BTW... I cannot be held responsible for anything that happens to your phone.... EVER!
Before you start... if you don't have root you WILL need it.
tooter1 reports an alternate method. Please tell me if this works for you.
BTW please note the importance of a BACKUP!!!!
tooter1 said:
My UPDATE:
I did just like the OP stated and, it messed up my IMEI number. Glad I had a backup of the file.
So I went back into the HEX editor (I used HxD editor) and looked where I did the the change and noticed to the right side there were a series of numbers that started at row 41460 and ended on row 41470.
It was an 8 digit series started with 75 ending in 13, something like this 75382313. I was sure it had something to do with the unlock code but, didn't have a different SIM to check.
I sold the phone and, the guy said he had to get it unlocked so he could use it with O2 network (I think).
I text him later that day to ask if he got the phone unlocked, he said no, the place wanted $45 to SIM unlock it.
I told him to try the number listed above and it "SIM UNLOCKED" the phone. He called me back and thanked me many times for saving him $45.
Hope this helps someone else and not mess with the IMEI number!!!!
Click to expand...
Click to collapse
IMEI Restore Method
All you need to do is restore your backup nv_data.bin and delete the md5. Even the unlocked file will work as long as you delete the .md5
Code:
su
cp /sdcard/nv_data.bin /efs/root/afs/settings/nv_data.bin
rm /efs/root/afs/settings/nv_data.bin.md5
Step 1. - Retrieve nv_data.bin file
Check locks... go to phone and enter *#7465625#
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
cat /efs/root/afs/settings/nv_data.bin >> /sdcard/nv_data.bin
Step 2. - Edit nv_data.bin file
mount the internal SD Card on your computer
make a backup copy of the nv_data.bin file on your computer
using your favorite HEX editor open the nv_data.bin on the sdcard
jump to address 0x1469
you should see a string like this
ff ff 01 00 00 00 00
there are 5 different types of locks in 5 different bytes
the FF bytes should be left alone
the first byte after the FF is the network lock
the next byte is the network subset lock
the next byte is the sp lock
the next byte is the cp lock
the last byte appears to be a data lock.
Change any 0x01 to 0x00 (or 0x00 to 0x01 to lock for warranty)
save and close file
unmount SD Card
Step 3. - Replace nv_data.bin file
I want to say it again so no one misses it MAKE SURE YOU HAVE A BACKUP OF YOUR NV_DATA.BIN FILE BEFORE YOU CONTINUE!!!!!
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
rm /efs/root/afs/settings/nv_data.bin
cat /sdcard/nv_data.bin >> /efs/root/afs/settings/nv_data.bin
rm /efs/root/afs/settings/nv_data.bin.md5
chmod 755 /efs/root/afs/settings/nv_data.bin
chown radio.radio /efs/root/afs/settings/nv_data.bin || chown 1001.1001 /efs/root/afs/settings/nv_data.bin
reboot
your phone is now unlocked... enjoy
[OPTIONAL] Use the PRO app [OPTIONAL]
Please note that this step is ONLY here for people that are not comfortable using a Hex editor.
Search "Vibrant unlock" in the market or scan the QR code:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Install and run app
press menu
press Unlock Phone
Select phone
allow root
at this point if you get an error code make SURE you mount your internal SD card on your computer and backup the nv_data.bin.orig file that is there.
press unlock
restart and your phone is now unlocked
to lock your phone for warranty
press lock instead of unlock
restart your phone, remove root, and take your phone in for warranty
To restore your IMEI try this.....
Code:
su
rm /efs/root/afs/settings/nv_data.bin
busybox cp /sdcard/nv_data.bin.orig /efs/root/afs/settings/
rm /efs/root/afs/settings/nv_data.bin.md5
chmod 755 /efs/root/afs/settings/nv_data.bin
chown radio.radio /efs/root/afs/settings/nv_data.bin || chown 1001.1001 /efs/root/afs/settings/nv_data.bin
reboot
LEGAL NOTES (because information should be free for all):
YOU MAY NOT, BY ANY MEANS, USE THIS SOLUTION/CODE OR PART OF IT FOR COMMERCIAL PURPOSES.
DO NOT USE THIS EXTRACTION METHOD COMMERCIALLY
PLEASE give credit (and donations if you can) to everyone listed on the original thread here
For those of you that have donated THANKS! (You know who you are...)
dagentooboy said:
This method works on my Vibrant 4G. Please email me if it doesn't work on your Vibrant 4G or SGS 4G.
NEW - PRO app should unlock any version of SGS for $5
Please note the same information used to develop the app is in the guide for free... the app just makes it easier
ALL METHODS FOR NEWER PHONES REQUIRE ROOT... PLEASE GO GET ROOT ON YOUR PHONE AND THEN COME BACK.
Oh and BTW... I cannot be held responsible for anything that happens to your phone.... EVER!
Before you start... if you don't have root you WILL need it.
Step 1. – Download PRO app (optional)
Check locks... go to phone and enter *#7465625#
Search "Vibrant unlock pro" in the market or scan the QR code:
Install and run app
press menu
press Unlock Phone
Select Phone
allow root
at this point if you get an error code make SURE you mount your internal SD card on your computer and backup the nv_data.bin.orig file that is there.
press unlock
restart and your phone is now unlocked
to lock your phone for warranty
press lock instead of unlock
restart your phone, remove root, and take your phone in for warranty
Step 2. - Retrieve nv_data.bin file
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
cat /efs/root/afs/settings/nv_data.bin >> /sdcard/nv_data.bin
Step 3. - Edit nv_data.bin file
mount the internal SD Card on your computer
make a backup copy of the nv_data.bin file on your computer
using your favorite HEX editor open the nv_data.bin on the sdcard
jump to address 0x1469
you should see a string like this
ff ff 01 00 00 00 00
there are 5 different types of locks in 5 different bytes
the FF bytes should be left alone
the first byte after the FF is the network lock
the next byte is the network subset lock
the next byte is the sp lock
the next byte is the cp lock
the last byte appears to be a data lock.
Change any 0x01 to 0x00 (or 0x00 to 0x01 to lock for warranty)
save and close file
unmount SD Card
Step 4. - Replace nv_data.bin file
I want to say it again so no one misses it MAKE SURE YOU HAVE A BACKUP OF YOUR NV_DATA.BIN FILE BEFORE YOU CONTINUE!!!!!
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
rm /efs/root/afs/settings/nv_data.bin
cat /sdcard/nv_data.bin >> /efs/root/afs/settings/nv_data.bin
chmod 755 /efs/root/afs/settings/nv_data.bin
chown radio.radio /efs/root/afs/settings/nv_data.bin || chown 1001.1001 /efs/root/afs/settings/nv_data.bin
reboot
your phone is now unlocked... enjoy
LEGAL NOTES (because information should be free for all):
YOU MAY NOT, BY ANY MEANS, USE THIS SOLUTION/CODE OR PART OF IT FOR COMMERCIAL PURPOSES.
DO NOT USE THIS EXTRACTION METHOD COMMERCIALLY
PLEASE give credit (and donations if you can) to everyone listed on the original thread here
For those of you that have donated THANKS! (You know who you are... you paid for my developer account so I could post the app)
Click to expand...
Click to collapse
It said it worked when I ran the program but I have no way of knowing because I don't have a ATT sim to check. I thought unlock required to enter in a 8 digit number? Never mind. It works. Just put in a chip and it recognized the number in about phone. It was boost mobile though so i could not call. Should work fine ATT takes over Tmobile.
^ Did you unlock this will running CM7? Can you do me a favor and check to see if your IMEI changed at all?
Menu->Settings->About Phone->Status->IMEI
Thanks.
matt310 said:
^ Did you unlock this will running CM7? Can you do me a favor and check to see if your IMEI changed at all?
Menu->Settings->About Phone->Status->IMEI
Thanks.
Click to expand...
Click to collapse
I haven't seen anything about CM7 on the Vibrant 4G..... I will search and see if I can test it.
Can anyone confirm if this device supports At&t 3g after being unlocked like the vibrant does? I know out didn't list the bands but neither did the vibrant...
That would future proof this device for tmo customers as far as hspa is concerned.
I love how all the orig credits were removed. Gotta love open source thieves
There is another thread about unlocking the sgs4g. It was free just get hex editor trial. Thats what I did. My phone is unlocked.
There is a thread where you can offer a paid software . Please post there.
http://forum.xda-developers.com/forumdisplay.php?f=993.
Thread closed.
Thread re-open since the OP will release a free version for xda members.
Thread has been re-written to conform to forum rules. All credits are still listed in the linked thread.
I want to make sure it is clear. ALL the information used to make the app is in the guide. If you are comfortable with a hex editor please use the guide. Let's keep this thread for questions about unlocking the Vibrant/SGS 4G.
The code doesn't work. Says invalid mmi code.
Serious_Beans said:
The code doesn't work. Says invalid mmi code.
Click to expand...
Click to collapse
What code? I am not sure what you are talking about.
I got the pro version from the market. Works
Sent from my SGH-T959V using XDA Premium App
I followed the guide about two weeks ago to unlock my father in law's SGS4G which he had just bought used. He was able to put his AT&T SIM in and it recognized it and worked flawlessly on AT&T 3G.
Only issue he had was with the GPS, he wasn't happen with how long it took to lock via GPS only, and location based services helped but he said the dot moved off the make... TL;DR but he was happen with it being unlocked and working great on AT&T.
joedeveloper said:
I followed the guide about two weeks ago to unlock my father in law's SGS4G which he had just bought used. He was able to put his AT&T SIM in and it recognized it and worked flawlessly on AT&T 3G.
Only issue he had was with the GPS, he wasn't happen with how long it took to lock via GPS only, and location based services helped but he said the dot moved off the make... TL;DR but he was happen with it being unlocked and working great on AT&T.
Click to expand...
Click to collapse
I am not sure what could cause GPS problems. Except that Samsung Galaxy S phones have been plagued with GPS problems since day one. Let me know if you figure out a fix.
I unlocked mine just yesterday anf gps actually locked pretty fast playing with maps and nav
Sent from my SGH-T959V using XDA Premium App
elry567 said:
I unlocked mine just yesterday anf gps actually locked pretty fast playing with maps and nav
Sent from my SGH-T959V using XDA Premium App
Click to expand...
Click to collapse
Maybe KD1 has some GPS fixes in it? Mine seems to work fine too.
I remember with my old Vibrant, I had an issue trying to unlock where the IMEI number changed and it messed up the available apps in the market. Will the unlock app jack with that?
chris071404 said:
I remember with my old Vibrant, I had an issue trying to unlock where the IMEI number changed and it messed up the available apps in the market. Will the unlock app jack with that?
Click to expand...
Click to collapse
So far I haven't heard of anyone having that problem... if something does happen... well that's why we make backups
awesomeness...
so simple...
just followed every step closely and now i have network lock off phone...
thanks alot...

[Q] Help with Unlocking -weird things when trying to unlock Samsung Galaxy Gio

I bought my first smart phone Samsung Gio S5660M and tried to unlock it. I tried different ways but weird things happened and I don’t know what causes the problem. I was wondering whether the unlock code would change if I did something to the phone. Now the phone is still locked and I really need and appreciate your help.
First I used the method in the link: http://forum.xda-developers.com/showthread.php?t=1204705 to root and unlock the phone but was not able to finish it. The steps that I have completed are as follows:
To root the phone:
1. Download this file http://www.mediafire.com/download.php?jzvnlbhidsd5f6l
2. Copy root_gb_gio.zip to the root of the SD card and put the card in the phone
3. Shutdown the phone.
4. Put the phone in recovery Mode (press: Home button + Power button toghether)
5. In recovery mode, choose Install Update from SD-card using Vol. up / down key and press Home key to confirm
6. Search for the root_gb_gio.zip file on the SD-card and Press home key again to run the update
7. Reboot
8. Verify in the app folder if SuperUser app is installed properly
9. Reboot
Network Unlock (using ADB Shell from PC).
1. Download and install Samsung Kies to the PC from here: http://www.samsungapps.com/about/onPc.as, also install Samsung USB Driver
2. Download and install ADB which comes with Android SDK from: http://developer.android.com/sdk/index.html
-Go to the "Available Packages" Option on the left Menu
-Click on the "Refresh" Button on the bottom Right and wait until it finish
-From Items select the "Andoid SDK platform-tools, revision 6" Item
-Click the "Install Selected" button on the botton right and wait until it finish then close the Android SDK
3. Add the correct path
-Right-click on Computer Icon (on your Desktop) and select "Properties" from the menu,
-On My PC Properties select the "Advanced Options" Tab
-Click "Advanced System Settings"
-Click "Environment Variables"
-Highlight the "Path" Variable and click the "Edit"
-At the end of the line (and path) add the path: ;C:\Program Files\Android\android-sdk\platform-tools
4. Connect the phone to the computer via the USB cable
-Click on the start button and open the "Run" option, on Run type cmd.exe and press enter. A command prompt window popped out.
-Type the next text to access the ADB Shell: cd C:\Program Files\Android\android-sdk\platform-tools
-Type: adb shell
-Now in adb shell (and executing commands on the phone itself)
-Type the next command: su
-The superuser application popped up on the PHONE SCREEN (yes take a look at the phone screen) asking to allow root privileges to the adb shell. Choose Allow root access for the ADB shell on the phone.
-Type: cd /
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: cat /efs/mits/perso.txt
got a bunch of characters on the screen and a 8 digit number, the unlock code, which is 28572603
-Type: unmount /efs (It should umount /efs, but I typed it wrong)
5. Disconnect the USB cable from the phone
6.Turn the phone off and insert the SIM card
7. Turn on the phone
In the last step it should ask for the unlock code to unlock the phone, however, it didn’t ask for the unlock code. Instead there was a message: “Phone is SIM Corporate Locked” and there is nowhere to input any code.
When I typed “*#7465625#, the result is as follows: Network Lock [OFF], Network Subset Lock [OFF], SP Lock [OFF], CP Lock [ON]. Note that the corporate lock is on. But I could access menu with the foreign SIM card in the phone. When I tried to dial “*#7465625*638*28572603” or “#0111*28572603” with or without foreign SIM card, the message is always something like network not available (cannot recall the exact words). When I went to a FIDO kiosk for help (SIM card is from FIDO), they told me to unroot the phone so that the phone could ask for the unlock code.
I googled corporate lock/SPCK code on the Internet and there is such message: “In 1% of cases to unlock samsung SPCK code is need”, I called Samsung for help with SPCK code. The technical support in Samsung asked me to factory reset the phone by typing “*2767*3855#”. After the reset, the status of the locks were still the same as before, so is the message “Phone is SIM Corporate Locked”. Then Samsung told me that they don’t have SPCK code. I noticed that SuperUser icon was still on the menu after the factory reset.
A further search showed the unlock method of mapping image partition from: http://forum.xda-developers.com/showthread.php?t=1244695 and http://forum.xda-developers.com/showpost.php?p=17148825&postcount=334 (same method). When I went to Shell and typed “su”, not sure whether because of the factory reset or not, superuser or admin denied, so I redid the rooting by following the previous steps, but it only took a few seconds to finish it. Then the steps I followed were:
1, first, go to the command line of pc.(win xp "start->run->cmd" )
and type "cd\", now in the root of the hard drive (also tried cd \Program Files\Android\android-sdk\platform-tools)
2, second, type "adb shell".
3, after that, type "su".
4, then, type "cat /dev/bml5>/sdcard/bml5.img"
5, type twice "exit" to disconnect with gio.
6, type "adb pull /sdcard/bml5.img"
But there is an error message “remote object /sdcar/bml5.img does not exist". I just repeated the steps a few minutes ago to get a few screenshots:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(using cd \Program Files\Android\android-sdk\platform-tools)
(using cd \)
(a different error: so I used mount command)
I think at this point (cannot recall after the following tries or at this time) that I inserted a foreign SIM card, the phone began to show message “Network Locked”, took out the foreign SIM card, typed “*#7465625#", weird enough, the result changed to: Network Lock [ON], Network Subset Lock [OFF], SP Lock [OFF], CP Lock [OFF]. Corporate lock is gone but the network lock came back. I don’t know the reason – is that because I did factory reset?
I put the foreign SIM card back to the phone, input the unlock code generated earlier “28572603”, but it was not successful. I decided to go back to the first method (ADB shell from PC) to generate the unlock code again to see whether the result code is the same. However, weird gain, this time no code at all. I reproduced the screenshot a moment ago for the result (I had to cut the screen into two half):
The third method I tried is to unlock the phone by using Android Terminal Emulator, the steps were:
- In Android Market, download and install Android Terminal Emulator
- Boot up the Android Terminal Emulator application
-Using the on-screen keyboard, type su, allowed the permission from the prompt
-Type: cd /
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: cat /efs/mits/perso.txt
The desire result should be a bunch of characters on the screen and a 8 digit number. However, I didn’t get the desire result – it seems that the result is the same as using the first method after factory reset, here is the screenshot (it seems that the shot is incomplete, but I had a hard time to get even such an incomplete shot – the shell would exit when I tried to screenshot):
My questions are: why the same method cannot generate the same code? Is it because I did something to the phone, like factory reset? The unlock code will change because of the situation or it will always keep the same? Why I cannot see the bml5.img? Is it possible I damaged it by chance? I am also worried that now even if I buy uncode code from GSMLiberty, it would not work any more because of what I did to the phone. Is it possible so? What is my option now? (I tried the code once, so I still have another two chances to input unlock code). Is what has happened weird or there is a reason for that?
Thank you very much.
I also pulled the perso.txt file onto my PC and reviewed it in XVI32. It does not look like any of the files others mentioned (a lot of 00 or FF followed by a number). Attached here is perso.txt. Is my perso.txt corrupted? If yes, how can I recover it? Thanks.
As far as I know, you're the first person that's reported seeing a CP lock on this phone... One possibility is that this happened instead of plain old bricking when you mistyped the umount command the first time around.
Is your IMEI still intact?
Did you reboot the phone since your third attempt?
Did you by any chance keep the first perso.txt you cat'ed on your first attempt?
The suggestion below is at best a shot in the dark and could very well worsen the situation. With that out of the way...
If your IMEI is still intact, you could try booting in CWM, mounting /efs as rewritable, and upload the attached perso.txt, unmount efs and reboot. The file is simply my own perso.txt, from an unlocked 5660M, with your unlock code put in place of mine in a Unix line-ending aware editor. (Another, albeit riskier possibility would be to mount rewritable in the main OS and cat the file into place, then unmount and reboot.)
Good luck,
Darkshado
Thank you, Darkshado, for answering my questions.
Yes the IMEI is still intact. What is weird is that now CP is off and network lock is on after I don't know which operation - I thought it should be due to the factory reset, but after factory reset, the status was still CP [ON] and network lock [OFF]. The I did reroot. The phone was rebooted many times after each attempt, and I only input unlock code once so I still have another two chances.
No I didn't make a copy of the original perso.txt as I almost knew nothing when I first tried.
About unmount mistake, is it so severe if there is a typo? My thought was that mounting and unmounting just control access to the file. When we mount a file, we get access to the file. If we forget to unmount it, it leave a hole for others to access. Is my understanding right? If yes, the typo in unmount command for the first method should not be a big deal as I rebooted the phone after an probably unsuccessful unmount.
As to the perso.txt, what I guess is that the file perso.txt contains all the unlock codes and when we input unlock code from the screen, the system will compare the input code with the code in perso.txt. If they are the same, unlock succeeds, which is similar to using password when we login anywhere. Am I right?
I actually think that uploading your perso.txt mught be a solution. But before doing that, I think it is better to compare your perso.txt with another perso.txt from another phone to see whether the difference is only the unlock code. If yes, the solution will succeed. However, if the perso.txt files from different phones are quite different -like the location of the unlock code and other data that is not 00 or FF, there is a good chance that it's very risky. Do you have another perso.txt available? Or anybody in the forum has a perso.txt available to compare?
My other question is how useful is this perso.txt. If I delete it totally by chance and ask people to unlock the phone from hardware, will the system still operate normally?
I'm going to try to factory reset the phone and reroot again - My PC is in repair and I'll try after I get my PC back - to see whether perso.txt could be restored. Do you have bml5.img in your phone? I don't know why I don't have it on my phone. But from the forum, it looks like that the bml5.img is very similar to perso.txt, only 00 becomes FF or vice verse.
Thanks again for your help.
SPnewb said:
Thank you, Darkshado, for answering my questions.
Yes the IMEI is still intact. What is weird is that now CP is off and network lock is on after I don't know which operation - I thought it should be due to the factory reset, but after factory reset, the status was still CP [ON] and network lock [OFF]. The I did reroot. The phone was rebooted many times after each attempt, and I only input unlock code once so I still have another two chances.
Click to expand...
Click to collapse
That is very strange. What, if any, SIMs did you have in the phone when attempting the unlock at the different stages? Was the Fido SIM in at any time before trying to get an unlock code prompt?
As far as I know, the factory reset operation, at least when triggered from recovery, only wipes the /data and /cache partitions. Is anything done to NV items? I don't have any data to tell.
About unmount mistake, is it so severe if there is a typo? My thought was that mounting and unmounting just control access to the file. When we mount a file, we get access to the file. If we forget to unmount it, it leave a hole for others to access. Is my understanding right? If yes, the typo in unmount command for the first method should not be a big deal as I rebooted the phone after an probably unsuccessful unmount.
As to the perso.txt, what I guess is that the file perso.txt contains all the unlock codes and when we input unlock code from the screen, the system will compare the input code with the code in perso.txt. If they are the same, unlock succeeds, which is similar to using password when we login anywhere. Am I right?
Click to expand...
Click to collapse
Your understanding about mounting and unmounting is correct, but I am not certain that perso.txt is actually used by the phone to check the unlock code. It may also be written there for some other reasons...
The problem with our phones is that corruption has occurred by merely reading the stl5 partition the wrong way.
I actually think that uploading your perso.txt mught be a solution. But before doing that, I think it is better to compare your perso.txt with another perso.txt from another phone to see whether the difference is only the unlock code. If yes, the solution will succeed. However, if the perso.txt files from different phones are quite different -like the location of the unlock code and other data that is not 00 or FF, there is a good chance that it's very risky. Do you have another perso.txt available? Or anybody in the forum has a perso.txt available to compare?
My other question is how useful is this perso.txt. If I delete it totally by chance and ask people to unlock the phone from hardware, will the system still operate normally?
Click to expand...
Click to collapse
The idea of comparing some perso.txt files is good, but so far all the perso.txt files I've seen uploaded came from the Euro/Asia 5660 Gio, so we'd need files from a 5660M. They did look almost identical to mine though, with essentially a Bell network identifier at the beginning that wasn't present at all in theirs. One person with a 5660 also posted a before/after set, and the file does change a little after the unlock.
I've been reluctant to try too many things on my EFS partition, like deleting perso.txt to see how the phone reacts, for fear of bricking it.
I'm going to try to factory reset the phone and reroot again - My PC is in repair and I'll try after I get my PC back - to see whether perso.txt could be restored. Do you have bml5.img in your phone? I don't know why I don't have it on my phone. But from the forum, it looks like that the bml5.img is very similar to perso.txt, only 00 becomes FF or vice verse.
Thanks again for your help.
Click to expand...
Click to collapse
There are two "levels" you can access the partitions on the phone. stl is a higher level access, with which you can get correct RFS partitions for instance, while bml is a lower, block-level access. perso.txt is simply a file contained in stl5, also known as the /efs partition. You can read its contents in a round-about way via bml, but you wouldn't want to flash an /efs, /system/ or /data partition through bml.
Unlike reading stl5, reading bml5 has not caused anyone bricking so far. bml5 is sufficient to get the unlock code as well.
Good luck,
Darkshado
Hi Darkshado,
Thank you very much for your help.
Darkshado said:
That is very strange. What, if any, SIMs did you have in the phone when attempting the unlock at the different stages? Was the Fido SIM in at any time before trying to get an unlock code prompt?
Click to expand...
Click to collapse
The phone was locked to Bell, and my SIM card is from FIDO. I also got a Rogers SIM card for testing. When I rooted and generated teh code, I didn't have any SIM card in the phone. When I inserted Fido card after teh first attempt, I got the message " Phone is SIM Coperated locked" [i.e. when CP lock is On and other locks OFF], but I could still use the other functions of the phone. When the CP lock is OFF and Network lock is ON, I could not use the phoen at all because teh screen asked to input unlock code. If no input orcode is wrong, I cannot use the phone at all. Without SIM card, I could still use other functions of the phone.
As far as I know, the factory reset operation, at least when triggered from recovery, only wipes the /data and /cache partitions. Is anything done to NV items? I don't have any data to tell.
Click to expand...
Click to collapse
What is NV items? Can you tell me how I can tell where to see NV items?
Your understanding about mounting and unmounting is correct, but I am not certain that perso.txt is actually used by the phone to check the unlock code. It may also be written there for some other reasons...
Click to expand...
Click to collapse
I was wondering whether the perso.txt is like config file?
The problem with our phones is that corruption has occurred by merely reading the stl5 partition the wrong way.
Click to expand...
Click to collapse
perso.txt is simply a file contained in stl5, also known as the /efs partition. You can read its contents in a round-about way via bml, but you wouldn't want to flash an /efs, /system/ or /data partition through bml.
Click to expand...
Click to collapse
I cannot think of where I read the partition wriong other than I might hav etyped the wrong unmount for the first time followed by a reboot. I actually thinking of falshing the phone, but for the moment I have not read anything about flash yet and have no idea where to find the proper version of files to falsh.
When I pull the perso.txt to PC, I seemed to use the following method (my PC is still in repair so I cannot verify ):
-Type: adb shell
-Now in adb shell
-Type: su
- allow root privileges to the adb shell.
-Type : mount -o remount rw /
-Type: mkdir /efs
-Type: mount -o nosuid,ro,nodev -t vfat /dev/block/stl5 /efs
-Type: exit twice to exit shell
-Type: adb pull /efs/mits/perso.txt
-Type: adb shell (to go back to shell)
-Type: umount
Is there any risk with this method?
About perso.txt,
One person with a 5660 also posted a before/after set, and the file does change a little after the unlock.
Click to expand...
Click to collapse
I will try to see whether I could get some perso.txt files from anotehr forum (redflagdeals). Can you tell me where I can find the before/after set?
Thank you again very much.
Cathy
Hello Cathy,
One big piece of advice I can give you is to try and have a basic understanding of whatever command it is you're typing in an ADB shell.
The "cat" command can take one or many standard inputs (we'll stick to files for now) and output them to a standard output; in our case, the screen or another file.
Its one way of copying a file, or simply seeing its contents depending on where you send it.
With multiple files in the input, you're concatenating them before they get output.
I would not try the method in your last post AT ALL. You already have your code, and I see no reason why your current perso.txt would be of any use. It is a configuration file, it has to do with the various locks, but I wouldn't be able to tell you more. The way yours has been "corrupted" (I'm employing the term loosely here) may be the reason you've seen that CP lock appear. It may also have altered your Network unlock code in unforeseen ways.
I don't remember anyone trying to directly adb pull perso.txt from the /efs partition off a live phone. Do this at your own risk.
The problems we've seen occur are in all likelyhood due to interference between the modem firmware and the higher-level Android OS. That's why even normally "harmless" read commands have caused problems.
The dd command, as well as leaving /efs mounted on normal mode phone shutdown are constants in multiple bricking cases on the Gio and other similar Samsung phones like the Galaxy Ace and Mini.
The lower-level bml5 partition has been deemed safe to read with the dd command so far, even from a live phone.
Completely disable the modem firmware, like in recovery mode, and you can access, and even edit, the /efs partition in a relatively safe manner.
Something interesting happened as I began writing this: I don't know how or when this happened, but I somehow had relocked my phone to Bell!
I decided to try the lock status code you posted above and saw "Network Lock: ON" Slipping another SIM (an unactivated Koodo one) in my Gio prompted for the unlock code, which I typed and got a network unlocked message.
I took another look at the perso.txt file I had modified for you and recognized a number near the beginning: 302610 that's the Bell MNC! I rebooted in recovery, mounted /efs and adb pulled perso.txt again (safe because I was in recovery mode). The file has the exact same length, and a few differences visible in Winmerge or a hex editor of your choosing.
I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell.
You also asked about NV items: they're phone settings common to all Qualcomm cellular modem based cellphones. GSM and WCDMA antenna power and gain settings, factory test mode, IMEI, there are thousands.
In the case of the Gio, some are accessible off the EFS (stl5) partition in the /nvm/num/ directory. Others, like the IMEI unfortunately, are stored elsewhere in the phone, I don't know where. We can read all the settings by using two leaked Samsung programs, named QPST and QXDM respectively. We can edit some of them, but unless you know exactly what you're doing, this is an easy way to completely mess up a phone.
One last silly question: did you have a MicroSD memory card in the phone when you tried cat'ing bml5 to /sdcard on your second attempt?
Okay. I think there is a way to solve your unusual lock problems, try the following steps:
Get Odin here
Get the latest Odin-flashable Gio ClockworkMod-based recovery available on XDA.
Download the perso_Cathy.txt attached below.
Flash the CWM-based recovery to your phone.
Reboot in recovery mode and connect the phone to your computer.
In Windows Explorer, go to the directory you've saved perso_Cathy.txt, and shift+right-click on the directory. Open command line from here. (Otherwise, open a command line window and cd to that directory.)
adb shell (notice your shell is already # aka root)
mount -o nosuid,rw,nodev -t vfat /dev/block/stl5 /efs (notice we're mounting rewritable this time)
exit (this will take you back to the regular command line)
adb push perso_Cathy.txt /efs/mits/perso.txt (so we're pushing and renaming at the same time)
adb shell umount /efs (I doubt this is *really* necessary, but better safe than sorry. You can send single commands to the shell this way)
adb reboot
The phone should already be unlocked on reboot.
Good luck,
Darkshado
Hi Darkshado,
Thank you for your quick response.
Darkshado said:
One big piece of advice I can give you is to try and have a basic understanding of whatever command it is you're typing in an ADB shell.
Click to expand...
Click to collapse
That's good advice If I read the whole thread of unlocking first before I began unlocking, there might not have been problems. I began to unlock after reading a few postings. I used Linux long time ago, but obviously I could not recall anything now.
I would not try the method in your last post AT ALL. You already have your code, and I see no reason why your current perso.txt would be of any use. It is a configuration file, it has to do with the various locks, but I wouldn't be able to tell you more. The way yours has been "corrupted" (I'm employing the term loosely here) may be the reason you've seen that CP lock appear. It may also have altered your Network unlock code in unforeseen ways.
Click to expand...
Click to collapse
The code I had was got before the corrupted perso.txt. I had a strong feeling that the input unlock code will be compared with the code in perso.txt for unlocking, Otherwise if perso.txt is not useful any more, why when I input the initially generated unlock code, the unlocking is not successful. The CP lock is now OFF after the perso.txt is corrupted, though it is hard to judge whether CP is ON or not before perso.txt is corrupted because I got the unlock first then I saw CP was ON.
I don't remember anyone trying to directly adb pull perso.txt from the /efs partition off a live phone. Do this at your own risk.
Click to expand...
Click to collapse
Can you tell me what command you use to get perso.txt? From the info below it seems that you use the same or similar commands, but in the recovery mode instead of the normal mode, is it right?
I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell.
Click to expand...
Click to collapse
By editing perso.txt only?
One last silly question: did you have a MicroSD memory card in the phone when you tried cat'ing bml5 to /sdcard on your second attempt?
Click to expand...
Click to collapse
Yes, since I inserted the MicroSD card into the phone for rooting, I never took it out. But I can hardly imagine this will cause any problem.
I think there is a way to solve your unusual lock problems, try the following steps:
Get Odin here
Get Ingmar Steen's latest Gio ClockworkMod-based recovery here
Download the perso_Cathy.txt attached below.
Flash the CWM-based recovery to your phone.
Reboot in recovery mode and connect the phone to your computer.
In Windows Explorer, go to the directory you've saved perso_Cathy.txt, and shift+right-click on the directory. Open command line from here. (Otherwise, open a command line window and cd to that directory.)
adb shell (notice your shell is already # aka root)
mount -o nosuid,rw,nodev -t vfat /dev/block/stl5 /efs (notice we're mounting rewritable this time)
exit (this will take you back to the regular command line)
adb push perso_Cathy.txt /efs/mits/perso.txt (so we're pushing and renaming at the same time)
adb shell umount /efs (I doubt this is *really* necessary, but better safe than sorry. You can send single commands to the shell this way)
adb reboot
Click to expand...
Click to collapse
After a second thought, I decided not to flash the memory since I have little knowledge about it and the tools you mentioned here. As you suggest, I should know enough before doing it. So now, I was wondering whether it will solve the problem by just push the file perso_Cathy.txt in your above message to /efs/mits/perso.txt in recovery mode. What do you think? Another quesion is that I wish to back up all the files in the operating system before any more action. Can you tell me how to back up?
My PC is back but now I cannot even install androit SDK on the computer, so I have to bring it back for repair. So the next few days I probably would not be able to try anything, but once I try, I'll let you know the rsult.
Thank you very much.
Cathy
SPnewb said:
I had a strong feeling that the input unlock code will be compared with the code in perso.txt for unlocking
Click to expand...
Click to collapse
It most definitely is compared. From what I can tell, perso.txt contains all the SIM-lock information, status and codes.
Can you tell me what command you use to get perso.txt? From the info below it seems that you use the same or similar commands, but in the recovery mode instead of the normal mode, is it right?
Click to expand...
Click to collapse
Exactly. Recovery mode is what makes the whole thing safe. You need a rooted recovery to do it though.
There are two ways to get the actual perso.txt file off the phone: adb pull (directly or by cat'ing the file to the sd card beforehand) or dd'ing the stl5 partition and extracting perso.txt from it.
By editing perso.txt only?
Click to expand...
Click to collapse
Yes.
After a second thought, I decided not to flash the memory since I have little knowledge about it and the tools you mentioned here. As you suggest, I should know enough before doing it. So now, I was wondering whether it will solve the problem by just push the file perso_Cathy.txt in your above message to /efs/mits/perso.txt in recovery mode. What do you think?
Click to expand...
Click to collapse
I'm pretty confident it will solve the problem, otherwise I would not have gone to the trouble of writing these instructions and uploading the file for you.
Another quesion is that I wish to back up all the files in the operating system before any more action. Can you tell me how to back up?
Click to expand...
Click to collapse
Look here.
My PC is back but now I cannot even install androit SDK on the computer, so I have to bring it back for repair. So the next few days I probably would not be able to try anything, but once I try, I'll let you know the rsult.
Click to expand...
Click to collapse
What does the ADK installer say? If its complaining about not finding the JDK when you've already installed it, just it Back, and then Next. It will detect at that time and proceed with the installation. It's a known bug. Also, stick to JDK version 6 for the time being. Version 7 is so recent there might be some incompatibilities...
Thank you very much.
Click to expand...
Click to collapse
You're welcome.
Goodbye,
Darkshado
The phone is bricked now. What I did is: hole the HOme key while pressing the power key, the phone asked me whether to "reboot the system now" or "update from /sdcard" or "wipe /data XXX factory reset" (sth like factory reset) or "wipe /cach", I chose "reboot the system now". after that , connect the phone to the system. What I did in PC is catured in teh following image:
After that, when rebooting the phone, the phone began to falsh "samsung" and it cannot be shut down any more.
It seems that using other people's perso.txt does not work. One reason may be that, as you said, "perso.txt contains all the SIM-lock information, status and codes", other than unlock code, it might also read each individual phone's information, since that hte perso.txt is not mine, the phone cannot find the proper information, which causes phone to do indefinite loop. If that is the case, instead of uploading a new perso.txt, editing my own (even the corrupted) perso.txt and changing the corresponding location into the unlock code might work, as the phoen could start up before. Another reason may be that by editing the perso.txt, the system might detect the action for example like using CRC, and if only perso.txt is edited, system detected inconsistency and will go into indefinite loop. If I were the developer and I am aware that perople crack the phone, I might using another file or check code to protect. In this case, "I turns out I can relock and unlock my phone as I see fit! I haven't tried, but I wouldn't be surprised if I could even lock my phone to a network other than Bell." might not work.
I guess that now even hardware unlock will not work, becaue when the phone start, it will read "perso.txt" and cannot find the right information. The only solution is push my original corrupted perso.txt back to the phone, but the question is how? Can you advise me what I should do now? SInce the phone does not start up at all, can I still flash the memory using Odin?
Thank you very much.
Cathy
Crap. I'm afraid that if your phone is now bootlooping with no access to recovery mode there is little to be done but to get it serviced or replaced.
No one has been able to flash EFS with Odin yet on our phones.
Also, your image attachment explaining what you attempted exactly is missing...
Look at the perso.txt files in a hex editor, there's no CRC or MD5 like thing anywhere in there. Of course it could be placed elsewhere, but it would be a first to have a booby-trapped phone OS...
I'll try locking my phone to another network within the next week for the heck of it.
Goodbye,
Darkshado
It's the format of the image. I changed to a different image format. You should be able to view the image in the first page now. Anyway, I posted it here again:
I'll try locking my phone to another network within the next week for the heck of it.
Click to expand...
Click to collapse
Let me know the result.
Thanks.
Cathy
SPnewb said:
Anyway, I posted it here again:
Click to expand...
Click to collapse
Please tell me: in what mode were you booted when you did the above?
Recovery?
Was the text blue or orange?
It's not normal that you had to use su. Otherwise your commands were correct starting with mount -o remount rw /
Darkshado said:
Please tell me: in what mode were you booted when you did the above?
Recovery?
Was the text blue or orange?
It's not normal that you had to use su. Otherwise your commands were correct starting with mount -o remount rw /
Click to expand...
Click to collapse
I thought that I booted in recovery mode since when I turned on the phone, I held Home key then press the power key, but when the phone start up there were only 4 or 5 choices in the recovery menu and except the one "reboot the system now", there were no other choices about reboot. I suspected that to choose "reboot the system now" will cause startup in normal mode. How do you start up the phone in recover mode?
I cannot recall teh color of the text, but I never see any orange text since I had the phone.
Thank you very much for your help. I'm going to get another Gio to unlock.

[CLOSED] Delete Thread.

Due to the disrespect of certain members I will no longer share the tutorials.
This tutorial is not working for Version 7.
An error message is displayed and the R/O cannot be released.
I have reported the error in the original thread.
I'm not very good at English.
PEACH-PIT said:
This tutorial is not working for Version 7.
An error message is displayed and the R/O cannot be released.
I have reported the error in the original thread.
I'm not very good at English.
Click to expand...
Click to collapse
Try and see if @munjeni has V2. That's what I used and it's working fine. He started having problems after that with V3 and onward. I personally have not tried V7.
It is not possible to try v2.
You should not try v3 or earlier, as they have serious errors.
I reported the error and got v9, but never got the r/w.
This tutorial is not working.
So far, I can't get r/w on moto g 5g.
PEACH-PIT said:
It is not possible to try v2.
You should not try v3 or earlier, as they have serious errors.
I reported the error and got v9, but never got the r/w.
This tutorial is not working.
So far, I can't get r/w on moto g 5g.
Click to expand...
Click to collapse
Here are the files I used of V2. While I did not have an error (and still using my phone) please use this at your discretion and your risk. You will be able to achieve R/O access following my guide with this.
https://forum.xda-developers.com/t/script-android-10-universal-mount-system-read-write-r-w.4247311/
"moto g 5g" can use makeSystemRW v1.31.
It must be used in conjunction with makesysrw_repair.
makesysrw_repair requires linux.
The size option will not work if it is too large or too small.
You need to specify an appropriate size.
Please adjust it by yourself.
I got the right result with 20mb.
adb shell
su
chmod +x /data/local/tmp/makesysrw_1.31/makesysrw.sh
setenforce 0
./data/local/tmp/makesysrw_1.31/makesysrw.sh size=20
https://forum.xda-developers.com/t/...t-system-read-write-r-w.4247311/post-84914345
Perhaps this will eliminate the need for makesysrw_repair.
However, you will need an sd card.
adb shell
su
chmod +x /data/local/tmp/makesysrw_1.31/makesysrw.sh
setenforce 0
cd /data/local/tmp/makesysrw_1.31
./makesysrw.sh size=20 out=/external_sd/super.img
Articul8Madness said:
Update: I used Version 2 with no problems. According to @munjeni there are BIG DANGEROUS ISSUES with Version and newer. Starting at V7 there are clone issues. I have tried Version 9 and had those issues.
Using the V2 method you will be able to delete and remove files. The ability to resize the partitions has not been achieved, so you will be at the mercy of the space limitations in the partition.
This tutorial is for people like me that after rooting the Moto One 5G Ace XT-2113 (MetroPCS Qualcomm Variant) running on stock Android 10 discovered that their root did not grant them Write Access to system files. Starting with Android 10, a new System As Root protocol prohibits users from access all of their files due to Dynamic Partitions and being formatted to EXT4_FEATURE_RO_COMPAT_SHARED_BLOCKS, effectively making root useless. You can read about that here:
https://twitter.com/i/web/status/1170404631865778177
Rest not, a method has been made!
Follow the following at your own risk! I am not responsible for any mishaps with your devices and neither is @munjeni. I also don't know if this will work on other variants, as I only have tried this method on the RETUS and RETEU stock firmware. Also, this will NOT obviously work for Verizon, AT&T, and Cricket phones or other mobile carriers that lock their bootloaders.
I want to thank a couple of people for their big beautiful brains and hard work in figuring this out. First, all the love in the world goes out to @lebigmac. This beautiful soul and I have been back and forth a week trying to get something going on the Moto. I thank him for his patience, his genius, and his tenacity to hang in there with my device even after I threatened a bunch of times to go to Apple and be done with this new cumbersome lockdown AndroidOS. He gave the hope as his method has worked on Asus and Xiaomi variants. It has been an honor to be on his beta test team.
Last, but not least, I want to thank @munjeni whose method finally broke on through to the other side. If it were not for his big beautiful brain I’d be ordering me an iPhone and calling it quits. It is due to his and @lebigmac’s hard work researching and testing that gives us the ability to finally have full root access. Thank you guys. I love you both!
And please visit both of their threads and help them continue support and development on this project for ALL of your Android 10 phones (especially this one).
@lebigmac Method: [SCRIPT][Android 10+] Universal Mount System read write R/W
@munjeni Method: [TOOL][WIN,LIN,AND,DARW] Super image unpack-repack tools
Introduction/Preparation
First, go and prepare by READING EVERYTHING I’M WRITING IN THIS POST BEFORE YOU START. Very important. Don't even jump into this without reading this thread here all the way to the end. This isn’t exactly child’s play if you are not comfortable with the ADB Shell or Linux, and if you type the wrong commands you could do serious, irreparable damage to your device. It also doesn’t hurt to read the original thread for this all the way through, and you can find that here: Munjeni's Superpack Repack Tool
Second, make sure your bootloader is unlocked and you have Magisk root on your device. You can check the forum for tutorials on how to do that. This method will ABSOLUTELY NOT WORK if you are not bootloader unlocked, and rooted with your boot.img patched by Magisk. If you can’t figure out that part of it then you definitely aren’t prepared for this.
***NOTES SO YOU DON'T FREAK OUT***
1. While it hasn’t happened to me, there is the possibility that you can brick your phone doing this. As such, make sure you have your firmware already downloaded and available to flash should something go wrong. This is just a precaution, a break glass in case of emergency situation. It’s better to have the files already ready to go with the flashfile commands converted and not need it than need it and frustrated because you didn’t prepare.
2. There is no custom recovery/TWRP for this variant yet (and trust me I’m trying very hard to work on that), so you will have to use ADB Shell to run the commands we need for this exercise. If you are not familiar with that, please do some research on ADB Shell so you’re comfortable and familiar. Google for once is a friend for that!
Files
Here is a list of things you will need going into it.
1. Windows 7. I did it in Windows 7 and Kali Linux so I can’t speak on whether or not this will work smoothly in other versions. This method is exclusively for Windows 7. Go to the original thread on info on how to use it on other platforms.
2. Get Tiny ADB and Fastboot (it's easier to use than Android SDK and smaller) or whatever fastboot you’re comfortable with.
3. Make sure the drivers for your Moto One 5G Ace are already downloaded and installed on your computer.
4. @munjeni’s Super Unpack Repack Tool. Can’t get anywhere with the method without it. You can download it here from the first post: https://forum.xda-developers.com/t/tool-win-lin-and-darw-super-image-unpack-repack-tools.4120963/
5. Root Explorer (or whatever your favorite type of system explorer is). There’s no getting into the system files without it.
6. Busybox. I used Busybox Pro 70 that I had from my MotoG7Power and that worked flawlessly. A newer version of Busybox did not install on my device because I didn’t have Write access going into it but that version I can attest works.
7. Stock Firmware (Just in case, remember?) I used XT2113_KIEV_RETUS_10_QZK30.Q4-40-55_subsidy-DEFAULT_regulatory-DEFAULT_CFC_R1_CFC.xml which is the US Retail software and the XT2113-3_KIEV_RETEU_10_QZKS30.Q4-40-62-2_subsidy-DEFAULT_regulatory-XT2113-3-EU-SAR_CFC.xml instead of MetroPCS's firmware because I hate any branded US carrier bloatware and such and like that factory unlocked from the manufacturer feel. Both of my phones flashed fine with it and you can find it here: Moto One 5G Ace ALL Firmwares. It doesn't matter what your carrier is, they have them all there.
8. The stock charging cable that comes with your phone.
The Process
1. Make sure the phone is at least halfway charged. Last thing you want is the phone to die in the middle of any of this and cause a system error that you might can’t get out of.
2. Make sure your have installed your Root Explorer and Busybox beforehand.
3. Extract @munjeni’s Super Unpack Repack Tool. Copy the file “superrepack.arm64_pie” to your phone.
4. Rename “superrepack.arm64_pie” on your phone to “superrepack” (obviously without quotations).
5. Move “superrepack” file on your phone to /data/local/tmp folder. If you have root and using a root explorer you can’t miss it (obviously without quotations).
6. Connect your phone to your PC via the charging cable.
7. Open TinyADB and Fastboot. Do not open it as an administrator or it will not function correctly getting root access on your device.
8. Type: “adb shell” and press enter. This will change C:/TheNameOfYourDirectory to kiev:/ $
9. Type: “su” and press enter. This will change the dollar sign “$” to a sharp symbol “#” and will look like kiev:/ # Make sure you allow permissions if Magisk asks for it or it will give you a permission denied message.
10. Type: “ls -Alg /dev/block/by-name | grep "super"” and press enter since you need to know where your block device is. It should return a result that looks like “lrwxrwxrwx 1 root 16 1970-01-01 08:07 super -> /dev/block/NameOfYourBlock” (obviously without quotations except the quotations in "super" - keep those)
11. Copy and paste somewhere “/dev/block/NameOfYourBlock” (obviously without quotations). You’re going to need that later.
12. Close TinyADB and Fastboot. Now open a fresh instance of it in a new window.
13. Type: “adb shell” (obviously without quotations) and press enter. This will change C:/TheNameOfYourDirectory to kiev:/ $
14. Type: “su” (obviously without quotations) and press enter. This will change the dollar sign “$” to a sharp symbol “#” and will look like kiev:/ #
15. Type: “chmod 755 /data/local/tmp/superrepack” (obviously without quotations) and press enter as the chmod command will give us root permissions to run the script. This is VERY IMPORTANT. Don’t worry if it goes to a blank next line that’s normal.
16. Type: “setenforce 0” (obviously without quotations) and press enter as we need to disable selinux. Again, don’t worry if it goes to a blank next line as that’s normal.
17. Type: “/data/local/tmp/superrepack /dev/block/NameOfYourBlock” (obviously without quotations) and press enter. Let the script run to the end.
18. Reboot your phone. Close Tiny ADB and Fastboot.
19. When your phone is rebooted go to Root Explorer (or your explorer).
20. Mount the system in your file explorer! You should have R/W Access in ALL of your partitions.
If Something Goes Wrong And You Have To Reflash Your Phone…
Please refer to the guides in the forum on how to get your phone back to stock. There’s one for flashing, one for root, and a subsequent one for debloat.
If you come up with an error, please go to the original thread https://forum.xda-developers.com/t/tool-win-lin-and-darw-super-image-unpack-repack-tools.4120963/ and let @munjeni know what the issue is so he can help.
Hope this brings some love to the Moto One 5G Ace users. We definitely need a boost to lift development spirits.
I will try and answer questions if I can or point you in the right direction.
Click to expand...
Click to collapse
Wow this was the easiest guide to get r/w access. Thanks to everyone involved in this milestone.
I can mount r/w on stock android 10....
Articul8Madness said:
Update: I used Version 2 with no problems. According to @munjeni there are BIG DANGEROUS ISSUES with Version and newer. Starting at V7 there are clone issues. I have tried Version 9 and had those issues.
Using the V2 method you will be able to delete and remove files. The ability to resize the partitions has not been achieved, so you will be at the mercy of the space limitations in the partition.
This tutorial is for people like me that after rooting the Moto One 5G Ace XT-2113 (MetroPCS Qualcomm Variant) running on stock Android 10 discovered that their root did not grant them Write Access to system files. Starting with Android 10, a new System As Root protocol prohibits users from access all of their files due to Dynamic Partitions and being formatted to EXT4_FEATURE_RO_COMPAT_SHARED_BLOCKS, effectively making root useless. You can read about that here:
https://twitter.com/i/web/status/1170404631865778177
Rest not, a method has been made!
Follow the following at your own risk! I am not responsible for any mishaps with your devices and neither is @munjeni. I also don't know if this will work on other variants, as I only have tried this method on the RETUS and RETEU stock firmware. Also, this will NOT obviously work for Verizon, AT&T, and Cricket phones or other mobile carriers that lock their bootloaders.
I want to thank a couple of people for their big beautiful brains and hard work in figuring this out. First, all the love in the world goes out to @lebigmac. This beautiful soul and I have been back and forth a week trying to get something going on the Moto. I thank him for his patience, his genius, and his tenacity to hang in there with my device even after I threatened a bunch of times to go to Apple and be done with this new cumbersome lockdown AndroidOS. He gave the hope as his method has worked on Asus and Xiaomi variants. It has been an honor to be on his beta test team.
Last, but not least, I want to thank @munjeni whose method finally broke on through to the other side. If it were not for his big beautiful brain I’d be ordering me an iPhone and calling it quits. It is due to his and @lebigmac’s hard work researching and testing that gives us the ability to finally have full root access. Thank you guys. I love you both!
And please visit both of their threads and help them continue support and development on this project for ALL of your Android 10 phones (especially this one).
@lebigmac Method: [SCRIPT][Android 10+] Universal Mount System read write R/W
@munjeni Method: [TOOL][WIN,LIN,AND,DARW] Super image unpack-repack tools
Introduction/Preparation
First, go and prepare by READING EVERYTHING I’M WRITING IN THIS POST BEFORE YOU START. Very important. Don't even jump into this without reading this thread here all the way to the end. This isn’t exactly child’s play if you are not comfortable with the ADB Shell or Linux, and if you type the wrong commands you could do serious, irreparable damage to your device. It also doesn’t hurt to read the original thread for this all the way through, and you can find that here: Munjeni's Superpack Repack Tool
Second, make sure your bootloader is unlocked and you have Magisk root on your device. You can check the forum for tutorials on how to do that. This method will ABSOLUTELY NOT WORK if you are not bootloader unlocked, and rooted with your boot.img patched by Magisk. If you can’t figure out that part of it then you definitely aren’t prepared for this.
***NOTES SO YOU DON'T FREAK OUT***
1. While it hasn’t happened to me, there is the possibility that you can brick your phone doing this. As such, make sure you have your firmware already downloaded and available to flash should something go wrong. This is just a precaution, a break glass in case of emergency situation. It’s better to have the files already ready to go with the flashfile commands converted and not need it than need it and frustrated because you didn’t prepare.
2. There is no custom recovery/TWRP for this variant yet (and trust me I’m trying very hard to work on that), so you will have to use ADB Shell to run the commands we need for this exercise. If you are not familiar with that, please do some research on ADB Shell so you’re comfortable and familiar. Google for once is a friend for that!
Files
Here is a list of things you will need going into it.
1. Windows 7. I did it in Windows 7 and Kali Linux so I can’t speak on whether or not this will work smoothly in other versions. This method is exclusively for Windows 7. Go to the original thread on info on how to use it on other platforms.
2. Get Tiny ADB and Fastboot (it's easier to use than Android SDK and smaller) or whatever fastboot you’re comfortable with.
3. Make sure the drivers for your Moto One 5G Ace are already downloaded and installed on your computer.
4. @munjeni’s Super Unpack Repack Tool. Can’t get anywhere with the method without it. You can download it here from the first post: https://forum.xda-developers.com/t/tool-win-lin-and-darw-super-image-unpack-repack-tools.4120963/
5. Root Explorer (or whatever your favorite type of system explorer is). There’s no getting into the system files without it.
6. Busybox. I used Busybox Pro 70 that I had from my MotoG7Power and that worked flawlessly. A newer version of Busybox did not install on my device because I didn’t have Write access going into it but that version I can attest works.
7. Stock Firmware (Just in case, remember?) I used XT2113_KIEV_RETUS_10_QZK30.Q4-40-55_subsidy-DEFAULT_regulatory-DEFAULT_CFC_R1_CFC.xml which is the US Retail software and the XT2113-3_KIEV_RETEU_10_QZKS30.Q4-40-62-2_subsidy-DEFAULT_regulatory-XT2113-3-EU-SAR_CFC.xml instead of MetroPCS's firmware because I hate any branded US carrier bloatware and such and like that factory unlocked from the manufacturer feel. Both of my phones flashed fine with it and you can find it here: Moto One 5G Ace ALL Firmwares. It doesn't matter what your carrier is, they have them all there.
8. The stock charging cable that comes with your phone.
The Process
1. Make sure the phone is at least halfway charged. Last thing you want is the phone to die in the middle of any of this and cause a system error that you might can’t get out of.
2. Make sure your have installed your Root Explorer and Busybox beforehand.
3. Extract @munjeni’s Super Unpack Repack Tool. Copy the file “superrepack.arm64_pie” to your phone.
4. Rename “superrepack.arm64_pie” on your phone to “superrepack” (obviously without quotations).
5. Move “superrepack” file on your phone to /data/local/tmp folder. If you have root and using a root explorer you can’t miss it (obviously without quotations).
6. Connect your phone to your PC via the charging cable.
7. Open TinyADB and Fastboot. Do not open it as an administrator or it will not function correctly getting root access on your device.
8. Type: “adb shell” and press enter. This will change C:/TheNameOfYourDirectory to kiev:/ $
9. Type: “su” and press enter. This will change the dollar sign “$” to a sharp symbol “#” and will look like kiev:/ # Make sure you allow permissions if Magisk asks for it or it will give you a permission denied message.
10. Type: “ls -Alg /dev/block/by-name | grep "super"” and press enter since you need to know where your block device is. It should return a result that looks like “lrwxrwxrwx 1 root 16 1970-01-01 08:07 super -> /dev/block/NameOfYourBlock” (obviously without quotations except the quotations in "super" - keep those)
11. Copy and paste somewhere “/dev/block/NameOfYourBlock” (obviously without quotations). You’re going to need that later.
12. Close TinyADB and Fastboot. Now open a fresh instance of it in a new window.
13. Type: “adb shell” (obviously without quotations) and press enter. This will change C:/TheNameOfYourDirectory to kiev:/ $
14. Type: “su” (obviously without quotations) and press enter. This will change the dollar sign “$” to a sharp symbol “#” and will look like kiev:/ #
15. Type: “chmod 755 /data/local/tmp/superrepack” (obviously without quotations) and press enter as the chmod command will give us root permissions to run the script. This is VERY IMPORTANT. Don’t worry if it goes to a blank next line that’s normal.
16. Type: “setenforce 0” (obviously without quotations) and press enter as we need to disable selinux. Again, don’t worry if it goes to a blank next line as that’s normal.
17. Type: “/data/local/tmp/superrepack /dev/block/NameOfYourBlock” (obviously without quotations) and press enter. Let the script run to the end.
18. Reboot your phone. Close Tiny ADB and Fastboot.
19. When your phone is rebooted go to Root Explorer (or your explorer).
20. Mount the system in your file explorer! You should have R/W Access in ALL of your partitions.
If Something Goes Wrong And You Have To Reflash Your Phone…
Please refer to the guides in the forum on how to get your phone back to stock. There’s one for flashing, one for root, and a subsequent one for debloat.
If you come up with an error, please go to the original thread https://forum.xda-developers.com/t/tool-win-lin-and-darw-super-image-unpack-repack-tools.4120963/ and let @munjeni know what the issue is so he can help.
Hope this brings some love to the Moto One 5G Ace users. We definitely need a boost to lift development spirits.
I will try and answer questions if I can or point you in the right direction.
Click to expand...
Click to collapse
This didn't work for me. My access is no different than when I started. The script showed the third partition was a different type.
Okay I want to give the benefit of doubt here so; what do you mean by V7 having clone issues? I'd say I had clone issues after following this tutorial but a more accurate description would be "hacked". So I'm just a little confused; could you elaborate a little on the "cloning issue" and differences between V2, 7 and 9? Thank you.
Wish we had a working TWRP FOR THE MOTO ACE.. Would open so many doors for this phone...
skinlab said:
Wish we had a working TWRP FOR THE MOTO ACE.. Would open so many doors for this phone...
Click to expand...
Click to collapse
I think it has not been released because it has problems with touch screen operation.
And in the case of motorola, you can't run these tools on twrp.
There is a high possibility that the protection function of the device will kick in and cause an error.
Ok. I got it to work after I reflashed the original ROM. Thanks for you help. I used 3 of your guides to get success! You are to be commended.
clintongsan said:
Okay I want to give the benefit of doubt here so; what do you mean by V7 having clone issues? I'd say I had clone issues after following this tutorial but a more accurate description would be "hacked". So I'm just a little confused; could you elaborate a little on the "cloning issue" and differences between V2, 7 and 9? Thank you.
Click to expand...
Click to collapse
You will have to ask munjeni. I just reposted what he sent me. But its not a hack issue, the superpartitions have a bad habit of reproducing themselves once you mod anything.
PEACH-PIT said:
I think it has not been released because it has problems with touch screen operation.
And in the case of motorola, you can't run these tools on twrp.
There is a high possibility that the protection function of the device will kick in and cause an error.
Click to expand...
Click to collapse
Not true. The Nairo variant of the Moto One 5G has TWRP. The mods over there had to make their own modules. I don't know how to do that, so all I have is an experimental working build with no touchscreen access.
PEACH-PIT said:
https://forum.xda-developers.com/t/script-android-10-universal-mount-system-read-write-r-w.4247311/
"moto g 5g" can use makeSystemRW v1.31.
It must be used in conjunction with makesysrw_repair.
makesysrw_repair requires linux.
The size option will not work if it is too large or too small.
You need to specify an appropriate size.
Please adjust it by yourself.
I got the right result with 20mb.
adb shell
su
chmod +x /data/local/tmp/makesysrw_1.31/makesysrw.sh
setenforce 0
./data/local/tmp/makesysrw_1.31/makesysrw.sh size=20
Click to expand...
Click to collapse
Tried using it in TWRP and it didn't work. Error 73.
Articul8Madness said:
Tried using it in TWRP and it didn't work. Error 73.
Click to expand...
Click to collapse
Why are you using TWRP to run that script?
If you run those scripts in linux, they will work fine.
I'm using BBQlinux.
Unfortunately you can't get r/w unless you use sysrw_repair.
PEACH-PIT said:
Why are you using TWRP to run that script?
If you run those scripts in linux, they will work fine.
I'm using BBQlinux.
Unfortunately you can't get r/w unless you use sysrw_repair.
Click to expand...
Click to collapse
@lebigmac said we could run the script from TWRP. That is how he initially designed it so I gave it a shot.
So, I am brand new here. Just signed up after reading straight for 6.5 hours (give or take). I have also been doing as much research as possible as I want to root my Moto One 5G Ace and it seemed like this forum is the best as far as knowledge and clarity. But it seems that with the multiple guides on here for this same device I am not sure exactly which to follow and where... as well as a few other concerns. But firstly, as I am reading about the R/O aspect, what exactly is the big benefits of going through this process exactly. To my knowledge R/W is one of the biggest benefits to rooting a phone. Not the only one of course but a big one nonetheless. I will hold of with doing anything until I get some opinions on it as well as a definitive answer as to what guide I should be following. Many thanks fellow tinkerers!
Paul_Neocube said:
So, I am brand new here. Just signed up after reading straight for 6.5 hours (give or take). I have also been doing as much research as possible as I want to root my Moto One 5G Ace and it seemed like this forum is the best as far as knowledge and clarity. But it seems that with the multiple guides on here for this same device I am not sure exactly which to follow and where... as well as a few other concerns. But firstly, as I am reading about the R/O aspect, what exactly is the big benefits of going through this process exactly. To my knowledge R/W is one of the biggest benefits to rooting a phone. Not the only one of course but a big one nonetheless. I will hold of with doing anything until I get some opinions on it as well as a definitive answer as to what guide I should be following. Many thanks fellow tinkerers!
Click to expand...
Click to collapse
This phone is great once you have done all the steps. It took me a while to get it all done correctly.
You need to follow the steps in the complete noob guide to rooting. I tried shortcuts that ultimately did not work. Then follow the guide to get read/write access. If you want to debloat, use the guide on using the package manager.
You can also add TWRP recovery. I forgot which guide I chose. I continue to find new dialer, contacts, etc. and remove stock programs. So have fun.

Categories

Resources