Database Info

[HOW-TO][FIX] Repair your IMEI with QPST - updated w/ info

Huge thanks to Peoplearmy for providing me with the knowledge on how to do this.
This guide is intended for those who:
Lost their IMEI and did not back it up
OR
Lost their IMEI, which now reads "0" (one zero)
Operating system needed: WINDOWS
If you are running OSX or Linux you can emulate Windows by using Parallels (OSX) or Virtualbox (Linux)
Things you need:
QPST_2.7_378
Rooted stock ROM (Root66 preferred)
======================START======================​
Download QPST from the link above
Write down your IMEI (you can find it on the back of the phone behind the battery)
Turn on your phone
Open the keypad and dial *#22745927
Enable hidden menu
Go back to the keypad and dial *#7284#
Click Qualcomm USB Settings
Select RMNET + DM + MODEM and click ok
On your computer, open up Device Manager
Locate Ports (COM & LPT) and expand it
You should see the following:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Write down (COM10) (yours may be different, just write it down)
Open up QPST
Select Ports & Add new port...
Enter your port (mine was (COM10) so I will put "COM10" in BOTH boxes)
In QPST select Start Clients and RF NV Item Manager
In RF NV Item Manager go to Settings -> Comport
Select your port from the drop menu and press ok
Under "File" choose Read Supported NV RF Items
From the list of items navigate to number 550
You will see 9 text boxes. This is where you will put in your IMEI. It's weird how it's ordered so follow this EXACTLY. You will need to enter your IMEI from left to right, but backwards. Here's what I mean:
***Make sure the Hex box is checked***
Code:
[B]EXAMPLE:[/B] Say your IMEI is 954091051099226
The boxes would look like so:
8 (This must go in the first box)
9a (The "a" represents the fact that the last pair only consists of 1 number)
45
90
01 (this can be written as 1 as well)
15
90
29
62
Once you enter in the data, press Write NV
Reboot your phone (remember to put your phone back to MTP + ADB by dialing *#7284#)
Your IMEI is now back!
Nice work going through all that :highfive:
=============NEED HELP / HAVE QUESTIONS?=============​
I don't see "Ports (COM & LPT)" in Device Manager. Where is it?
Some of you may have trouble, even after dialing the correct numbers and that's okay. Here's what you need to do:
Open up cmd as Administrator
Type hdwwiz.exe to start the Hardware Wizard
Follow the onscreen prompts until you come to two choices
Select Install the hardware that I manually select from a list (Advanced)
Scroll down until you find Ports (COM & LPT) and select it
Add your phone's ports
Now go into Device Manager on your computer and start from instruction #10 in the first part of this guide.
Any news on fixing _______?
If there are any developments, I'd be posting about them on Twitter
I like this a lot. I want to donate to you.
Thanks for the consideration, but please donate to Peoplearmy instead. He is the main mastermind behind this.
=================FOR KNOWLEDGE=================​
If your previous phone was only capable of 3G - remember we had to dial *228 to activate it or update our PRL? Well, DO NOT dial this on a 4G phone. Constantly dialing *228 on our Galaxy S3s has the potential to fry the SIM cards rendering our phones useless. With 4G phones, the PRL is automatically pushed to the phone via the SIM card and should be given periodic updates by Verizon.

Great info. Thanks for the how to! Third (or fourth) line should be 01 btw . Hope this will ressurect some bricks!
Sent from my SCH-I535 using xda app-developers app

prenedo said:
Great info. Thanks for the how to! Third (or fourth) line should be 01 btw . Hope this will ressurect some bricks!
Sent from my SCH-I535 using xda app-developers app
Click to expand...
Click to collapse
Oh, right. Thanks lol

This should encourage more people to try out the AOSP releases!
One note, in your IMEI example, I think you have 10 instead of 01. If I'm wrong, please delete this post.
Mods, feel free to delete once it's fixed.
Sent from my SCH-I535 using Tapatalk 2

mmalkin said:
This should encourage more people to try out the AOSP releases!
One note, in your IMEI example, I think you have 10 instead of 01. If I'm wrong, please delete this post.
Mods, feel free to delete once it's fixed.
Sent from my SCH-I535 using Tapatalk 2
Click to expand...
Click to collapse
Corrected it lol

This is great development. Will try CM10 in a week
Sent from Verizon Galaxy S 3 w/ XDA APP

It is awesome to know... I may try CM9 or CM10 later...

Just wanted to point out on the QPST download page, don't click any of the "download" buttons (there are multiple on the page). Just scroll to the middle of the page, enter the code, and click on "Qualcomm Product Support Tools (QPST) v.2.7.323"
Hitting the download buttons downloaded a "setup.exe" file. Not sure what it does but it sounds suspicious. Hope that helps and thanks PureMotive for the very thorough guide.

Thanks for your hard work, looks great..

Has anyone who lost their IMEI tried this?
Sent from my Verizon Samsung Galaxy S III with a locked bootloader - F*** YOU VERIZON

weblexa said:
Has anyone who lost their IMEI tried this?
Sent from my Verizon Samsung Galaxy S III with a locked bootloader - F*** YOU VERIZON
Click to expand...
Click to collapse
I just did it yesterday.

This should be moved to Original Development so it doesn't get lost and is truly original.
Sent from my SCH-I535 using xda premium

How to do it from cm10 http://forum.xda-developers.com/showpost.php?p=29434759&postcount=152

PureMotive said:
I just did it yesterday.
Click to expand...
Click to collapse
Awesome. I've been holding off on flashing CM10 until we found a way to fix the IMEI. Think I'll do some flashing tonight.
Sent from my Verizon Samsung Galaxy S III with a locked bootloader - F*** YOU VERIZON

PureMotive said:
Thanks to peoplearmy for providing me with the knowledge on how to do this.
This guide is intended for those who:
Lost their IMEI and did not back it up
OR
Lost their IMEI, which now reads "0" (one zero)
Operating system needed: WINDOWS
If you are running OSX or Linux you can emulate Windows by using Parallels (OSX) or Virtualbox (Linux)
Things you need:
QPST version 2.7 build 323
Rooted stock ROM
======================START======================​
Download QPST from the link above
Write down your IMEI (you can find it on the back of the phone behind the battery)
Turn on your phone
Open the keypad and dial *#22745927
Enable hidden menu
Go back to the keypad and dial *#7284#
Click Qualcomm USB Settings
Select RMNET + DM + MODEM and click "ok"
On your computer, open up Device Manager
Locate Ports (COM & LPT) and expand it
You should see the following:
Write down (COM 10) (yours may be different, just write it down)
Open up QPST
Select Ports & Add new port...
Enter your port (mine was (COM 10) so I will put "COM10" in BOTH boxes)
In QPST select Start Clients and RF NV Item Manager
In RF NV Item Manager go to Settings -> Comport
Select your port from the drop menu and press "ok"
Under "File" choose Read Supported NV RF Items
From the list of items navigate to number 550
You will see 9 text boxes. This is where you will put in your IMEI. It's weird how it's ordered so follow this EXACTLY. You will need to enter your IMEI from left to right, but backwards. Here's what I mean:
***Make sure the Hex box is checked***
EXAMPLE: Say your IMEI is 954091051099226
the boxes would look like so:
8 (This must go in the first box)
9a (I believe the "a" represents the fact that the last pair only consists of 1 number)
45
90
01 (this can be written as 1 as well)
15
90
29
62
Once you enter in the data, press "Write NV"
Reboot your phone
Congrats, your IMEI is back!
Click to expand...
Click to collapse
Frigging AWESOME! GREAT work all!
Sent from a galaxy far, far away....

Can anyone go to Settings -> Status and locate their MEID and tell me how many digits it is? Also, please let me know if you only see numbers or if there are letters as well. I believe a corrupt MEID (Dec & Hex) is the cause of errors such as persistent roaming and I would like to try to find a fix.

my MEID is 14 digits long. IMEI is 15 digits. both correct. on cm10.

PureMotive said:
Can anyone go to Settings -> Status and locate their MEID and tell me how many digits it is? Also, please let me know if you only see numbers or if there are letters as well. I believe a corrupt MEID (Dec & Hex) is the cause of errors such as persistent roaming and I would like to try to find a fix.
Click to expand...
Click to collapse
MEID DEC = all numbers. 18 total
MEID HEX = numbers and letters. 1 letter (x) and 15 numbers. The letter is the 2nd thing listed followed by 14 numbers. For example, 0x13234123412341

larry_walker said:
my MEID is 14 digits long. IMEI is 15 digits. both correct. on cm10.
Click to expand...
Click to collapse
Thank you. Do you have numbers and letters in your MEID or is it just one or the other? Also, is it a single string of numbers?
I forgot to ask, but if anyone is thinking of switching ROMs soon, can you compare the MEID on your first ROM with the MEID on the second ROM? Tell me if they are the same or different. This will greatly help development. Thanks!

PureMotive said:
Thank you. Do you have numbers and letters in your MEID or is it just one or the other? Also, is it a single string of numbers?
I forgot to ask, but if anyone is thinking of switching ROMs soon, can you compare the MEID on your first ROM with the MEID on the second ROM? Tell me if they are the same or different. This will greatly help development. Thanks!
Click to expand...
Click to collapse
Is my MEID corrupted since i have a dec and hex?

[GUIDE] How to get GSM signal back after selecting USA Band in *#*#4636#*#*

Have you ever lose your phone ‘s signal due to accidentally selecting USA BAND in *#*#4636#*#* menu? If yes, this guide is for you. Thanks to @ian.anindya for guidance and clues on how to restore my phone’s signal back.
Requirement:
1. Rooted HTC One E8 phone
2. Knowledge on how to use ADB command
3. Software Qpst, Qxdm and Mztool
4. A cup of coffee
This is how to do it:
1. Download all necessary software here and extract to separate folder.
2. Install Qpst and Qxdm.
3. Enable USB debugging on your phone and connect it to PC. Verify with command
Code:
adb devices
It must show your device ID and must not be offline.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Input command below to activate diagnostic mode
Code:
adb shell
su
If this is the first time you issue the command, check your phone. There is a prompt asking for root permission, grant it. Continue with below command
Code:
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/on
5. Your PC will detect new hardware and install necessary drivers. If you do not have the drivers, browse to HTC Diag folder which you download together with qpst and qxdm software. If the drivers installation succeed, check your PC device manager and it will show your HTC Diagnostic Interface (in my case COM5, the value can be different on your PC).
Your phone is now ready for the fun part playing with NV items
6. Open QPST configuration from your windows start menu. Go to Ports tab, and then add your HTC Diag com port.
7. We need to backup current NV items in case something goes wrong. Choose start client, software download. On backup tab, select where to store .qcn file and click start and wait until finished. After finished, close QPST program.
8. Open QXDM professional from your windows start menu. Select NV Browser in the drop down list. Since we do not connect our phone yet, the NV list is not editable.
9. Choose option, communications. Select HTC Diag com port in the target port. If succeed now the NV browser window is editable.
Tick Dual SIM if your phone is dual SIM version. Subscription ID field will be activated.
ID 0 is for SIM 1 and ID 1 is for SIM 2.
For this purpose, we will only need to edit NV item 1877, 441, 946 and 2954.
10. SIM 1
Make sure Dual SIM is ticked and Subscription id is 0.
We use Mztool application to define frequency parameters.
Go to Band Preference (NV Value) tab to configure GSM and WCDMA frequency that we want to put in our phone. Choose the frequency that supported by your phone.
Mine is like this
According to the picture,
Box No.1 refers to NV item 1877. Value is 73925504 (remove commas)
Box No.2 refers to NV item 441. Value is 896
Box No.3 refers to NV item 946. Value is 1128
Box No.4 referes to NV item 2954. Value is 0
All values are in Decimal
Now we need to input these values in NV browser window in Qxdm.
NV Item 1877
On column ID, find item 1877. Click Read to read current value. Take note of it, in case something goes wrong. Write the new value 73925504 under input field and click Write. Click Read again to verify.
NV Item 441
On column ID, find item 441. Click Read to read current value. Take note of it, in case something goes wrong. Write the new value 896 under input field. The value is automatically converted in to Hex.
In my case 896 in decimal is the same as 0x380 in Hex. Click Write. Click Read again to verify.
Do not touch the nam value.
NV Item 946
On column ID, find item 946. Click Read to read current value. Take note of it, in case something goes wrong. Write the new value 1128 under input field. The value is automatically converted in to Hex.
In my case 1128 in decimal is the same as 0x468 in Hex. Click Write. Click Read again to verify.
Do not touch the nam value.
NV Item 2954
On column ID, find item 2954. Click Read to read current value. Take note of it, in case something goes wrong. Write the new value 0 under input field and click Write. Click Read again to verify.
Do not touch the nam value.
Up to here, if you reboot your phone, It should get GSM/WCDMA signal on SIM 1 only. Now we are working for SIM 2.
11. SIM 2
Dual SIM is still ticked but this time choose Subscription ID 1
Remember that SIM 2 supports only GSM (no WCDMA). So in Mztool, choose only GSM signal.
Mine is like this
According to the picture,
NV item 1877 value is 2622336
NV item 441 value is 896
NV item 946 value is 40
NV item 2954 value is 0
All values are in Decimal
Do the same procedures as SIM 1.
12. After finished editing NV items, close Qxdm and then we have to close the diagnostic mode.
Wait around 10 seconds and then input command below to deactivate diagnostic mode
Code:
adb shell
su
echo 0 > /sys/devices/virtual/android_usb/android0/f_diag/on
13. Reboot your phone using ADB command
Code:
adb reboot
After rebooting your phone, wait for 1 or 2 minutes and then hopefully you will get the GSM/WCDMA signal.
Later on, I will continue this guide on how to add LTE Band

===Reserved===

Hello,.
first off all im from Indonesia too, from Surabaya,..
Ane komen pake bahasa inggris aja ya soalnya ini forum internasional
I had that issue too, try to factory reset about several time but still no clue,...
i sent my device to service center, about 1 month and when my device back, its updated from 4.4.2 to 5.0.2, but my sim 1 slot still no signal, its ridiculous how htc tech guy work, they not test my device after update
i wanna follow your guide,. is that work on lolipop?
thanks for advice

Yes, it works on lolypop 5.0.2. Root your device first using latest supersu, flash from twrp recovery.

stuntgp said:
Yes, it works on lolypop 5.0.2. Root your device first using latest supersu, flash from twrp recovery.
Click to expand...
Click to collapse
Yes i'm gonna try to root it first, newbie about it, so many reading about "how to" :laugh:
wish me luck,.. im gonna inform you and maybe need your advice if meet any trouble,.. :laugh:

after reading all night, try and error your guide on second night, yeahhhh finally my sim 1 signal HTC E8 (m8sd - Indonesia) goes ON again, and normal capturing network Indosat, and Simpati (Indonesian Provider) and look working good on HSDPA and 3G ,...
BTW your value on MZtools is different when im genereate, but i am follow your value (because i know we are from same country),..
HTC Service in Indonesia cannot fix this, THEY JUST UPGRADE ROM FROM 4.4.2 TO 5.02 I DONT KNOW WHY THEY ARE NOT TESTING MY SIGNAL FIRST BEFORE SEND BACK MY DEVICE,....
HAHAHAH THX A LOT FOR MADE THIS GUIDE,..... its really reliable guide and easy to follow (i am noob )...

bugs182 said:
after reading all night, try and error your guide on second night, yeahhhh finally my sim 1 signal HTC E8 (m8sd - Indonesia) goes ON again, and normal capturing network Indosat, and Simpati (Indonesian Provider) and look working good on HSDPA and 3G ,...
BTW your value on MZtools is different when im genereate, but i am follow your value (because i know we are from same country),..
HTC Service in Indonesia cannot fix this, THEY JUST UPGRADE ROM FROM 4.4.2 TO 5.02 I DONT KNOW WHY THEY ARE NOT TESTING MY SIGNAL FIRST BEFORE SEND BACK MY DEVICE,....
HAHAHAH THX A LOT FOR MADE THIS GUIDE,..... its really reliable guide and easy to follow (i am noob )...
Click to expand...
Click to collapse
Glad to hear that... Now I am trying to inject LTE band, especially for Band 3 and Band 8 which is supported in Indonesia.

Thanks bro
This thread solved my problem after 1,5 months)
Good job
I'm from indonesia too
Malang exactly
Thanks for @ian.anindya for show me this thread and remoted my pc using team viewer to unbrick my phone
Sorry for bad english
Sent from my HTC One_E8 dual sim using XDA Free mobile app

network Roaming not working after this nv restore
hi there,
thanks a lot for putting up these recovery steps..they were really helpful..but only one thing is that i'm still unable to get a signal while roaming..
do you have any solution for the same..or atleast if i can get a backup of qcn file from stock untouched htc e8 ...that should help..

Jude85 said:
hi there,
thanks a lot for putting up these recovery steps..they were really helpful..but only one thing is that i'm still unable to get a signal while roaming..
do you have any solution for the same..or atleast if i can get a backup of qcn file from stock untouched htc e8 ...that should help..
Click to expand...
Click to collapse
I have not tried roam with other network, but have you checked frequency band of your destination network? and compare with the one in your NV items list?

stuntgp said:
I have not tried roam with other network, but have you checked frequency band of your destination network? and compare with the one in your NV items list?
Click to expand...
Click to collapse
Hi, this is more about a national roaming within india and i dont think the bands will vary in such case...and to be more clear i had searched the bands listed for E8 dual sim on htc site and added them on the mz tool. i believe there is some other nv item that needs an edit to enable the roaming, would be of great help if you could suggest reg it.

Install Superuser "The su binary is out of date."
stuntgp said:
Yes, it works on lolypop 5.0.2. Root your device first using latest supersu, flash from twrp recovery.
Click to expand...
Click to collapse
I am having difficulty in rooting my phone (HTC One E8 Dual Sim) completely, as I get error message "The Superuser binary (su) must be updated. Please choose an installation method. Recovery mode installation is recommended for HTC devices." Options are --> Cancel/ Recovery Install. When I choose Recovery Install, I get another screen which states "There was an error installing Superuser. Please send a log of the error to the developer."
I used TWRP 2.8.7.0 to flash recovery through ADB and installed superuser.zip obtained from clockworkmod site which I guess is the latest version of SU.
I request for your technical expertise to help m e out as I need to perform lot of troubleshooting steps further to rectify the issue with USA Band.
Thank you.

Jude85 said:
Hi, this is more about a national roaming within india and i dont think the bands will vary in such case...and to be more clear i had searched the bands listed for E8 dual sim on htc site and added them on the mz tool. i believe there is some other nv item that needs an edit to enable the roaming, would be of great help if you could suggest reg it.
Click to expand...
Click to collapse
Hi ,
could you pls post the NV items used ,
I'm from India too , but i couldnt get CDMA signal after chaging NV items .
Now im able to use GSM only in slot 2 .
in Slot 1 couldnt reconize cdma/gsm .
---------- Post added at 05:12 AM ---------- Previous post was at 05:08 AM ----------
stuntgp said:
I have not tried roam with other network, but have you checked frequency band of your destination network? and compare with the one in your NV items list?
Click to expand...
Click to collapse
Hi ,
could you pls post the NV items used ,
I'm from India too , but i couldnt get CDMA signal after chaging NV items .
Now im able to use GSM only in slot 2 .
in Slot 1 couldnt reconize cdma/gsm .

default qcn /original qcn
Even my phone sim slot one doesnt work. it detects sim number but no n/w. I tired changing the NV items as suggested, still no n/w
I have only 2G n/w in sim slot 2
The moment i reached US, slot one stopped working.
Please suggest some way to enable slot one .
Thanks
rahul01libra said:
Hi ,
could you pls post the NV items used ,
I'm from India too , but i couldnt get CDMA signal after chaging NV items .
Now im able to use GSM only in slot 2 .
in Slot 1 couldnt reconize cdma/gsm .
---------- Post added at 05:12 AM ---------- Previous post was at 05:08 AM ----------
Hi ,
could you pls post the NV items used ,
I'm from India too , but i couldnt get CDMA signal after chaging NV items .
Now im able to use GSM only in slot 2 .
in Slot 1 couldnt reconize cdma/gsm .
Click to expand...
Click to collapse

For people under warranty !
Hey Guys ! I had the same problem in my HTC E8. Gave it to the service centre and got the motherboard replaced after ~25 days.
Just got the phone back . Has a different IMEI number now.
Phone now has Wifi signal issues ( Getting very less signal strength in relative comparison to my other phone ) and it takes about ~15minutes for the data to turn ON.
Hence the phone is back to the service centre .

can be refurbished device
icyspikey said:
Hey Guys ! I had the same problem in my HTC E8. Gave it to the service centre and got the motherboard replaced after ~25 days.
Just got the phone back . Has a different IMEI number now.
Phone now has Wifi signal issues ( Getting very less signal strength in relative comparison to my other phone ) and it takes about ~15minutes for the data to turn ON.
Hence the phone is back to the service centre .
Click to expand...
Click to collapse
The warranty replacement can be refurbished ones. This is the only reason I did not send my mobile to HTC US warranty claim centre. The Indian purchased mobile also have global warranty , but the claim device can be refurbished. I purchased mine just 3 month back for full price and dont want to receive refubished unit
So still working on my second sim slot, hopefully if the first sim slot works in India once I reach , I will be very happy . Atleast i dont have to fight with HTC for warranty replacement .
Anyways i will never buy another HTC .

NV Items for Indian bands used in HTC ONE E8
SIM 1
1877 : 82314112
0441 : 896
0946 : 1256
2954 : 0
SIM 2
1877 : 2622336
0441 : 896
0946 : 40
2954 : 0
Atlast my both sim s working gr8 .
Thank you Anindya for such a great post ...............:good::good::good::good::good::good::good::good:
---------- Post added at 12:29 PM ---------- Previous post was at 12:25 PM ----------
VERY big Thank you:good::good::good::good::good::good::good::good::good::good::good::good:
d

can see both band USA and Cellular(800 Mhz)
rahul01libra said:
SIM 1
1877 : 82314112
0441 : 896
0946 : 1256
2954 : 0
SIM 2
1877 : 2622336
0441 : 896
0946 : 40
2954 : 0
Atlast my both sim s working gr8 .
Thank you Anindya for such a great post ...............:good::good::good::good::good::good::good::good:
---------- Post added at 12:29 PM ---------- Previous post was at 12:25 PM ----------
VERY big Thank you:good::good::good::good::good::good::good::good::good::good::good::good:
d
Click to expand...
Click to collapse
Thanks a lot for response, Now with your NV values, i can see both bands USA and Cellular (800 MHz) from *#*#4636#*#*
Atleast it has come back to original setting , even though i still dont have n/w in sim slot 1

With my experiance ..... pls follow the below ,,,,
Put the CDMA in SIM lot 1 and GSM in sim slot 2
1 . Got to *#*#4636#*#* and selct radio bands to Cellular (800 MHz) only ,,,,
2 .. and keep the all type of signalings like WCDMA/GSM/CDMA/EVODO/LTE auto ......
u will get sifnal in both sims.................
keep rocking.......................:good::good::good::good::good:

slot one is tmobile gsm
I am using T-Mobile gsm in slot one . I think wcdma or 3g gsm should work onnslot one . Correct me if I am wrong
Airtel 2g/3g used to work in slot one when I was in India
I will be happy even if 2g works . I have kept the settings as you have mentioned

[Guide] Fix and Re-Locking Bootloader From Fake UBL

ULTIMATE GUIDE TO FIX ROM FROM FAKE UNLOCK BOOTLOADER​
Device: Redmi Note 5/Pro (Whyred)
Anti: 3 (required)
Initial Rom: Global/China with ARB v3
Method: Test Point
As we know that buying whyred from a distributor with a red box has a strange rom and also mi account that can't be binded. this is very troublesome when we want to unlock the bootloader..
This method is to really lock the Bootloader again, can bind Mi account and can be used for Unlock bootloader officially.
And finally, this method doesn't need to edit the script anymore, I upload patch scripts and loaders specifically for ROM 9.5.17 below.
It has been tested and the results are successful.
Let's start and DWYOR!
Step:
1. Download ROM 1 and ROM 2 below then extract.
2. Download the Patch then copy and replace it in ROM 1 which has been extracted (in the images folder).
3. Open back cover of the phone carefully and connect to the PC via Test Point (HS-USB QDLoader 9008)
4. Flash ROM 1 that has been patched with MiFlash (I use MiFlash 2017.4.25.0 and PC 64bit during flashing).
5. After success, close the miflash, unplug the cable, and turn it on. Wait a few moments until stuck in recovery mode (pict 1)
6. Connect Whyred to PC again via Test Point and Flash ROM 2 with MiFlash.
7. Wait for the first boot, after entering the system, check unlock status in developer mode and tadaaaa.. it's completely locked now... (pict 2)
8. Bind Mi account, continued unlock bootloader officially.
9. Done! ready to go to custom ROM
Note:
1. Patch is only used for ROM 1 (Global 9.5.17).
2. ROM 2 can use all China ROMs as long as still ARB v3.
Picture:
Pict 1
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Pict 2
War Equipment:
ROM 1. (Global 9.5.17): LINK
ROM 2. (China 9.5.21): LINK
Patch: LINK
Just Hit THANKS Button for Supporting me..

Any chance this guide can be updated for ARB4? At least the patch file?
Edit:
Nevermind, I see it cannot be done.

poncespr said:
Any chance this guide can be updated for ARB4? At least the patch file?
Edit:
Nevermind, I see it cannot be done.
Click to expand...
Click to collapse
The same mistake is also available

poncespr said:
Any chance this guide can be updated for ARB4? At least the patch file?
Edit:
Nevermind, I see it cannot be done.
Click to expand...
Click to collapse
UtkuAblak said:
The same mistake is also available
Click to expand...
Click to collapse
sorry bro, currently only available for arb 3. refers to the difficulty of flashing if it has arb 4. coz the test point method in arb 4 must use an authorized account.
there is a guide to bypass this authorized account, but there are some reports that still fail.
this weirdness has been made xiaomi itself..

octodellin said:
sorry bro, currently only available for arb 3. refers to the difficulty of flashing if it has arb 4. coz the test point method in arb 4 must use an authorized account.
there is a guide to bypass this authorized account, but there are some reports that still fail.
this weirdness has been made xiaomi itself..
Click to expand...
Click to collapse
Stupid me that updated my RMN5Pro before reading these guides. Still is a great phone. Just wanted a taste of pie.

Mi phone deat
Sir, my nead mi authorized account please help me this my id 1813003637
---------- Post added at 05:50 PM ---------- Previous post was at 05:39 PM ----------
Sir my need mi authorized account please help me
This is my id 1813003637 sorry for my bad english

I have ARB3 device with fake ubl. I want to try this method, but I can not fully understand what we do with battery while short circuit the test points(5th step).
After writing 1st ROM, we connect the battery, then open device and stuck with recovery. After this (6th step), will I disconnect the battery again, while test point?

And another question;
while writing 1st or 2nd ROM which option we select with MiFlash Tool? "Clean_all" or "Clean_all and Lock" ?

How can I check for Fake UBL to be sure for 100% that I need this ?

netlogger said:
I have ARB3 device with fake ubl. I want to try this method, but I can not fully understand what we do with battery while short circuit the test points(5th step).
After writing 1st ROM, we connect the battery, then open device and stuck with recovery. After this (6th step), will I disconnect the battery again, while test point?
Click to expand...
Click to collapse
yes, like the first..
netlogger said:
And another question;
while writing 1st or 2nd ROM which option we select with MiFlash Tool? "Clean_all" or "Clean_all and Lock" ?
Click to expand...
Click to collapse
both can be used, coz basically our whyred is in locked bootloader.
but for sure, you can choose Clean_all and Lock
The4anoni said:
How can I check for Fake UBL to be sure for 100% that I need this ?
Click to expand...
Click to collapse
go to fastboot mode and run fastboot command:
Code:
fastboot getvar anti
if the displayed output is 3, is good. that means you can use this method.
if the displayed output is 4, you can not use this method.

octodellin said:
go to fastboot mode and run fastboot command:
Code:
fastboot getvar anti
if the displayed output is 3, is good. that means you can use this method.
if the displayed output is 4, you can not use this method.
Click to expand...
Click to collapse
I know how to check anti rollback... I want to check does my bootloader is fake unlocked or not

I copied the patch files to the ROM1 images folder.
I open miflash, selected the ROM1 folder.
I made the testpoint method, and I see driver 9008.
then clicked the refresh button then Flash button on miflash program. It writes "flashing".
Flashing process starts, but after that, it stucks while writing keymaster.mbn file. I waited over 20 minutes but nothing happened.
I tried another miflash from may 2018, but same situation.
I tried other USB ports, nothing changed.
I checked the log file. At begining it seems everything normal, but when it came to write keymaster.mbn file(this is the first file to flash)
The log file looks like this:
...
: Write file C:\RN5... ....\images\keymaster.mbn to partition[keymaster] sector 65536
: write file legnth 357392 to partition 65536
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
...
And gooes on like this for over 80000 lines. I closed the miflash.
I checked the phone, nothing happened, It opens normally, old rom still there...
what can be the situation?

The4anoni said:
I know how to check anti rollback... I want to check does my bootloader is fake unlocked or not
Click to expand...
Click to collapse
1. check in mi unlock status from developer mode
2. check from fastboot command: fastboot oem device-info
3. test to unlock bootloader
if you face unlocked in mi unlock status but in fastboot showing "Device unlocked: false" even more you can't bind account, thats mean you unlocked is fake.
netlogger said:
I copied the patch files to the ROM1 images folder.
I open miflash, selected the ROM1 folder.
I made the testpoint method, and I see driver 9008.
then clicked the refresh button then Flash button on miflash program. It writes "flashing".
Flashing process starts, but after that, it stucks while writing keymaster.mbn file. I waited over 20 minutes but nothing happened.
I tried another miflash from may 2018, but same situation.
I tried other USB ports, nothing changed.
I checked the log file. At begining it seems everything normal, but when it came to write keymaster.mbn file(this is the first file to flash)
The log file looks like this:
...
: Write file C:\RN5... ....\images\keymaster.mbn to partition[keymaster] sector 65536
: write file legnth 357392 to partition 65536
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
: WriteFile position 0, size 0
...
And gooes on like this for over 80000 lines. I closed the miflash.
I checked the phone, nothing happened, It opens normally, old rom still there...
what can be the situation?
Click to expand...
Click to collapse
1. make sure that you have extracted the patch. there are 3 files that must be replaced to the images folder in ROM 1 (Global 9.5.17)
2. use the miflash that I use
3. try to change clean all or clean all and lock, with flash_all.bat
hope it works for you ..

I allready tried that all of you wrote. But in windows command prompt mode, I tried to execute flash_all.bat with admin rights. It didn't work.
---------- Post added at 10:45 AM ---------- Previous post was at 10:42 AM ----------
I allready tried all. Nothing changes.
I tried to run flash_all.bat from command prompt with admin rights, but that does not work.

Bruh. Thanks a lot. This is the ONLY guide that has helped me fix my Note 5 Pro.
I was on global rom from the seller... I'm flashing a bunch of ARB 3 or lower MIUI roms... I accidently flashed with lock the bootloader...
That bricked my phone. No other roms would work. No china ones, no global. Tried so many patches until this guide which worked for me.
Thanks

Converted J9110 to J8170 - VoLTE working on tmobile (US)

I got the J9110 from WondaMobile (hk) a couple weeks ago. Finally saw that the J8170's US firmware is out on Xperifirm, so I downloaded and flashed it. VoLTE works on Tmobile! Only downside is that 2nd sim isn't in the settings option, and unsure if it works. I use 1 sim + microsd card anyway.
Photos here: https://imgur.com/7LjnwCC

iArvee said:
I got the J9110 from WondaMobile (hk) a couple weeks ago. Finally saw that the J8170's US firmware is out on XDA, so I downloaded and flashed it. VoLTE works on Tmobile! Only downside is that 2nd sim isn't in the settings option, and unsure if it works. I use 1 sim + microsd card anyway.
Click to expand...
Click to collapse
Would you please share the download link of the J8170 firmware?

oh damn !!! nice ! how u flashed it
?

EmrickX51 said:
Would you please share the download link of the J8170 firmware?
Click to expand...
Click to collapse
On xda search for Xperifirm app. This can download Sony fw
avetny said:
oh damn !!! nice ! how u flashed it
?
Click to expand...
Click to collapse
On xda search for newflasher app

Thank you !!! Gonna do it tonight
---------- Post added at 11:10 AM ---------- Previous post was at 10:57 AM ----------
VeixES said:
On xda search for newflasher app
Click to expand...
Click to collapse
Friend one more question, did u flashed all frimware folder ? Or you move something out of folder ? (Im also on tmobile lmao)
Regards
Avi

avetny said:
Thank you !!! Gonna do it tonight
---------- Post added at 11:10 AM ---------- Previous post was at 10:57 AM ----------
Friend one more question, did u flashed all frimware folder ? Or you move something out of folder ? (Im also on tmobile lmao)
Regards
Avi
Click to expand...
Click to collapse
You can take userdata.sin file out. keep everything else

VeixES said:
You can take userdata.sin file out. keep everything else
Click to expand...
Click to collapse
Thank u friend!!!!

avetny said:
Thank you !!! Gonna do it tonight
---------- Post added at 11:10 AM ---------- Previous post was at 10:57 AM ----------
Friend one more question, did u flashed all frimware folder ? Or you move something out of folder ? (Im also on tmobile lmao)
Regards
Avi
Click to expand...
Click to collapse
It'd be best if you also flash the userdata.sin file. Since we're flashing a different variant, it'd be best to wipe everything clean. Taking out userdata will keep data intact.

iArvee said:
It'd be best if you also flash the userdata.sin file. Since we're flashing a different variant, it'd be best to wipe everything clean. Taking out userdata will keep data intact.
Click to expand...
Click to collapse
Oh im that kind of guy who factory reset (with full wipe/format) every time after frimware update via network lol !
Thank you I'll definitely flash data and on top I'll factory reset manually from the settings one more time lmao

damn guys hate to be a noob but im getting error in my newflasher.exe window.
--------------------------------------------------------
newflasher.exe v17 by Munjeni @ 2017/2019
--------------------------------------------------------
Determining available free space by GetDiskFreeSpaceEx:
Available space to caller = 822419 MB
Total space on current drive = 953766 MB
Free space on drive = 822419 MB
Optional step! Type 'y' and press ENTER if you need GordonGate flash driver, or
type 'n' to skip.
This creates GordonGate.7z archive in the same dir with newflasher.exe!
n
Device path: \\?\usb#vid_0fce&pid_b00b#5&29cad4f4&0&1#{a5dcbf10-6530-11d2-901f-0
0c04fb951ed}
Class Description: Android Device
Device Instance Id: USB\VID_0FCE&PID_B00B\5&29CAD4F4&0&1
Optional step! Type 'y' and press ENTER if you want dump trim area, or type 'n'
and press ENTER to skip.
Do in mind this doesn't dump drm key since sake authentifiction is need for that
!
n
ERROR: GetOverLapped_out_Result: failed with error code 1 as follows:
Incorrect function.
- Error write! Need nBytes: 0x18 but done: 0x0
nBytes[0x0]:
- Error writing command getvar:max-download-size!
End. You can disconnect your device when you close newflasher.exe
Press any key to continue . . .
1) installed drivers via Xperia Companion. (make sure they all installed everywhere)
2) downloaded J8170_Customized US_1318-8742_55.0.A.2.278_R13A
3)Placed newflasher_v17 files in to J8170_Customized US_1318-8742_55.0.A.2.278_R13A
4) Run as administrator and getting that error. (adb devices showing my phone, is mean drivers installed !)
Damn !

Guys hate to be a noob but im getting error in my newflasher.exe window.
ERROR: GetOverLapped_out_Result: failed with error code 1 as follows:
Incorrect function.
- Error write! Need nBytes: 0x18 but done: 0x0
nBytes[0x0]:
- Error writing command getvar:max-download-size!
End. You can disconnect your device when you close newflasher.exe
Press any key to continue . . .
1) installed drivers via Xperia Companion. (make sure they all installed everywhere)
2) downloaded J8170_Customized US_1318-8742_55.0.A.2.278_R13A
3)Placed newflasher_v17 files in to J8170_Customized US_1318-8742_55.0.A.2.278_R13A
4) Run as administrator and getting that error. (adb devices showing my phone too)
Any ideas gentlemens?

avetny said:
damn guys hate to be a noob but im getting error in my newflasher.exe window.
--------------------------------------------------------
newflasher.exe v17 by Munjeni @ 2017/2019
--------------------------------------------------------
Determining available free space by GetDiskFreeSpaceEx:
Available space to caller = 822419 MB
Total space on current drive = 953766 MB
Free space on drive = 822419 MB
Optional step! Type 'y' and press ENTER if you need GordonGate flash driver, or
type 'n' to skip.
This creates GordonGate.7z archive in the same dir with newflasher.exe!
n
Device path: \\?\usb#vid_0fce&pid_b00b#5&29cad4f4&0&1#{a5dcbf10-6530-11d2-901f-0
0c04fb951ed}
Class Description: Android Device
Device Instance Id: USB\VID_0FCE&PID_B00B\5&29CAD4F4&0&1
Optional step! Type 'y' and press ENTER if you want dump trim area, or type 'n'
and press ENTER to skip.
Do in mind this doesn't dump drm key since sake authentifiction is need for that
!
n
ERROR: GetOverLapped_out_Result: failed with error code 1 as follows:
Incorrect function.
- Error write! Need nBytes: 0x18 but done: 0x0
nBytes[0x0]:
- Error writing command getvar:max-download-size!
End. You can disconnect your device when you close newflasher.exe
Press any key to continue . . .
1) installed drivers via Xperia Companion. (make sure they all installed everywhere)
2) downloaded J8170_Customized US_1318-8742_55.0.A.2.278_R13A
3)Placed newflasher_v17 files in to J8170_Customized US_1318-8742_55.0.A.2.278_R13A
4) Run as administrator and getting that error. (adb devices showing my phone, is mean drivers installed !)
Damn !
Click to expand...
Click to collapse
Try using the drivers from flashtool.

iArvee said:
Try using the drivers from flashtool.
Click to expand...
Click to collapse
Oh i didn't tried that way ! Thank u

Thanks.
Flashed J8170 customized us firmware to my J8110 few minutes ago, the t-mobile volte worked.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

xzent said:
Thanks.
Flashed J8170 customized us firmware to my J8110 few minutes ago, the t-mobile volte worked.
Click to expand...
Click to collapse
Gonna drive to new York help me out to flash it ?

avetny said:
Gonna drive to new York help me out to flash it ?
Click to expand...
Click to collapse
If you need help flashing, feel free to send me a PM.

iArvee said:
If you need help flashing, feel free to send me a PM.
Click to expand...
Click to collapse
oh man, thank you very much for your kind :highfive:
---------- Post added at 12:48 PM ---------- Previous post was at 12:04 PM ----------
iArvee said:
Try using the drivers from flashtool.
Click to expand...
Click to collapse
you was right ! i switched USB ports (choose the new one) , and installed drivers from GordonGate.
it went true ! Thank you friend !

Does anyone know if J8110 and J9110 share the same hardware? Guess I'm asking if it's possible to flash J9110 firmware on J8110 to get dual sim functionality?
Sent from my J8110 using Tapatalk

lepszy said:
Does anyone know if J8110 and J9110 share the same hardware? Guess I'm asking if it's possible to flash J9110 firmware on J8110 to get dual sim functionality?
Sent from my J8110 using Tapatalk
Click to expand...
Click to collapse
They have the same hardware, except for the modem I'm guessing. You only have 1 IMEI number, so you won't be able to use the 2nd sim. You can flash the firmware, but 2nd sim most likely won't work.

May anyone confirm if Verizon is working on non-J8170 devices flashed to J8170? I got a J9110 and I'm thinking of flashing it to J8170 for Verizon support, but if it doesn't work for calls and text it will be useless : ( Thanks for any help!

Question [J706F][FIXED] Update from 10 to 11 not working after switching from ROW to ZUI

EDIT: FIXED. I flashed persist.img from version "S250260_210804..." (unzip, flash via `fastboot flash persist persist.img`) https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
Hello dear community,
I am in need of some help. So here is what I did:
* Coming from latest Android 11 ROW, flashed ZUI using QFIL from here: https://mirrors.lolinet.com/firmware/lenovo/Tab_P11_Pro/TB-J706F/
* tried upgrading to ZUI 12.5, 12.6 and 13 but didn't work
* used fastboot to unlock and unlock_critical (i know, i know...)
* used payload_dumper (from some github repo) to extract zui 13 update.zip
* flashed every image I extracted manually using fastboot (I know, I'm stupid)
* Got ZUI 12.0 working, didn't like it and wanted ROW android 11 back
* flashed latest ROW rom using QFIL from lolinet url -> bootloop
* flashed oldest ROW rom using QFIL, updated 3x via OTA to latest version -> few bootloops, then device booted back to android 10 and created notification "failed to install ota"
So I can install any version between TB-J706F_S210002_201015_ROW and TB-J706F_S250260_210804_ROW from lolinet url, but nothing above that. Neither through QFIL, nor using lenovo smart rescue assistent, nor using OTA update from android 10 (which is working fine).
I tried following things to fix this:
* ####6030# -> change to CN and change the NV value to 00
* ####6030# -> change to DE and change the NV value to 02 or 00
* flash latest ROW using QFIL, then change NV value from 02 to 00
nothing of that worked and I'm starting to believe, that I ****ed up some partitions using fastboot. Because I flashed images from ZUI android 11 and I can't install ROW android 11 now.
Could I possibly try restoring a TWRP backup from some other user?
What else could I do to install android 11?
PS: I used QFIL backup and restore tool to change the NV value. Because the nv reader/writer tool didn't seem to work.

It might help, if someone would be kind enough to provide me with the following images (by backing them up with twrp):
* abl
* xbl_a
* xbl_b

Hi there, I also got into this trouble that can't flash any global ROM including TB-J706F_S250260_210804_ROW. What I did is change the NV value to 02 and not 00 using QFIL. After that I was able to update via OTA and currently on the latest global ROM.
Thanks to this thread: https://forum.xda-developers.com/t/check-region-unlock-p11-tb-j606f-l-n.4356451/

MateUserHHTT​I have similar problem before, can not flash to Android 11, even ROW or ZUI, bootloop~
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
If not functional, I'm following below post instruction to flash presist.img, and can upgrade to Android 11, both of ROW & ZUI are available.
<TB-J706F> Auto-rotation & Auto Brightness Broken.​But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.

auston said:
But Serial Number shows 123456789ABCDEF, wifi /bluetooth MAC shows 00:00:00... still not solve even functional.
Click to expand...
Click to collapse
I may found a fix for Bluetooth MAC by generating a file for the "NV-items_reader_writer.exe" and wrote it to NV item 447 (some one sait this is BT). Problem was that this item (447) was NOT present at this time inn QCN.
WARNING! May my guess of "Items size" 128 is wrong, I don't know. Use at your own risk and change the file to your MAC.
After that I flashed "persist.img" (matching the actual ROM), some one wrote that this fixed the autorotate. I can confirm this.
But still not found solution for serial, the correct serial is still in NV item 2497.

Okay, Serial number restore can be done the same way.
See here https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/
Best would be to have the full original QCN file (or an editor for this files)

MateUserHHTT said:
* abl
* xbl_a
* xbl_b
Click to expand...
Click to collapse
abl (_a and _b) = abl.elf
xbl (_a and _b) = xbl.elf
You will find both in the ROM Zip's at lolinet.
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.

auston said:
please check your J706F screen auto rotate and auto brightness(and pair bluetooth devices) still functional?
Click to expand...
Click to collapse
Firstly, let me thank you for your reply! It's interesting, I indeed noticed just a few days ago, that auto rotation isn't working!
I will follow the guide you linked and update my post accordingly.
Edit: THANK you very much indeed! My problem was solved instantly by this!
Flashed persist.img via fastboot, flashed the latest ROM from lolinet using QFIL and had no issues whatsoever.
Oh, and you have to set region code in QCN NV 6858, somebody found out that Android 11 checks that value. If it is wrong, device boot loops.
Click to expand...
Click to collapse
as I said in my post, I did tried both 00 and 02. I read the thread about the second region code checking.

CryptMan said:
Mine updates successfully from 10 to 11 after I have restored BT, Wifi, SN, PN and region lock. And flashed persist.img.
Click to expand...
Click to collapse
I don't have any problem but just in case...
I guess PN is Product Number where did you change it and where do you get the correct value? I only found a code before the SN that looks unique per tablet but it's not in the box.

MrCrayon said:
I guess PN is Product Number where did you change it and where do you get the correct value?
Click to expand...
Click to collapse
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.

One issue persists though, which is that my widewine level is set to L3.
1. I flashed persist.img from TB-J706F_S250260_210804_ROW
2. I then installed the TB-J706F_S620150_211226_ROW via QFIL and
3. updated to TB-J706F_S630185_220128_ROW via OTA in system settings.
My serial number is also 1-9A-F. My device is locked. I'm unlocking my device and flashing the persist.img of the latest ROM. If that doesn't work, what are my options to restore L1?

CryptMan said:
Well I changed the PN in NV item 2497
I found this PN number here: https://forum.xda-developers.com/t/tab-j706f-serial-number.4318901/#post-86315607
My other device, P11 (TB-J606F), has this number: 8SSP69A6PB5XHA6213L0864
Because they look pretty same (length, etc.) I decided to try it.
May somebody would confirm if this PN are the same on all device.
Open settings and type in the search bar "####2222#". That will display PN and SN.
Click to expand...
Click to collapse
Ah ok, so the number before SN is the PN.
I have two J706F and they have different PN, The last 8-9 digits are different and the other ones are the same.
I could not find that code anywhere else.

MateUserHHTT said:
One issue persists though, which is that my widewine level is set to L3.
Click to expand...
Click to collapse
If you check in play store settings does it say your device is certified?

On my J706F, the one on which I have lost QCN with SN MAC etc. , I have the same problem as MateUserHHTT.
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
My guess it that there is a file or partition holding this certifications, but I don' t know which.
And of course I don't have a backup ...

If you check in play store settings does it say your device is certified?
Click to expand...
Click to collapse
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

CryptMan said:
The device lost L1 cert. PlayStore says NOT certified and "DRM Info" app says L3.
I also have a property "sys.lenovo.widevine_security_level" with value "L3".
Click to expand...
Click to collapse
Is your bootloader unlocked or did you unlock it previously and relocked?
MateUserHHTT said:
It says "Device is not certified"
Now that's curious: my tablet, running the latest Android 11 ROW version, is offering me to upgrade my device to Android Kitkat 4.4. Now that's an offer I can't resist (yes, of course I clicked "update". I want all the new features!)
Click to expand...
Click to collapse
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.

MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Maybe the OTA app is getting some wrong data / not set data and that's the result
I tried to decompile that app to get the address called to download updates but my knowledge of android programming is really basic and did not have enough time.
Click to expand...
Click to collapse
I previousl, unlocked and afterwards relocked it (both flashing lock and flashing lock_critical)
Yes, I once said "erase all before download" and accidentally deleted my original qcn file so some NV fields seem to be missing. Maybe that caused the app to default back to 4.4 it was Lenovo Feature Updater by the way, not the settings - system - update.
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/

MateUserHHTT said:
It was Lenovo Feature Updater by the way, not the settings - system - update.
Click to expand...
Click to collapse
I disabled that as soon as I saw it
MateUserHHTT said:
If you share your past work in a git repo I will take a look at it. I'm no expert for sure but I'm developing fir android for some years and have stuck my nose a tiny bit under the surface of android rom development (1mm and it was very painful still).
Click to expand...
Click to collapse
Not much really, I'm not at my desk now but I extracted LenovoOTA from stock ROM and decompiled it with apktools, but even with online tools is probably ok.
Then I see two options:
Recompile that package changing package name and adding a log with full address and parameters or get the code that construct the URL and put it in a new app.
For you probably the last one is easier.
I went for a third I was trying to understand if i could get the data with adb or in files but I did not find documentation.
MateUserHHTT said:
My widewine lvl is L3. Any chance of resetting to L1 myself? I don't know much about how trust attestation works. :/
Click to expand...
Click to collapse
I don't think there is a way to force it, this widevine a thing is a pain.

MrCrayon said:
Is your bootloader unlocked or did you unlock it previously and relocked?
Click to expand...
Click to collapse
Locked, and was never unlocked before.
I tried to unlock now, but does not succeed with flashing sn.img.
Because I'm not interested on Custum ROM, I will leave it locked.
Do you know where the device certification is stored?

I unlocked without flashing sn.img. Does that make a difference?
Did you try monitoring the network traffic with wireshark?