Search results

I can SIM unlock F-04G. Sent from my F-04G using XDA-Developers mobile app

Oh I've deleted it by accident. Someone who still owns it please upload.

Naive. a. I may have more experience on SHARP unlocking than you. There are at least 5 different SIM lock implementations in SHARP devices. Of course I'm talking about radio(hexagon). b. There is no more sense focusing on SHSim*.apk since this summer, due to Japanese law change. c. Radio is...

Why do you think known xposed modules will work? There are lots of hardcodes in this ROM. Again, any *known* solutions won't work I think. Many of you only know editting properties or using known hacks, but never know how and why. a. GSM/UMTS and other LTE bands I did not check GSM/UMTS. For...

https://gist.github.com/tewilove/a5a66c7a3ef3216013c4 After apply this xposed module, you may still have to delete /pdp_profiles/profile1 in EFS using QPST.

I do have signal with China Mobile/TDD BAND 41. Bad news is that SHARP seems to have hardcoded APN list, possible in radio. I've removed all restrictions in Android with xposed and the log did tell me written APN to radio with success. But I cannot get data working. And FC when dialing, and auto...

Two ideas. Sent from my SH-03G using XDA Free mobile app

No. Sent from my SH-03G using XDA Free mobile app

Stop. I definitely know all public guides.

I've changed lteOnCdmaDevice to 0, ro.telephony.default_network to 9. And installed xposed framework, did some hook on TeleService.apk(com.android.phone) and choosed LTE/WCDMA/GSM. Now in operator list I can see China Mobile/China Unicom/46011. They are local LTE network I think. But cannot...

Hello all, I've uploaded TWRP, only for testing. Please use it at YOUR OWN risk.

No, until you pay me $$$$. Sent from my D6633 using XDA Free mobile app

thanks, I'll invest later. Sent from my D6633 using XDA Free mobile app

again. can you make a list of /nv/item_files/modem/rfnv and past here? only numberic names are desired. Sent from my D6633 using XDA Free mobile app

Looks like CDMA/HDR/GSM/LTE is inside... And what about /nv/item_files/modem/uim/gstk/rat_priority_config?

Again, can you upload /sd/rat_acq_order from your phone's EFS?

access to /policyman might be restricted. currently no way to edit. :( Sent from my D6633 using XDA Free mobile app

Thanks but I'm not going to accept it. BTW, someone can take a look that if there is a directory called /policyman in QPST EFS Explorer after turning DIAG mode on? This is possibly related to GSM/UMTS lock. Sent from my D6633 using XDA Free mobile app

So I want to clean this thread, whom should I ask? Sent from my SH-03G using XDA Free mobile app

什么逻辑，狗屁不通。 Sent from my SH-03G using XDA Free mobile app

To Chinese here：我已经说了禁止转载了，现在帖吧到处都是，转载还没写出处。。。wpoff每个型号解除写保护指令是不一样的，怎么试都没用的。你们爱怎么玩怎么玩，祝砖。 Sent from my MI 4C using XDA Free mobile app

For my SH-04F: UPDATE-SuperSU-v2.46 will install but no root due to removal of install-recovery.sh. Direct replacing app_process or other root process causes boot loop. I guess there seems to be some tricks in SHARP's kernel. I recompiled kernel and repacked boot.img, and did some minor tweaks...

I have done full root & TWRP on a SH-04F. Since my 306SH is bricked, hope someone else here do it for you.

Generally it requires kernel exploit, bypassing kernel restrictions, then hook TelephonyService. And you will need valid DCM phone number and IMSI to fake while hooking.

I'll make another one working with all known versions later. Patient. Sent from my L55u using XDA Free mobile app

WP is defeated! Starting another thread soon.

SHARP blocks talk to mmc by ioctl at kernel level. I need your kernel and version to exactly patch the kernel to make wpoff work. To make most of you happy I may need every version...

Well. I'm going to find another 306sh. Sent from my SH-03G using XDA Free mobile app

Somebody knows what is the exactly build version? Tell me this two please. adb shell getprop ro.product.model adb shell getprop ro.build.display.id I need your boot.img and matching version, otherwise the kernel patch is incorrect, which may cause reboot and has no effect.

i dont remember exactly. ??? = you must fill it according to your device. # cd /dev/block/platform/???/by-name # dd if=boot of=/data/local/tmp/boot.img then you can pull it out with adb pull /data/local/tmp/boot.img don't forget paste your rom build version along with boot dump.

with this temp root, dd boot partition and pull it out.

Someone can dump kernel for me? I have a test program which tries to remove write protection. But kernel must be patched first. As someone mentioned my device is bricked. Sent from my L55u using XDA Free mobile app

Yes, I'm a bit annoyed. Take a look at #1 and think before asking.

There is no software restrictions after you gain temp root using tools provided by me. Again, both MIYABI and mmc_protect_part are removed. Did you read the thread which explains power on WP on SHARP devices? And as I said, the protection is not kernel level, it's hardware. Search for eMMC...

This temp root has already completely removed MIYABI. Without this you cannot access boot/recovery/aboot, etc at all. Have you read the posts in this board before? MIYABI makes no sense here. Even write protection is not done by LINUX. I don't want to repeat many times but please read another...

Why referring SHARP source? FOTA source is definitely proprietary. I have decrypted 95% of FOTA update package of this device. It's a matter of time for me to build a fake OTA. To install TRWP, there are two steps. 1. unlock bootloader, only edit one byte in aboot partition 2. write TRWP to...

Modem PBL loads and authenticates MBA, MBA loads and authenticates modem fw, then jump to modem fw. Unless you are absolutely sure 305SH and 306SH shares the same key, don't flash modem images... Also there are many Sprint specific features in 306SH modem. And modem is protected by power on WP.

Decrypted part of the file. The result looks promising, but I need to learn more about RedBend OTA package format. Or someone know this here? Take this if you are interested. https://drive.google.com/file/d/0B5QYBzdG6RuybU16WmJCakFyZms/view?usp=sharing FOTA central index...

Thanks.

Hi, I've reversed the FOTA process, about 50% or so. FOTA update seems to be very insecure since there appears to be no DIGITAL SIGNATURE. I grabbed an OTA file from another SHARP device and managed to decrypt 3/4 of it. And it seems that only 2/4 of it is used in recovery(FOTA). The left thing...

I think it will stay the original version if you delete /fota/update_package before rebooting. But not 100% sure. Sent from my SH-01G using XDA Free mobile app

Hello, can somebody grab an OTA for me? Cos mine is up to date. The procedure is, run this temp root to obtain a root shell, then execute OTA but not to reboot immediately. After downloading OTA package should be at /fota/update_package. Use # cat /fota/update_package >...

This thread is totally crap.

I don't see anything but only stories. I think it's a fake. Sent from my D6633 using XDA Free mobile app

Can you share some details with me? What you found is somewhat beyond my knowlege. My thought is simple. When FOTA finishes it sets one or more flags to indicate the following procedure(maybe sbl1, tz, aboot) that power on WP is temporary disabled. So just tamper this flag.

Which bootloader? sbl1 or aboot? For this device aboot has no fastboot facility and even more, when power on WP is set is uncertain(WIP), if it's inside sbl1 then goodbye aboot. And why attacking OTA? I believe it's AESed with fixed key&IV inside FOTA or somewhere else. But modern OTA...

Impossible. Sent from my SH-01G using XDA Free mobile app

SHARP recovery seems to only handle master clear. Take SH-01G as example, fota is likely being handled in sbl1. Sent from my SH-01G using XDA Free mobile app

I'm not familiar with it, too.

We should find a way to set FOTA flag since after OTA Android is doing odex. At this point system is rw. Sent from my D6633 using XDA Free mobile app