***
If you have at least one sbf on your hard drive, read at least the first post here! Read everything and still not sure? Then you can ask, with providing some info about your software in phone (now and before) !
Even if you're unlocked, you need to know, which parts can be flashed and from what source you can use the cgs or dump files. Always check them first.
If you brick your phone with methods mentioned here, it's your responsibility.
But we are trying the opposite - unbrick your phone.
***
Before you flash anything, write down somewhere this info from Settings - About phone:
Baseband version
Build number
After you flash anything and it is working, write it down again.
If you want some easy help later, keep this info, it is important.
!!!
MAIN INFO (the most important):
sv0 = signature version 0
sv1 = signature version 1
sv2 = signature version 2
etc.
sv1 = 2.3.4 sbf, ota, derpunlock,etc... - CGs/partitions from 2.3.4_198_7 and less
sv2 = 2.3.5 sbf, ota, pudding 2.3.5, etc... - CGs/partitions from 2.3.5_254_12, 2.3.5_USC_19 and more
sv1 -> sv2 - possible, but it is the end of your unlocked bootloader days (end of custom kernels, recoveries and many custom roms)
sv2 -> sv1 - impossible !!!
always check with smgver program, before compiling sbf
!!!
After many hours of searching and playing with SBFs and RSD Lite, I found working tool for recompiling SBF superfiles. And I want to share my knowings.
I am not responsible for any damage. You must know, what you are doing.
First, before trying anything, you need to know that SBF files are just compiled CGxx.smg files, which are in many cases identical to partitions after flashed in your phone.
Something is already presented in this Atrix thread, as this phone is very similar.
Most of CGs are signed by Motorola and time to time, incoming new version of SBF, comes with new version of CGs signature. Mostly newer Android versions. These signature versions are known that they are switching the fuse, because once you flash higher version of CG, there is no way to flash the lower version back.
Recapitulation of SMGs:
RDL1 - Used for flashing CG5.smg - signed - always signature version 0
RDL3 - Flashes all other SMGs - signed - signature version incrementing
CG2 - ptable - not signed
CG3 - CDT.bin - something like - signed - signature version incrementing
CG5 - This is compiled from various mbn parts only for MBM6600 modem - partition, amss, cefs, dbl, osbl - not signed, but mbns are somehow secured
- MDM6600 is standalone unit with its own cpu, memory, bootloader, etc.
CG39 - configtable - signed - signature version incrementing
CG42 - Bootloader - signed - signature version incrementing
CG47 - Microboot - signed - signature version incrementing
CG56 - Boot logo - not signed
CG58 - Recovery emmc image (kernel and ramdisk.gz with recovery) - mmcblk0p10 - signed - signature version incrementing
CG59 - Boot emmc image (kernel and ramdisk.gz for system) - mmcblk0p11 - signed - signature version incrementing
CG60 - System image - mmcblk0p12 - signed - signature version incrementing only with sbf, but for some reason, signature is probably needed only for sbf flashing
CG61 - Webtop image - mmcblk0p13 - signed - same as CG60, but signature version checking software (SMGver) doesn´t see that, probably address doesn´t fit
CG62 - CDrom image - mmcblk0p14 - signed - signature version incrementing
CG65 - Preinstall image - mmcblk0p17 - not signed
Never forget to backup your /pds partition - mmcblk0p3, it's not part of any sbf.
Now to the creating of custom sbf:
It is a little complicated, because you first need to know, what do you want.
I am stuck unlocked, so I can flash any SMG signed with version 1 or not signed.
I cannot try this with locked bootloader signed with version 1, because of experiments with OTA.
I could try this with locked bootloader version 2, but it would close the door to unlocking.
So as first example, I create custom SBF of my Hybrid ROM, with TWRP recovery and Electrify boot.img.
First I need tools -
SBF Codec - tool for decompiling and compiling SMGs
SMG version - tool for checking version of SMG signature
I don´t take any credits for these easy and very good tools
Now I can take for example 198_7 SBF, that I have as base for my rom, open with SBF Codec and after a while, all SMGs will be in SMG folder next to my SBF Codec folder.
Now I can copy smgver.exe and ver.bat into SMG folder, open command line, navigate there to the SMG folder and run ver.bat. As I can see, these SMGs are mostly signed with version 1 or not signed, so there is nothing to worry about for me.
So now I need to know, which SMGs do I need and which do I want.
Always needed SMGs or the flash process will fail are:
CG2.smg
CG3.smg
CG39.smg
RDL3.smg
(don´t touch SBFData.dat and SBFHeader.hdr files)
The rest can be removed, except those wanted.
(If I want this SBF to unlock my bootloader, I just replace CG42.smg with the one from derpunlock.sbf)
Wanted SMGs are in my case - custom kernel, recovery and rom, so I will not remove:
CG58.smg
CG59.smg
CG60.smg
But I need those changed, so I need to get them from my phone as full partition dumps.
Dumping full partitions:
From running phone with adb shell and command -
dd if=/dev/block/mmcblk0p10 of=/sdcard/recovery.img
dd if=/dev/block/mmcblk0p11 of=/sdcard/boot.img
dd if=/dev/block/mmcblk0p12 of=/sdcard/system.img
Now I copy them from sdcard next to SMG folder and rename -
recovery.img -> CG58_0x000......smg
boot.img -> CG59_0x000......smg
system.img -> CG60_0x000......smg
And I overwrite those in SMG folder with these.
Now I can click on save button in SBF Codec tool and name the new sbf as I want.
I will do factory reset of my phone and flash over any unlocked rom based on 198_7 or 198_6 maybe 154_5, etc. SBF.
There is not much potential for unlocked bootloaders. As we have custom recovery flashing everything.
But the better from this comes on locked bootloaders.
In case of 2.3.4 softbrick, you don´t have to flash full SBF, root and install bootstrap.
You can just make your own SBF with custom rom (mof 2.3.5ish for locked for example), and in case of some system brick, just reflash your custom sbf without even wiping data and recover from brick after a few minutes.
*updated info - still possible, but custom sbf with unlocked bootloader needed
And the best is, that you can make custom SBF for recovering from Photon 2.3.5 ota brick, with CG2, CG3, CG39, RDL3 with signature version 2, taken from USC Electrify 2.3.5 SBF and Photon 2.3.5 OTA system dump (CG60).
*updated info - system dump no, we do not have any not modified sv2 system dump
You can probably install custom Webtop on locked 2.3.5.
*updated info - webtop dump no, we do not have any not modified sv2 webtop dump, custom webtop no (maybe some optimized for bootstrap)
You cannot install AOSP roms on locked bootloader this way, because custom boot.img needed and you cannot sbf/fastboot flash custom modified CGs/partitions.
Do not try to flash radio this way, it´s not working. Locked or unlocked, always remove RDL1.smg and CG5.smg.
*updated info - it works, but hex editing sbf header needed (0-767 byte)
*
Partition table - CG2 or ptable or PT
mmcblk0p1 - nvmotota - here goes bootloader with microboot (ap20bl.img) from ota updates, installing on first reboot after updating
mmcblk0p2 - CDT (codegoup description table - cdt.bin)
mmcblk0p3 - PDS (/pds)
mmcblk0p4 - EBR
mmcblk0p5 - SP
mmcblk0p6 - CID
mmcblk0p7 - MSC (misc) - empty
mmcblk0p8 - LOG (logo)
mmcblk0p9 - KPA (kernel panic)
mmcblk0p10 - SOS (recovery image)
mmcblk0p11 - LNX (boot image)
mmcblk0p12 - APP (system image)
mmcblk0p13 - OSH (webtop image)
mmcblk0p14 - CDR (cdrom image)
mmcblk0p15 - CAC (cache)
mmcblk0p16 - UDA (userdata)
mmcblk0p17 - PIA (preinstall image)
mmcblk0p18 - SDC (sdcard)
mmcblk0p19 - GPT (gpt)
*
Failed to boot 1 - bootloader/microboot partition problem
Failed to boot 2 - boot partition problem
Failed to boot 3 - recovery partition problem
Failed to boot 4 - system partition problem
Not modified signed boot.img and recovery.img dump from partition can be flashed with fastboot or sbf.
Dumped system.img looks like a problem to flash with fastboot or sbf, because to dump it, you must be rooted. Root = broken checksum = broken signature = failed to boot 4
