Database Info

How do we flash just the baseband?

I haven't seen any releases of baesband packages.

There is no current method to flash just the baseband that I know of. Assuming you want the newest KK1, the method you can use is to flash back to stock, do the official OTA update from AT&T, and then flash the rom you want and the KK1 modem will remain.
This should work with all of the roms listed here--none of them have the modem packaged in it that I know of (and I think I've tried them all...)

Actually, there is Tested and working fine! I have meant to release a CWM updater for this method (it's sitting on my linux partition - but it needs more widespread testing.)
Here is the manual method:
grab the odin.tar containing radio you want
grab amss.bin and mdm.bin from it
adb push them to your /sdcard/
boot into CWM
use the menu to mount /emmc
connect in adb shell
type the following:
dd if=/dev/block/mmcblk0p13 of=/emmc/mmcblk0p13.bin
dd if=/dev/block/mmcblk0p17 of=/emmc/mmcblk0p17.bin
(this gives you a backup of your /system/etc/firmware/misc and /system/etc/firmware/misc_mdm which constitute the modem)
dd if=/emmc/amss.bin of=/dev/block/mmcblk0p13
dd if=/emmc/mdm.bin of=/dev/block/mmcblk0p17
(done, you are now on the new modem firmware)
as a sanity check you can attempt to mount the partition to verify it flashed correctly, unmount and dd your backup if it did not)

PM me a link and I'll test it for you.

Da_G said:
Actually, there is Tested and working fine! I have meant to release a CWM updater for this method (it's sitting on my linux partition - but it needs more widespread testing.)
Here is the manual method:
grab the odin.tar containing radio you want
grab amss.bin and mdm.bin from it
adb push them to your /sdcard/
boot into CWM
use the menu to mount /emmc
connect in adb shell
type the following:
dd if=/dev/block/mmcblk0p13 of=/emmc/mmcblk0p13.bin
dd if=/dev/block/mmcblk0p17 of=/emmc/mmcblk0p17.bin
(this gives you a backup of your /system/etc/firmware/misc and /system/etc/firmware/misc_mdm which constitute the modem)
dd if=/emmc/amss.bin of=/dev/block/mmcblk0p13
dd if=/emmc/mdm.bin of=/dev/block/mmcblk0p17
(done, you are now on the new modem firmware)
as a sanity check you can attempt to mount the partition to verify it flashed correctly, unmount and dd your backup if it did not)
Click to expand...
Click to collapse
Cool...Sorry to be naive here, what if you have a CWM zip, how do you extract the mdm.bin and amss.bin? If someone can post the KK1 equivalent of those two (if they are on 2.3.6), I can probably create a CWM package using above instructions.

[HOWTO] Unlocking i9505G bootloader

This will Wipe every thing on the internal storage SO BACKUP your stuff on the SD card and maybe the onto computer too
This is for the Google edition of the Galaxy S4
Go To setting / about phone /
Tap "Build Number" 7 times
Go back to Main Settings Menu and under now shown "Developer Options" enable "USB debugging"
Download this
http://developer.android.com/sdk/index.html#download
extract to the C drive in the folder adb (you can move it anywhere just adjust the path)
run "SDK Manager.exe"
in the extras select "Google USB Drivers"
click "Install 1 package" and accept license / Install
now go into the device manager on you PC and change the "Samsung ADB driver" to the
"Android Composite ADB Interface" located in this folder
C:\adb\sdk\extras\google\usb_driver
you will have to force that driver to install by selecting it
let it finish installing the drivers
then
unplug and then plug in the USB on the phone
your phone will ask you about "Allow USB debugging?"
check the box "always allow from this computer"
click OK on your phone
If this doesn't work the some thing is wrong with the drivers and reinstall the drivers make sure you select "Android Composite ADB Interface" and not "Android ADB Interface"
Now open up a command prompt (I did this as "run as administrator")
type "cd C:\adb\sdk\platform-tools" (or what ever the directory you extract your files)
enter this command
adb reboot bootloader <enter>
Once in bootloader,
In the command prompt type:
fastboot oem unlock <enter>
It will ask you to unlock you phone and this may void you warranty
Use the volume buttons to change to yes and the power button as enter
At this point everything gets wiped on your phone
The phone rebooted back into bootloader and it now said "bootloader=unlocked" and the bottom left of the screen
Reboot the phone and the unlock icon will appear on the 1st Google screen.
the phone will boot into android like it was new
I have not done any ODIN on my phone so i don't know how this affect it
I am trying to avoid ODIN and get the phone rooted and have a custom recovery on it.
I just did this on my phone and typed this up i think everything is accurate let me know if i need to adjust anything.
fyi the command "fastboot flash recovery recovery.img" don't work because the system is still secure boot enable.

Thanks and Questions
Thanks. Could you please tell where you found this info?
Also, I'm not that experienced and don't understand why this is necessary. Don't our GT-i9505G phones come with unlocked boot loader?

bsam55 said:
Thanks. Could you please tell where you found this info?
Also, I'm not that experienced and don't understand why this is necessary. Don't our GT-i9505G phones come with unlocked boot loader?
Click to expand...
Click to collapse
It still needs to perform fastboot oem unlock just like nexus device does
Sent using GT-i9505~

This is what i did on my galaxy nexus device (nexus 3) and my friend nexus one
I made this from my notes of the old devices
my experience is that i could mess up my phone and lock me out of it it, so i wanted to be sure i could fix it, that is why i did this
I did not try to use fastboot beforehand, so it could work.
but i have a feeling that the ODIN flash changed the bootloader (probably not)
but i have been screwed buy a odin flash messing with the bootloader on the vibrant( but for some reason there looked to be 3 bootloader on that device)
if some one want to try it
just put the ClockworkMod 6.0.3.3 recovery file the
C:\adb\sdk\platform-tools
adb reboot bootloader
fastboot boot recovery.img
this dose take 1 minute after the file is sent to reboot and load
I have tried TWRP but it don't load past the first screen.
This just boots into the file and doesn't change anything
access to the sd cards don't work
I am tempted to flash ClockworkMod but i would like to pull a copy of the recovery first.
BTW after paying $700 for a phone i want to be sure to be able to reinstall the OS, like on a PC.

warwolfx0 said:
This is what i did on my galaxy nexus device (nexus 3) and my friend nexus one
I made this from my notes of the old devices
my experience is that i could mess up my phone and lock me out of it it, so i wanted to be sure i could fix it, that is why i did this
I did not try to use fastboot beforehand, so it could work.
but i have a feeling that the ODIN flash changed the bootloader (probably not)
but i have been screwed buy a odin flash messing with the bootloader on the vibrant( but for some reason there looked to be 3 bootloader on that device)
if some one want to try it
just put the ClockworkMod 6.0.3.3 recovery file the
C:\adb\sdk\platform-tools
adb reboot bootloader
fastboot boot recovery.img
this dose take 1 minute after the file is sent to reboot and load
I have tried TWRP but it don't load past the first screen.
This just boots into the file and doesn't change anything
access to the sd cards don't work
I am tempted to flash ClockworkMod but i would like to pull a copy of the recovery first.
BTW after paying $700 for a phone i want to be sure to be able to reinstall the OS, like on a PC.
Click to expand...
Click to collapse
Maybe you can do a full dump for the community.

before you install custom recovery, I'd like to ask if you could do complete system dump of your device, including stock recovery (recovery.img), stock bootloader (boot.img) and system.img . It would be a big help to the community. You can do it simple after rooting with for example Motochopper exploit (described here http://whatswithtech.com/how-to-root-samsung-galaxy-s4/ )
Then something like this:
Code:
for gaining root access type: su
then:
copy BOOT -> dd if=/dev/block/mmcblk0p20 of=/sdcard/boot.img bs=4096
copy HIDDEN -> dd if=/dev/block/mmcblk0p27 of=/sdcard/hidden.img bs=4096
copy PARAM -> dd if=/dev/block/mmcblk0p19 of=/sdcard/param.bin bs=4096
copy RECOVERY -> dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096
copy SYSTEM -> dd if=/dev/block/mmcblk0p16 of=/sdcard/system.img bs=4096
Thanks a lot!

System Dump
Plus One on the system dump. There are a lot of knowledgeable people waiting to help as soon as they have this. I don't know enough to do it and did try CWM (which doesn't work, by the way.)
Hope you are able to help. Thanks

bmbm said:
before you install custom recovery, I'd like to ask if you could do complete system dump of your device, including stock recovery (recovery.img), stock bootloader (boot.img) and system.img . It would be a big help to the community. You can do it simple after rooting with for example Motochopper exploit (described here http://whatswithtech.com/how-to-root-samsung-galaxy-s4/ )
Then something like this:
Code:
for gaining root access type: su
then:
copy BOOT -> dd if=/dev/block/mmcblk0p20 of=/sdcard/boot.img bs=4096
copy HIDDEN -> dd if=/dev/block/mmcblk0p27 of=/sdcard/hidden.img bs=4096
copy PARAM -> dd if=/dev/block/mmcblk0p19 of=/sdcard/param.bin bs=4096
copy RECOVERY -> dd if=/dev/block/mmcblk0p21 of=/sdcard/recovery.img bs=4096
copy SYSTEM -> dd if=/dev/block/mmcblk0p16 of=/sdcard/system.img bs=4096
Thanks a lot!
Click to expand...
Click to collapse
cool thank i was looking for that info
Just i couldn't get su to work in adb
I have been able to get Supersu (also tried superuser) on the phone but it complains about the su binaries (busybox in superuser) not being installed i have tried to install it using the market app (which said i am rooted) but i get no popup on the system.
i might try a wipe to see if that fixed it. (i did flash root to the system so it should still be there after a wipe)
first root, then system dump
unless someone knows how to do a system dump without root? or temp root solution.
I will look into the motochopper later today

you don't need "su" to work in adb shell, if you run "adb root" and "adb remount" with a modified adbd binary (inside CWM for example) you will have root access.
pls try out this root zip I just made, maybe it will work

warwolfx0 said:
QUOTE]
DELETed
Click to expand...
Click to collapse

I have root
Thanks broodplank1337
download the root that "broodplank1337" made
and put it in "C:\adb\sdk\platform-tools" (this is my adb.exe folder)
Download ClockworkMod 6.0.3.3 NORMAL from below
http://forum.xda-developers.com/showthread.php?t=2359132&highlight=recovery
aka Miustone_CWM_flash-NORMAL.zip
extract the recovery.img to the folder "C:\adb\sdk\platform-tools"
Now open up a command prompt (I did this as "run as administrator")
type "cd C:\adb\sdk\platform-tools" (or what ever the directory you extract your files)
enter this command
adb reboot bootloader <enter>
Once in bootloader,
In the command prompt type:
fastboot boot recovery.img (this takes 1min to load after the file is sent)
This will boot into ClockworkMod
goto "install zip"
goto "install zip from sideload"
in the cmd type
adb sideload root.zip
This sends to the phone and write to the phones Rom.
Now reboot and we have root without ODIN on a I9505G
BTW my file was missing busybox in the xbin i was playing around with "CWM-SuperSU.zip" as a base
It is kind of late so i may have missed some things in this write up.
Now off to the system dump.
I will repost this later as a new post to keep this clean.

ok i had some issues with viewing the files on the phone
i moved them to the sdcard and then pulled them off the card on my pc using a "sd to usb"
dd if=/dev/block/mmcblk0p20 of=/storage/extSdCard/dump/boot.img bs=4096
dd if=/dev/block/mmcblk0p27 of=/storage/extSdCard/dump/hidden.img bs=4096
dd if=/dev/block/mmcblk0p19 of=/storage/extSdCard/dump/param.bin bs=4096
dd if=/dev/block/mmcblk0p21 of=/storage/extSdCard/dump/recovery.img bs=4096
dd if=/dev/block/mmcblk0p16 of=/storage/extSdCard/dump/system.img bs=4096
Is there any other mmcblk0p i should backup
and is there any issues with posting this info on this forum
so far this only has root
i did notice that clockworkmod did give me access to root but i couldn't find the sd card while fastbooting it.
I don't think that the whole bootloader is part of what i backup, I thought there was a sbl.bin that i need too.

warwolfx0 said:
ok i had some issues with viewing the files on the phone
i moved them to the sdcard and then pulled them off the card on my pc using a "sd to usb"
dd if=/dev/block/mmcblk0p20 of=/storage/extSdCard/dump/boot.img bs=4096
dd if=/dev/block/mmcblk0p27 of=/storage/extSdCard/dump/hidden.img bs=4096
dd if=/dev/block/mmcblk0p19 of=/storage/extSdCard/dump/param.bin bs=4096
dd if=/dev/block/mmcblk0p21 of=/storage/extSdCard/dump/recovery.img bs=4096
dd if=/dev/block/mmcblk0p16 of=/storage/extSdCard/dump/system.img bs=4096
Is there any other mmcblk0p i should backup
and is there any issues with posting this info on this forum
so far this only has root
i did notice that clockworkmod did give me access to root but i couldn't find the sd card while fastbooting it.
I don't think that the whole bootloader is part of what i backup, I thought there was a sbl.bin that i need too.
Click to expand...
Click to collapse
can you please upload your system dump , thank you mate

warwolfx0 said:
Thanks broodplank1337
download the root that "broodplank1337" made
and put it in "C:\adb\sdk\platform-tools" (this is my adb.exe folder)
Download ClockworkMod 6.0.3.3 NORMAL from below
http://forum.xda-developers.com/showthread.php?t=2359132&highlight=recovery
aka Miustone_CWM_flash-NORMAL.zip
extract the recovery.img to the folder "C:\adb\sdk\platform-tools"
Now open up a command prompt (I did this as "run as administrator")
type "cd C:\adb\sdk\platform-tools" (or what ever the directory you extract your files)
enter this command
adb reboot bootloader <enter>
Once in bootloader,
In the command prompt type:
fastboot boot recovery.img (this takes 1min to load after the file is sent)
This will boot into ClockworkMod
goto "install zip"
goto "install zip from sideload"
in the cmd type
adb sideload root.zip
This sends to the phone and write to the phones Rom.
Now reboot and we have root without ODIN on a I9505G
BTW my file was missing busybox in the xbin i was playing around with "CWM-SuperSU.zip" as a base
It is kind of late so i may have missed some things in this write up.
Now off to the system dump.
I will repost this later as a new post to keep this clean.
Click to expand...
Click to collapse
I maybe wrong in this, but I have played with fastboot on my ex HTC device. the proper command to flash recovery is
Code:
fastboot flash recovery recovery.img
the proper command to flash kernel is
Code:
fastboot flash boot boot.img
with
Code:
fastboot boot recovery.img
, the recovery isn't permanent. it will be only be there for the current session. after rebooting, the stock recovery will overwrite the custom recovery. the same goes to kernel.
Sent from my GT-I9505 using Tapatalk 2

warwolfx0 said:
ok i had some issues with viewing the files on the phone
i moved them to the sdcard and then pulled them off the card on my pc using a "sd to usb"
dd if=/dev/block/mmcblk0p20 of=/storage/extSdCard/dump/boot.img bs=4096
dd if=/dev/block/mmcblk0p27 of=/storage/extSdCard/dump/hidden.img bs=4096
dd if=/dev/block/mmcblk0p19 of=/storage/extSdCard/dump/param.bin bs=4096
dd if=/dev/block/mmcblk0p21 of=/storage/extSdCard/dump/recovery.img bs=4096
dd if=/dev/block/mmcblk0p16 of=/storage/extSdCard/dump/system.img bs=4096
Is there any other mmcblk0p i should backup
and is there any issues with posting this info on this forum
so far this only has root
i did notice that clockworkmod did give me access to root but i couldn't find the sd card while fastbooting it.
I don't think that the whole bootloader is part of what i backup, I thought there was a sbl.bin that i need too.
Click to expand...
Click to collapse
NONE of this would pull anything of relation from the I9505G (except System - mmcblk0p16) as our partitions layout is completely different. And more so, it would softbrick your 9505 if you tried flashing.
Check out here - http://forum.xda-developers.com/showthread.php?t=2360346 - for a system dump from the i9505G. It has SYSTEM/BOOT/RECOVERY. Param and Hidden are both empty on our phones. This has already been used a couple times to cook roms for other S4 devices.

donovanbrock said:
NONE of this would pull anything of relation from the I9505G (except System - mmcblk0p16) as our partitions layout is completely different. And more so, it would softbrick your 9505 if you tried flashing.
Check out here - http://forum.xda-developers.com/showthread.php?t=2360346 - for a system dump from the i9505G. It has SYSTEM/BOOT/RECOVERY. Param and Hidden are both empty on our phones. This has already been used a couple times to cook roms for other S4 devices.
Click to expand...
Click to collapse
Since my backup might mess people up i am not going to post it.
but as a backup i will make a full backup of all the mmcblk0pxx file
dd if=/dev/block/mmcblk0pxx of=/storage/extSdCard/dump/mmcblk0pxx.img bs=4096
i think there is like 20 files

Those with a real I9505G google edition samsung, do u have an option in settings to always have the lightkeys light up when screen is on? The menu and the back key, that light up.

hmmm followed step bye step but phones boot loader is still locked
i do have Super User access tho
edit: fail on my part. everything worked smoothly! thanks man!

Hello. Please help me. Can I flash stock ROM GT-I9005 on my Google Edition phone GT-I9005G? Thank for answer

SnegovikRZN said:
Hello. Please help me. Can I flash stock ROM GT-I9005 on my Google Edition phone GT-I9005G? Thank for answer
Click to expand...
Click to collapse
no

Any one with a fully rooted nxt-al10 or l29??? need modemnvm_backup/modemnvm_factory

Hi, as many other people i have unbricked my mate using Dc-phoenix and lost nerwork
is missing modemnvm_backup/modemnvm_factory/modemnvm_system partition in the flash, dc phoenix erase them but not reflashed them after. If any one with working al10 or l29 can extract them and upload this img,
If any one can give this three partition pls help
Thank you
i can not find working phone to get file

Here is a Trwp Modem Backup from L29
Extract and copy in Twrp Folder Backups
You can test,but i dont know if it works

thank you but my problem is this file is missing
modemnvm_backup
modemnvm_factory
modemnvm_system
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_factory of=/external_sd/backup/modemnvm_factory.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_backup of=/external_sd/backup/modemnvm_backup.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_img of=/external_sd/backup/modemnvm_img.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_system of=/external_sd/backup/modemnvm_system.img
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodemnvm of=/external_sd/backup/3rdmodemnvm.img
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodemnvmbkp of=/external_sd/backup/3rdmodemnvmbkp.im
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodem of=/external_sd/backup/3rdmodem.img
its defiant bro

elsokary said:
thank you but my problem is this file is missing
modemnvm_backup
modemnvm_factory
modemnvm_system
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_factory of=/external_sd/backup/modemnvm_factory.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_backup of=/external_sd/backup/modemnvm_backup.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_img of=/external_sd/backup/modemnvm_img.img
dd if=/dev/block/platform/hi_mci.0/by-name/modemnvm_system of=/external_sd/backup/modemnvm_system.img
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodemnvm of=/external_sd/backup/3rdmodemnvm.img
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodemnvmbkp of=/external_sd/backup/3rdmodemnvmbkp.im
dd if=/dev/block/platform/hi_mci.0/by-name/3rdmodem of=/external_sd/backup/3rdmodem.img
its defiant bro
Click to expand...
Click to collapse
This Modemfiles are from my L29,i Backup it with Partition Backup&Restore from Playstore
Working the Phone?
If yes Download the Files from Attachment
Extract the Partitions Backup.zip and copy the Folder Named "PartitionsBackups" in your external or internal Memory
install the apk file and open it
On the 3 Dot Menu Restore the Modem Files
i hope this works for you
Looking the Screenshots in Attachment to Help for the right Partition (mmcblk0p35/14/15/10/6/and 12)

thank you pro
i will try and tell you

Hero
You are my hero!
You saved my day! my week! my month!

[HOW-TO] Recover Bricked U11+

Greetings all.
Several weeks ago, I made this post seeking help with a self-created problem. I am happy to announce that the problem has been resolved with the immense help of sephstyler. He is literally my phone's messiah.
The afore-mentioned XDA member has a device identical to mine. I borrowed his and mirrored most of the data on his device by copying several partitions off his phone on to mine. I followed this guide about changing CID/MID.
I got a hold of a notepad document (you'll find it here) that lists partition information of the U11+. I wasn't sure which of my partitions were corrupt but I was certain the one containing the OS and IMEI information were messed up. My IMEI was blank. The OS version reported in fastboot was 9.99999 or something like that.
So I set out to copy these partitions and their corresponding img files in no particular order - boot, hosd, radio, modemst1, modemst2, cache, system, vendor, persist, and sdf1 (which carries CID info).
Please note that this method fixes the issue where your device is stuck on the bootloader screen with the message, "this phone has been flashed with unauthorised software and is locked....." And you will need a second device that is identical to yours (and functional too) for this process to work. I don't know if they both have to come from the same region (i.e have the same CID and MID). I guess there is no harm in trying. You couldn't possibly do more harm to your device by doing this. Or maybe you could. Either way, I will not be held responsible for any undesirable outcomes.
Steps taken:
- I installed HTC drivers on my computer, running Windows 10 64-bit. And 15-second ADB Installer. Get them both from here and here. I uninstalled HTC Sync Manager after the installation was done as I only needed the drivers.
- I flashed TWRP on the borrowed device so I could have access to adb from recovery.
- I then opened up a command prompt window on my computer, typed adb devices just to be sure that drivers were installed correctly.
The next few steps can be achieved right from within TWRP using the Terminal function. But I chose to use my computer as it'd be much quicker and I am less likely to make typos on a full-sized keyboard.
In a command prompt window, type adb shell. Hit enter.
To copy the system image, type dd if=/dev/block/sda5 of=/sdcard/system.img
For cache, type dd if=/dev/block/sdd21 of=/sdcard/cache.img
For boot, type dd if=/dev/block/sda3 of=/sdcard/boot.img
For radio, type dd if=/dev/block/sdd13 of=/sdcard/radio.img
For modemst1, type dd if=/dev/block/sde2 of=/sdcard/modemst1.img
For modemst2, type dd if=/dev/block/sde3 of=/sdcard/modemst2.img
For persist, type dd if=/dev/block/sde5 of=/sdcard/persist.img
For vendor, type dd if=/dev/block/sda6 of=/sdcard/vendor.img
For sdf1 (board_info), type dd if=/dev/block/sdf1 of=/sdcard/sdf1.img
For hosd, type dd if=/dev/block/sdd12 of=/sdcard/hosd.img
These img files would be saved to your internal storage. I then copied all files to the root folder of my faulty device's storage using Windows Explorer. System.img however refused to transfer. I got creative and used a microSD to make the transfer possible.
Now that these files were sitting comfortably on my phone, I booted to TWRP, connected it to my PC, then entered the following commands in Command Prompt via adb shell.
To copy these images to the appropriate partitions on your phone:
For board_info, type dd if=/sdcard/sdf1.img of=/dev/block/sdf1
For system, type dd if=/sdcard/system.img of=/dev/block/sda5
For cache, type dd if=/sdcard/cache.img of=/dev/block/sdd21
For boot, type dd if=/sdcard/boot.img of=/dev/block/sda3
For radio, type dd if=/sdcard/radio.img of=/dev/block/sdd13
For modemst1, type dd if=/sdcard/modemst1.img of=/dev/block/sde2
For modemst2, type dd if=/sdcard/modemst2.img of=/dev/block/sde3
For persist, type dd if=/sdcard/persist.img of=/dev/block/sde5
For vendor, type dd if=/sdcard/vendor.img of=/dev/block/sda6
For hosd, type dd if=/sdcard/hosd.img of=/dev/block/sdd12
Upon completion, press Ctrl+C or type exit to quit adb shell. Then type adb reboot to reboot your device.
If the above commands were entered correctly (and if the adb gods smile upon you), your device should be restored.
Now I know that copying all images fixed the issue. My guess is the system, boot, and radio images were the crucial ones. I am not entirely sure. But I was desperate for a positive result so I copied the ones that I deemed important.
I hope this helps someone. Cheers.
P.S: My apologies for the formatting. I am still fairly new to this. Also, I just realised I could upload these images for anyone who doesn't have access to a second device. I shall update the post with download links after the upload's completed. Sorry about the brain fart.
[EDIT] Images are up. You can find them here. These files are for the Taiwan-based HTC U11+ (CID - HTC_621)

Nice tutorial.

Hi, I'm having a similar problem with my U11+.... followed ur download link but a decryption key is needed. whats the decryption key?

ChuDust said:
Hi, I'm having a similar problem with my U11+.... followed ur download link but a decryption key is needed. whats the decryption key?
Click to expand...
Click to collapse
Here's the key. I had no idea the files were encrypted to begin with. Sorry about that.
-b087zdU9re0k3e3HHah1w
P.S: Since you're downloading the image files from the link provided, you don't have to go through the first half of the process - copying data from a working phone to an external location.
Best of luck.

Hello. I have an identical situation. My original CID is 622. I changed the CID to 001, but after RUU firmware I could not boot into the system. Now after flash RUU, the phone will reboot into the bootloader. Can anyone help me?

Do you have to be rooted or with unlocked bootloader to be able to backup the phone partitions using this method ?
Or does it just work on completely stock from an db connection to PC ?
Thank you.

The bootloader needs to be unlocked at the very least so you can gain access to the required partitions. Root isn't necessary.
Hope this helps.

Hello, I followed your instructions and made backups of my partitions from HTC U11+ dual-sim european version 401.12.
With unlocked bootloader and rooted with magisk by patched boot image.
Ran adb shell and su while phone was running normally in Android OS and connected to PC.
I'm curious about the sizes of the images created because they don't match with the sizes from partitions.txt.
For example "4210688 sda5 - system" is actually 4,311,744,512 bytes,
"65536 sda3 - boot" is actually 67,108,864 bytes in created image, but the actual boot.img from the OTA file is 38,163,762 bytes.
If these sizes are different can I actually trust the created images ? and use them in need.
Can these created images be flashed by fastboot, for example for system.img: "fastboot flash -S 1G system system.img" ?
Thanks.

andreipaval said:
I'm curious about the sizes of the images created because they don't match with the sizes from partitions.txt.
For example "4210688 sda5 - system" is actually 4,311,744,512 bytes,
"65536 sda3 - boot" is actually 67,108,864 bytes in created image, but the actual boot.img from the OTA file is 38,163,762 bytes.
Thanks.
Click to expand...
Click to collapse
If you divide the 4,311,744,512 bytes by the 1024, you get what you need - 4210688 - this is in Kb.
And so same for boot - 67,108,864 bytes / 1024 = 65536 Kb.

andreipaval said:
Hello, I followed your instructions and made backups of my partitions from HTC U11+ dual-sim european version 401.12.
With unlocked bootloader and rooted with magisk by patched boot image.
Ran adb shell and su while phone was running normally in Android OS and connected to PC.
I'm curious about the sizes of the images created because they don't match with the sizes from partitions.txt.
For example "4210688 sda5 - system" is actually 4,311,744,512 bytes,
"65536 sda3 - boot" is actually 67,108,864 bytes in created image, but the actual boot.img from the OTA file is 38,163,762 bytes.
If these sizes are different can I actually trust the created images ? and use them in need.
Can these created images be flashed by fastboot, for example for system.img: "fastboot flash -S 1G system system.img" ?
Thanks.
Click to expand...
Click to collapse
Hi. I hope your first question was answered. Regarding your second concern, I'm afraid I don't have an answer to that. At the time, flashing any image files onto my device didn't fix the issue even though each flash completed successfully. Copying them manually sure did.
Hope this helps.

Do you have the twrp backup of the stock rom?
andreipaval said:
Hello, I followed your instructions and made backups of my partitions from HTC U11+ dual-sim european version 401.12.
With unlocked bootloader and rooted with magisk by patched boot image.
Ran adb shell and su while phone was running normally in Android OS and connected to PC.
I'm curious about the sizes of the images created because they don't match with the sizes from partitions.txt.
For example "4210688 sda5 - system" is actually 4,311,744,512 bytes,
"65536 sda3 - boot" is actually 67,108,864 bytes in created image, but the actual boot.img from the OTA file is 38,163,762 bytes.
If these sizes are different can I actually trust the created images ? and use them in need.
Can these created images be flashed by fastboot, for example for system.img: "fastboot flash -S 1G system system.img" ?
Thanks.
Click to expand...
Click to collapse
Hello,
do you have the twrp backup of stock rom?

I did not make backups with twrp.

[SOLVED] Help to mount userdata in linux or repair userdata.img

After an Update of Two magisk modules, my Ulefone Armor 11 5G staied stucked on boot logo, I can only enter in recovery or fastboot.
I try to build a TWRP, but it is not able to mount userdata.
I was able to download with the help of mtkclient all the partition on my phone, even userdata , it took 7 hours.
I wanted to load the image in linux but using mount disk imag or using the command sudo mount -o loop userdata.img ~/Armor_11_5G doesn't do anything not even an error message.
I'm wondering if the filesystem was corrupted during the update.
Is it possible to repair the fylesystem like in Windows?
Thanks

did you previously disable encryption and factory reset long time before the modules updates failed?
what do you mean mount doesn't do anything not even an error message? either it give error message or it succeed.

I didn't disable encryption before updating the modules, I already updated this modules many times.
what do you mean mount doesn't do anything not even an error message? either it give error message or it succeed.
Click to expand...
Click to collapse
That is the problem, it doesn't succed and I don't have an error message. The file is 256 Gbyte big, I don't know if it plays a role. I'm using Ubuntu 22

if phone is encrypted that's just 256G garbage. post the output of
Code:
$ parted <file> unit B print

Here are the results of parted
Code:
Error: /home/*****/Public/userdata.bin.img: unrecognised disk label
Model: (file)
Disk /home/osboxes/Public/userdata.bin.img: 249208733696B
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags:
Thanks

You may try https://www.cgsecurity.org/wiki/TestDisk_Download
I'd be glad for your feedback.

sorry thought it's whole disk, but it's only 232G file therefore parted won't print partition table
does apply to FDE only
assuming this file is dump of single userdata partition, open with HxD editor. if the partition image is not encrypted, you will see lot zeros within first 1024 bytes.
in that case you can check for file system type is ext4 or f2fs.
Code:
$ xxd -l 1080 dump.img | grep 53ef
$ xxd -l 1024 dump.img | grep 1020.f5f2
But most likely the userdata partition is encrypted, therefore no way to recover data offline.
The easiest way not to load Magisk modules is, not to load Magisk. Flashing stock boot.img will solve it.
Beware, in case you disabled encryption beforehand, booting stock boot.img will force encryption. This may take long time without notice.

I never disabled encryption, I don't know if Magisk do it without informing. I used this phone for an year without a problem.
After the update I left the phone on for one night but nothing happens. I tried to reflash the stock boot image, and again a whole night wait, but again nothing happens.
Reading the fstab the file system should be ext4.
The file is the dump of the whole userdata partition of my Ulefone Armor 11 5G.
I did a backup of the whole system before doing any experiment so if the partition table is corrupted maybe if I reflash back the userdata partition with a working partition table I have again access to the datas.

there is no partition table in userdata partition, I just gave you wrong advise. because the phones total storage is 256G, I made wrong assumptions (you can view partition table from file pgpt.bin)
full 1:1 backup is impossible for FBE encryption because encryption keys are stored in TEE. once you factory reset device backup of userdata + metadata becomes useless.
fstab doesn't tell you what file you just have dumped. if you can't find ext4 super magic (#7) it's impossible to loop mount that file (and impossible to decrypt on linux PC)
if you can't fix boot-loop by stock boot.img then it's unrelated to magisk modules. you can however enable adb in default.prop and capture adb logcat during boot-loop for further analysis. you could also inject own script that deletes some files (only DE encrypted files, CE encrypted files requires lock screen credentials aka pin/pattern)

boot this TWRP and get log from adb
Code:
$ fastboot boot recovery.img
$ adb shell twrp decrypt '1234'
$ adb pull /tmp/recovery.log
https://twrp.me/faq/openrecoveryscript.html

full 1:1 backup is impossible for FBE encryption because encryption keys are stored in TEE. once you factory reset device backup of userdata + metadata becomes useless.
Click to expand...
Click to collapse
With mtk client I was able to do the backup of tee1 and tee2 and also of gpt_backup and gpt_main.
$ xxd -l 1080 dump.img | grep 53ef
$ xxd -l 1024 dump.img | grep 1020.f5f2
Click to expand...
Click to collapse
Doesn't produce any results.
I have immediately the command prompt.
you can however enable adb in default.prop
Click to expand...
Click to collapse
How can I do that? Which value should I change in default.prop?

so your "backup" is encrypted. please note Trustonic Kinibi is TEE OS running in secure memory one can't access or backup with mtkclient. the tee partitions in phone storage do not contain any encryption key (none of the partitions does, secure memory is not even a partition). the only crypto related partition is metadata used for keydirectory of metadata encryption (on top of FBE encryption) but it is useless for backup purposes.
yes you can modify default.prop in boot.img, ro.secure=0 should give root access.
https://forum.xda-developers.com/t/...hone-with-broken-screen.2965462/post-85905033
Code:
ro.secure=0
ro.debuggable=1
persist.service.adb.enable=1
in case the default.prop modification is not sufficient, you need additional command to be executed as root.
Code:
# settings put global adb_enabled 1
as you installed magisk, you could use magisk overlay.d/sbin/ for running startup script.
https://forum.xda-developers.com/t/...ithout-losing-your-data.4383255/post-86934375
aIecxs said:
boot this TWRP and get log from adb
Code:
$ fastboot boot recovery.img
$ adb shell twrp decrypt '1234'
$ adb pull /tmp/recovery.log
https://twrp.me/faq/openrecoveryscript.html
Click to expand...
Click to collapse
How about this TWRP? it should be able to decrypt userdata. if decryption failed, provide recovery.log

Until tomorrow I cannot do a logcat and I cannot find my view logcat on my laptop.
I unpacked boot.img with Carliv Image Kitchen and there is no default.prop, that is present in the recovery as prop.default.
Is there a way to backup secure memory of Trustonic?
How about this TWRP? it should be able to decrypt userdata. if decryption failed, provide recovery.log
Click to expand...
Click to collapse
I already tried that version but it cannot decrypt, that' why I'm trying to build my own version of TWRp with the help of the creator of that version of TWRP, but I'm stucked.

oh, you know how to build TWRP with proper FBE + metadata encryption support? have a look at other Oppo devices how they did... good luck.
regarding default.prop in boot.img (it's a symlink to system unfortunately) you can do it the other way
use magisk overlay.d/sbin/
create a boot script that does the thing with resetprop -n <prop_name> <prop_value>
don't use outdated Carliv Image Kitchen! use osm0sis AIK from link above.

oh, you know how to build TWRP with proper FBE + metadata encryption support? have a look at other Oppo devices how they did... good luck.
Click to expand...
Click to collapse
I'm learning.
I try to integrate the decryption service following the suggestion of ADeadTrouser on Github, but the service doesn't want to start and I don't understand why.
I never checked Oppo, I will take a look at them also, thanks for the suggestion.

I think I figured out now the adb logcat at least. hope that helps
https://forum.xda-developers.com/t/accessing-my-phone-with-a-dead-screen.4542763/post-88016019

I tried your script butr nothing happens, the telephone is not listed when I type
Code:
adb devices
and if I type
Code:
adb logcat
I receive the message waiting for device

you might follow the thread

wenyendev said:
You may try https://www.cgsecurity.org/wiki/TestDisk_Download
I'd be glad for your feedback.
Click to expand...
Click to collapse
I run the software on the image and it identify the contents and can read the encrypted and not encrypted part, that means that all the files are there, but I cannot mount in Linux or in TWRP

The fact that I cannot mount in Linux or TWRP the userdata image/partition can be that is corrupted the partition or the file index?
That would also explain why the script for Magisk provided by aIecxs is not able to copy the adb_key from the cache in the data partition.