# New way to backup IMEI 8/25/12



## Hobart (Dec 27, 2011)

I saw this over on xda and didn't see it posted yet here. This is not my work obviously...Big thanks to the Developers of Synergy for this one.

If this has already been posted please remove. Or if its in the wrong section.. please move. Figured it was development but could be general...

Hey guys - good seeing some of the old HTC guys over here (and all the new faces). As you all probably know i've been lurking around helping behind the scenes working on the rom. I have been researching the IMEI loss issue lately with the help of some Synergy testers (thanks guys) and have came up with the following information.

Now I do not have a gs3 myself, nor do I know anyone that has lost their imei (with said blocks to restore from), so its all "untested". Consider this a warning and continue on doing whatever other redundant methods to be safe.

There are several important keys on the system, HDCP keys, WIFI/Bluetooth MAC, Playready DRM keys, and IMEI/radio NV data. Our backups goal is to get all of these full partitions and have an easy restore process.

Paths/Files that appear to be important:
Code:
Playready DRM:
/efs/drm/playready/bdevcert.dat
/efs/drm/playready/devcert.dat
/efs/drm/playready/license.hds

Wifi Mac used by macloader:
/efs/wifi/.nvmac.info

HDCP (untested, anyone have HDMI cable?)
/efs/cert.cp
/efs/hdcp13.bin

radio/nvdata partitns:
13-modemst2 & 20-backup 
12-modemst1 & 21-fsg

Unknown (may be important dumps):
/data/misc/radio/
Now the important question here, nvdata/imei. The EFS partition has been verified by itself not to be a valid backup/restore of imei. This is because not all the files "actually" live there.

/efs on disk partition 11 reports to contain
Code:
/.files
/FactoryApp
/bluetooth
/drm
/imei
/sensors
/wifi
The actual EFS contains
Code:
/CGPS_ME
/CGPS_PE
/CGPS_SM
/CGPS_TLE
/SUPL
/application_specific_profiles
/cert
/client-cert
/client-key
/eHRPD
/gnss
/hdr
/mmgsdi
/mmode
/nv
/nvm
/pdp_profiles
/sd
/shared
/sms
/ssm
/wlan
So whats with the difference? After changing some radio values and checking partition MD5s we narrowed it down to a few moving partitions. More light was shed on this by going back to bootloader R&D, we can see Adam got an interesting email from someone named lee who analyzed the param.img structure. (if hes still around, would love to hear more on this) What is interesting now to us that wasn't during bootloader R&D are these few reboot reasons:

Quote:
0x77665511 - copy modemst1 to fsg partition and copy modemst2 to backup partition. sets param_header.nvdata_backup to 1
0x77665512 - copy fsg to modemst1 and copy backup to modemst2. checks to ensure param_header.nvdata_backup=1 first
0x77665514 - erase fsg and backup partitions. clears param_header.nvdata_backup
0x77665515 - same as 0x77665511 but then reboots the device into RECOVERY_MODE
What these show is modemst1 backs up to fsg part, modemst2 goes to backup. These must be important partitions if they are duplicated/backed up. The other key part here is sets param_header.nvdata_backup to 1, nvdata being the important bits that contain imei among other things.

Now as I said before, I see this as being more of a "total backup" for keys. I have not been able to thoroughly test this because its hard to reproduce the loss, but I have good faith from what we have seen that restoring modemst1/modemst2/efs/data folders to a known good state together hopefully would restore service. Please continue using other methods as well as a "double safeguard"

The next unlucky soul to loose their imei I would love to see run through the restore steps. On flash of rom - starting with tonights nightly - we will be creating a unsigned updater-zip formatted file with a backup of important partitions in /sdcard/synergyrom/. if you are left with a bad imei or any other bad keys, move the latest .zip where you know you had a good imei from /sdcard/synergyrom/backups/*.zip to the root of your SD card and flash it (and of course let us know here if it worked!)

Good luck!

*EDIT* I have attached a signed copy of the updater.zip we were using for testing to this post. It contains all the tools to backup your important partitions to synergyrom/backup folder on your SDCard. It creates an unsigned 7ziped files in flashable format.you can use to try to recovery from bad imei/mac/drm keys. Use common sense/with care, I wouldnt restore unless you are sure things have gone downhill (or balls of steel)
ATTACHED FILES
http://forum.xda-developers.com/attachment.php?attachmentid=1281376&d=1345868740 Synergy_Backup_HWKeys_signed.zip - [Click for QR Code] (1.07 MB, 109 views)

Sent from my SCH-I535 using Tapatalk 2


----------



## ERIFNOMI (Jun 30, 2011)

Can we have the link to the original article?

Also, this will get moved to general since it isn't a release, but still nice to see.


----------



## Hobart (Dec 27, 2011)

http://forum.xda-developers.com/showthread.php?t=1792499&page=574

Original link

Sent from my SCH-I535 using Tapatalk 2


----------



## Hobart (Dec 27, 2011)

ERIFNOMI said:


> Can we have the link to the original article?
> 
> Also, this will get moved to general since it isn't a release, but still nice to see.


Sorry wasn't sure

Sent from my SCH-I535 using Tapatalk 2


----------



## landshark (Aug 6, 2011)

This is not ROM or kernel development and does not belong in this section. Also, this information has already been added by Goose306 to the OP of his IMEI backup thread here:

http://rootzwiki.com/topic/32397-tutorial-imei-backup-nv-with-qpst-us-variants/

Moving this thread to general where it belongs and locking this thread since it is duplicate information.


----------

