[HOWTO]Comprehensive IMEI/EFS Backup

Search This thread

WildZontar

Senior Member
Jul 11, 2010
105
185
Scranton, PA
Update 9/1/2012: A user has successfully restored with this method! Continue to "Testimonials" for more info!
Update 9/2/2012: TrevE has now come up with a way to leverage Samsung's built-in restore to your advantage! Read below for more!
Update 9/3/2012: Changed adb commands to reduce Operation not permitted problems.

Thanks to the efforts of some great developers, there is now *possibly* a more comprehensive method to backup your IMEI. While I have not personally tested a restore using this method, a user in IRC has done a manual NVRAM wipe and restored it using this method, without the roaming issues caused by a occasionally-bungled QPST restore or manual IMEI injection. In addition, posts in this thread indicate a successful restore from an actual occurrence of the problem, all without the use of QPST and also without any roaming issues!

Before I go any further, the same old disclaimer still applies; you accept all responsibility for what you do to your own device!

Theory:
The theory is that the S3 has, in the boot process, a routine which is "tripped" when it detects an error condition. This routine is designed to "save" your IMEI by restoring images from two built-in backup blocks. The problem is, it actually does the opposite; for whatever boneheaded reason, the default backup blocks contain dummy images with an IMEI of 0 and no carrier identification. This is why your phone forgets what carrier it's on and what its IMEI number is; the restore routine actually overwrites the phone's only copy of the IMEI data with a dummy. Because much more data is lost than just the IMEI, this is also why a QPST injection (not a QCN restore) persistently leaves you on roaming.

In an initial attempt to solve this problem, users have attempted to "dd", or create an image of, a single block supposedly containing the IMEI when the phone is still in a good state. This is the efs.sbn method that you may have seen. However, upon further inspection, it turns out the IMEI data is actually spread across five different block devices, hence why the efs.sbn method is either ineffective or leaves you on roaming! After the block devices were identified, a SynergyROM team member created an easy-to-use recovery zip that allows you to image these five blocks, allowing you to reflash them should the Samsung boot process overwrite your IMEI! Re-flashing these blocks after they've been crapped up virtually ensures your phone has been fully restored to its pre-IMEI-loss condition, thereby preventing roaming or data issues seen consistently with a manual injection, or intermittenly with a QPST restore. You do not need SynergyROM to use this tool; I've done it from full stock.

But wait: there's more. About a week after the development of this tool, several unused boot entry points were discovered that revealed a way to control Samsung's built-in "safety" feature and actually make it work properly! Two backup blocks were put in by Samsung themselves; "fsg" and "backup". The great news is that, although these images may contain dummies by default, you can instruct the bootloader to write your good NVRAM data to them so that the good data is what's written to NVRAM in the event of an error. That is, instead of restoring a dummy image over your good IMEI...it restores a good backup instead and you don't lose a thing! How awesome is that?

Developers are now recommending a new IMEI backup regimen, leveraging Samsung's built-in IMEI backup and SynergyROM's manual backup, together with an optional QCN backup you can do for good measure. Of course I can't make any guarantees, but doing this backup should leave you in such a good spot that almost nothing can total your IMEI or leave you in a roaming state. Here are the new instructions on how to backup your IMEI, iron-clad. Do Parts A and B, in order, C is optional but will give you added peace of mind.

Backup:
Part A (Samsung's built-in backup):
1. If your phone does not have Terminal Emulator installed, you will need to use ADB. Download and install the Android SDK platform-tools for your platform. This is a bit non-trivial as it requires the installation of the Android SDK, however, you can find a guide for installing adb here. After installing, open a command prompt and navigate to the "platform-tools" folder within the SDK, where adb is stored. If you need additional help on this, simply ask in this thread.

If your phone is rooted and has Terminal Emulator installed, you don't need to do any of this. Simply open up the Terminal Emulator and go to step 2.

2. For ADB: Connect your phone to the computer and ensure it is in "Debug Mode" (Settings->Developer Options->USB debugging). Then. in the command prompt, type the following:
Code:
adb reboot nvbackup

For Terminal Emulator: The actual "beef" of the command is the "reboot nvbackup" line. Therefore, if you have Terminal Emulator installed, you can just run the command straight off your phone. Enter these two commands from the app:
Code:
su
reboot nvbackup

3. Your phone will reboot and copy the contents of two IMEI partitions to the two built-in backup blocks. You may see tiny blue text on the bootloader screen indicating that it is copying.
4. Allow it to finish and then reboot back into Android. The "fsg" and "backup" block devices now contain your IMEI information as they should have in the first place.

Part B (SynergyROM's "Plan B" manual backup):
1. Download the attachment at the bottom of this post. This is an update ZIP you can run right from recovery.
2. Reboot into recovery. On stock this can be done by turning off the phone and then turning it back on while holding UP and HOME.
3. CWM: Use VOL UP and VOL DOWN together with HOME to select "install zip from sdcard" then "choose zip from sdcard". Navigate to the folder you downloaded it to (most likely Download/). Select the zip you just downloaded to "flash".
TWRP: Touch "install" and navigate to the folder you downloaded the zip to (most likely Download/). Swipe to confirm flash.
4. Allow the backup to complete successfully. "Flash" is a bit of a misnomer; this is actually just a script that will safely backup your EFS and radio information to /sdcard/synergyrom/backup without touching your ROM at this point. When the script completes, reboot.

Part C: Backup with QPST:
Once the gold standard of IMEI backup, this method (in my opinion) should now be done only in the event of an unlikely complete catastrophe where neither Samsung's built-in restore nor SynergyROM's restore works. Simply follow the instructions here for extreme peace of mind; you don't need to do this if you don't want to, but I personally did.

Restore:
Do not do this unless your IMEI has been lost!
Performing Part A of the backup should ensure that you never lose your IMEI in the first place; the theory being that the Samsung built-in backup now has a good image to restore itself, as opposed to a dummy image. However, things may still happen. If you've still lost your IMEI, perform each of these methods in order of priority, "A" being the first.

Restore Plan A:
Run the following command from adb, just like when you backed up (have Android SDK installed, connect phone, and ensure USB debugging is enabled):
Code:
adb reboot nvrestore
This method triggers Samsung's built-in IMEI restore; except this time, you got good images on your side. Simply allow the phone to restore and reboot itself when completed. NEVER PERFORM THIS COMMAND WITHOUT DOING PART A OF "BACKUP" FIRST; THIS WOULD RESTORE THE DUMMY IMAGES INSTEAD AND WIPE YOUR IMEI!

Restore Plan B:
Sometimes a fluke happens and the nvrestore does not work. That's why this one is Plan B and not Plan A. Good thing you did Part B of "Backup"! Rather than instructing Samsung's bootloader to restore your NVRAM, this method will do so manually from recovery using a manually done backup.

It's just like when you backed up, except now you want to flash the zip containing your NVRAM info that the other zip built for you. This zip is located in /sdcard/synergyrom/backup. Simply navigate to this path and flash the zip beginning with "keybackup"; this will write images to 5 block devices from a time when your IMEI was all good. Reboot the phone; if all went well, you now have your IMEI back with no roaming!

Restore Plan C:
Both methods above may fail you in extremely unlikely circumstances. At this point, you'll need to try using QPST to get your IMEI back. If you did Part C in "Backup", you can follow instructions in that same thread to get you back up and running. In most QPST restores, you shouldn't have any issues with data or roaming.

Restore Plan D:
The planets have lined up, the Cubs have won the World Series, and all three above methods have failed you in what is surely a sign of the apocalypse. Far more likely, though, is that you didn't have a backup of anything and your IMEI is gone for good. The good news is that you can still get your phone working; the bad news is that you'll be stuck on roaming and may have problems with data. You'll need to perform an "IMEI injection" which is a kludgy last-resort restore method that manually writes the IMEI to NVRAM; the link I provided in Part C of "Backup" will tell you how to do it.

Testimonials:
This method has been tested good by the following users in this thread!

Just flashed CM10 09-01 nightly and lost data, confirmed I lost my IMEI. I had used the process in the OP a while ago to backup my IMEI. Just would like to confirm that I just flashed the backup it created and happy to report all is well again. Thanks for the post of this tool........saved my butt......

I'll join the club. Lost my IMEI while doing the latest CM10 nightly. Restored and was back in action in no time.

Nght12 said:
Hey, used your backup method and ended up having to use it later in the day. It works. I'd reply but I can't yet due to being a new member here

Please continue to let everyone know if this restore has worked for you after an IMEI loss!

Happy flashing!
 
Last edited:

con247

Retired Recognized Developer
Sep 1, 2010
3,154
3,108
Ann Arbor
The other trickery we ran into is partitions do not like to be written to for whatever reason outside of package_extract_file right outa the zip. dd'ing directly back failed over and over, I have no clue why, poor esc must have flashed 100 zips before I gave up looking into it. So the updater zip restore uses only package_extract_file, actually writing partitions out properly. I have high hopes that it will actually work, but until tested otherwise do as many types of backups as you can :p

Your restore dd commands won't work.
 

xCHPx

Senior Member
Oct 6, 2010
369
19
So will this work on any ROM?

Sent from my SCH-I535 using xda app-developers app
 

tu3218

Senior Member
Apr 14, 2009
3,413
368
Yeah I'm on stock rom just rooted an cwm. Can I flash this zip an since I don't have synergy, where will the backup be stored?

Sent from my SCH-I535 using xda app-developers app
 

Travisimo

Senior Member
Oct 15, 2010
162
60
I'm all for redundancy of backups, so here's hoping this method fully works when restoring. I have not experience a loss of IMEI myself, but I definitely want to be safe. I know the original efs backup method was proven to be an incomplete backup, but I thought the QPST NV backup method was proven to work? Are you saying that restoring with tthe QPST method (where you have an NV backup before you lose IMEO) does not work and will still having roaming issues?

At any rate, it will be interesting to see if this is the "one true backup" to rule them all for IMEI. ;) So basically, you flash the zip in recovery and it creates another zip with the backed up contents. And in the event of an IMEI loss, you just flash the new zip and should be good to go? At least, that's the theory, right?
 

con247

Retired Recognized Developer
Sep 1, 2010
3,154
3,108
Ann Arbor
I'm all for redundancy of backups, so here's hoping this method fully works when restoring. I have not experience a loss of IMEI myself, but I definitely want to be safe. I know the original efs backup method was proven to be an incomplete backup, but I thought the QPST NV backup method was proven to work? Are you saying that restoring with tthe QPST method (where you have an NV backup before you lose IMEO) does not work and will still having roaming issues?

At any rate, it will be interesting to see if this is the "one true backup" to rule them all for IMEI. ;) So basically, you flash the zip in recovery and it creates another zip with the backed up contents. And in the event of an IMEI loss, you just flash the new zip and should be good to go? At least, that's the theory, right?

You nailed it!
 
Confirmed successful backup using CWM.

I can confirm this backup method works using CWM.

I first tried it with TWRP via Goo Manager and the script didn't execute properly.
I tried flashing the file while still in TWRP and I couldn't even find the zip file anywhere, user error I'm guessing.. lol.

So I flashed CWM over TWRP via ROM Manager PRO and flashed the zip file with CWM via ROM Manager PRO and the zip script executed nicely. I found the backed up zip file where the OP said it would be.

Here's to hoping I never have to use the backed up file, but it's good to know I have it there if needed.

Thanks again OP!
 

WildZontar

Senior Member
Jul 11, 2010
105
185
Scranton, PA
So will this work on any ROM?

Sent from my SCH-I535 using xda app-developers app

This should work regardless of ROM as it is a recovery zip. I've tested it with CWM: I've never used TWRP so I don't know how well it would work in TWRP.

Yeah I'm on stock rom just rooted an cwm. Can I flash this zip an since I don't have synergy, where will the backup be stored?

Sent from my SCH-I535 using xda app-developers app

I've tested a backup successfully on full stock, rooted. The backup will be stored in a folder called "synergyrom" but this just the name the tool gives to the directory (as the tool was created by the Synergy team) and has no impact on function or dependency on SynergyROM.

I'm all for redundancy of backups, so here's hoping this method fully works when restoring. I have not experience a loss of IMEI myself, but I definitely want to be safe. I know the original efs backup method was proven to be an incomplete backup, but I thought the QPST NV backup method was proven to work? Are you saying that restoring with tthe QPST method (where you have an NV backup before you lose IMEO) does not work and will still having roaming issues?

QPST method is not perfect; it is better than a simple IMEI injection, but the boot bug writes crap over much more than just the IMEI. This is why either method may leave you on roaming (althogh a QPST restore only sporadically causes roaming). In addition, various DRM keys may be erased as well, leaving you potentially unable to play back HDCP/PlayReady titles; QPST does not restore these.

At any rate, it will be interesting to see if this is the "one true backup" to rule them all for IMEI. ;) So basically, you flash the zip in recovery and it creates another zip with the backed up contents. And in the event of an IMEI loss, you just flash the new zip and should be good to go? At least, that's the theory, right?

That's correct. When you "flash" the backup zip, nothing actually is written to the ROM as far as I can tell; it runs just like a script/batch file and saves your backup zip to /sdcard/synergyrom. The tool itself creates a new flashable zip in this directory, one that does modify your unit, which you can then use only in the event that the bootloader craps up the NVRAM.
 
Last edited:

hopesrequiem

Senior Member
May 27, 2011
3,056
1,151
Just did this on cm10. Backed up without issue and I see the folder it created. Thank you. I've done qpst as well so now I feel very safe

Sent from my SCH-I535 using Tapatalk 2
 

tu3218

Senior Member
Apr 14, 2009
3,413
368
So this requires an unlocked bootloader? I just did this but it skipped because my bootloader is still locked. Is that correct in that it needs to be unlocked for this backup process to work?

Sent from my SCH-I535 using xda app-developers app
 

1ManWolfePack

Senior Member
Jul 11, 2012
2,384
1,758
Just did this, thanks!

I now have 3 different types of backups. I feel safe now if I ever lose it.

Safe-r, I should clarify.

Sent from my SCH-I535 using Tapatalk 2
 

hopesrequiem

Senior Member
May 27, 2011
3,056
1,151
So this requires an unlocked bootloader? I just did this but it skipped because my bootloader is still locked. Is that correct in that it needs to be unlocked for this backup process to work?

Sent from my SCH-I535 using xda app-developers app

There is no excuse to not be unlocked at this point.

Sent from my SCH-I535 using Tapatalk 2
 
  • Like
Reactions: xsteven77x

Top Liked Posts

  • There are no posts matching your filters.
  • 166
    Update 9/1/2012: A user has successfully restored with this method! Continue to "Testimonials" for more info!
    Update 9/2/2012: TrevE has now come up with a way to leverage Samsung's built-in restore to your advantage! Read below for more!
    Update 9/3/2012: Changed adb commands to reduce Operation not permitted problems.

    Thanks to the efforts of some great developers, there is now *possibly* a more comprehensive method to backup your IMEI. While I have not personally tested a restore using this method, a user in IRC has done a manual NVRAM wipe and restored it using this method, without the roaming issues caused by a occasionally-bungled QPST restore or manual IMEI injection. In addition, posts in this thread indicate a successful restore from an actual occurrence of the problem, all without the use of QPST and also without any roaming issues!

    Before I go any further, the same old disclaimer still applies; you accept all responsibility for what you do to your own device!

    Theory:
    The theory is that the S3 has, in the boot process, a routine which is "tripped" when it detects an error condition. This routine is designed to "save" your IMEI by restoring images from two built-in backup blocks. The problem is, it actually does the opposite; for whatever boneheaded reason, the default backup blocks contain dummy images with an IMEI of 0 and no carrier identification. This is why your phone forgets what carrier it's on and what its IMEI number is; the restore routine actually overwrites the phone's only copy of the IMEI data with a dummy. Because much more data is lost than just the IMEI, this is also why a QPST injection (not a QCN restore) persistently leaves you on roaming.

    In an initial attempt to solve this problem, users have attempted to "dd", or create an image of, a single block supposedly containing the IMEI when the phone is still in a good state. This is the efs.sbn method that you may have seen. However, upon further inspection, it turns out the IMEI data is actually spread across five different block devices, hence why the efs.sbn method is either ineffective or leaves you on roaming! After the block devices were identified, a SynergyROM team member created an easy-to-use recovery zip that allows you to image these five blocks, allowing you to reflash them should the Samsung boot process overwrite your IMEI! Re-flashing these blocks after they've been crapped up virtually ensures your phone has been fully restored to its pre-IMEI-loss condition, thereby preventing roaming or data issues seen consistently with a manual injection, or intermittenly with a QPST restore. You do not need SynergyROM to use this tool; I've done it from full stock.

    But wait: there's more. About a week after the development of this tool, several unused boot entry points were discovered that revealed a way to control Samsung's built-in "safety" feature and actually make it work properly! Two backup blocks were put in by Samsung themselves; "fsg" and "backup". The great news is that, although these images may contain dummies by default, you can instruct the bootloader to write your good NVRAM data to them so that the good data is what's written to NVRAM in the event of an error. That is, instead of restoring a dummy image over your good IMEI...it restores a good backup instead and you don't lose a thing! How awesome is that?

    Developers are now recommending a new IMEI backup regimen, leveraging Samsung's built-in IMEI backup and SynergyROM's manual backup, together with an optional QCN backup you can do for good measure. Of course I can't make any guarantees, but doing this backup should leave you in such a good spot that almost nothing can total your IMEI or leave you in a roaming state. Here are the new instructions on how to backup your IMEI, iron-clad. Do Parts A and B, in order, C is optional but will give you added peace of mind.

    Backup:
    Part A (Samsung's built-in backup):
    1. If your phone does not have Terminal Emulator installed, you will need to use ADB. Download and install the Android SDK platform-tools for your platform. This is a bit non-trivial as it requires the installation of the Android SDK, however, you can find a guide for installing adb here. After installing, open a command prompt and navigate to the "platform-tools" folder within the SDK, where adb is stored. If you need additional help on this, simply ask in this thread.

    If your phone is rooted and has Terminal Emulator installed, you don't need to do any of this. Simply open up the Terminal Emulator and go to step 2.

    2. For ADB: Connect your phone to the computer and ensure it is in "Debug Mode" (Settings->Developer Options->USB debugging). Then. in the command prompt, type the following:
    Code:
    adb reboot nvbackup

    For Terminal Emulator: The actual "beef" of the command is the "reboot nvbackup" line. Therefore, if you have Terminal Emulator installed, you can just run the command straight off your phone. Enter these two commands from the app:
    Code:
    su
    reboot nvbackup

    3. Your phone will reboot and copy the contents of two IMEI partitions to the two built-in backup blocks. You may see tiny blue text on the bootloader screen indicating that it is copying.
    4. Allow it to finish and then reboot back into Android. The "fsg" and "backup" block devices now contain your IMEI information as they should have in the first place.

    Part B (SynergyROM's "Plan B" manual backup):
    1. Download the attachment at the bottom of this post. This is an update ZIP you can run right from recovery.
    2. Reboot into recovery. On stock this can be done by turning off the phone and then turning it back on while holding UP and HOME.
    3. CWM: Use VOL UP and VOL DOWN together with HOME to select "install zip from sdcard" then "choose zip from sdcard". Navigate to the folder you downloaded it to (most likely Download/). Select the zip you just downloaded to "flash".
    TWRP: Touch "install" and navigate to the folder you downloaded the zip to (most likely Download/). Swipe to confirm flash.
    4. Allow the backup to complete successfully. "Flash" is a bit of a misnomer; this is actually just a script that will safely backup your EFS and radio information to /sdcard/synergyrom/backup without touching your ROM at this point. When the script completes, reboot.

    Part C: Backup with QPST:
    Once the gold standard of IMEI backup, this method (in my opinion) should now be done only in the event of an unlikely complete catastrophe where neither Samsung's built-in restore nor SynergyROM's restore works. Simply follow the instructions here for extreme peace of mind; you don't need to do this if you don't want to, but I personally did.

    Restore:
    Do not do this unless your IMEI has been lost!
    Performing Part A of the backup should ensure that you never lose your IMEI in the first place; the theory being that the Samsung built-in backup now has a good image to restore itself, as opposed to a dummy image. However, things may still happen. If you've still lost your IMEI, perform each of these methods in order of priority, "A" being the first.

    Restore Plan A:
    Run the following command from adb, just like when you backed up (have Android SDK installed, connect phone, and ensure USB debugging is enabled):
    Code:
    adb reboot nvrestore
    This method triggers Samsung's built-in IMEI restore; except this time, you got good images on your side. Simply allow the phone to restore and reboot itself when completed. NEVER PERFORM THIS COMMAND WITHOUT DOING PART A OF "BACKUP" FIRST; THIS WOULD RESTORE THE DUMMY IMAGES INSTEAD AND WIPE YOUR IMEI!

    Restore Plan B:
    Sometimes a fluke happens and the nvrestore does not work. That's why this one is Plan B and not Plan A. Good thing you did Part B of "Backup"! Rather than instructing Samsung's bootloader to restore your NVRAM, this method will do so manually from recovery using a manually done backup.

    It's just like when you backed up, except now you want to flash the zip containing your NVRAM info that the other zip built for you. This zip is located in /sdcard/synergyrom/backup. Simply navigate to this path and flash the zip beginning with "keybackup"; this will write images to 5 block devices from a time when your IMEI was all good. Reboot the phone; if all went well, you now have your IMEI back with no roaming!

    Restore Plan C:
    Both methods above may fail you in extremely unlikely circumstances. At this point, you'll need to try using QPST to get your IMEI back. If you did Part C in "Backup", you can follow instructions in that same thread to get you back up and running. In most QPST restores, you shouldn't have any issues with data or roaming.

    Restore Plan D:
    The planets have lined up, the Cubs have won the World Series, and all three above methods have failed you in what is surely a sign of the apocalypse. Far more likely, though, is that you didn't have a backup of anything and your IMEI is gone for good. The good news is that you can still get your phone working; the bad news is that you'll be stuck on roaming and may have problems with data. You'll need to perform an "IMEI injection" which is a kludgy last-resort restore method that manually writes the IMEI to NVRAM; the link I provided in Part C of "Backup" will tell you how to do it.

    Testimonials:
    This method has been tested good by the following users in this thread!

    Just flashed CM10 09-01 nightly and lost data, confirmed I lost my IMEI. I had used the process in the OP a while ago to backup my IMEI. Just would like to confirm that I just flashed the backup it created and happy to report all is well again. Thanks for the post of this tool........saved my butt......

    I'll join the club. Lost my IMEI while doing the latest CM10 nightly. Restored and was back in action in no time.

    Nght12 said:
    Hey, used your backup method and ended up having to use it later in the day. It works. I'd reply but I can't yet due to being a new member here

    Please continue to let everyone know if this restore has worked for you after an IMEI loss!

    Happy flashing!
    9
    Ziggy helped grep through kernel code - in /arch/arm/mach-msm/restart.c (http://git.ziggy471.com/i535.git/tree/arch/arm/mach-msm/restart.c) there's the following code for reboot reasons. Not entirely if you can just hit these reasons with something like -
    Code:
    adb shell reboot nvbackup
    -

    or if you have to hit it in fastboot (if you guys have it) with
    Code:
    fastboot oem reboot nvbackup

    but either may be possible to kick a stock backup with something similar. *use at own risk*

    Also if these nv reboot commands (nvbackup/nvrestore/nverase/nvrecovery) are just screwing you guys over instead of actually working, maybe kernel devs can patch them out? Or change them to boot into download mode or something similar so atleast people can track when something would have happened? Just throwing some ideas out there

    Code:
    	if (cmd != NULL) {
    		if (!strncmp(cmd, "bootloader", 10)) {
    			__raw_writel(0x77665500, restart_reason);
    		} else if (!strncmp(cmd, "recovery", 8)) {
    			__raw_writel(0x77665502, restart_reason);
    		} else if (!strncmp(cmd, "oem-", 4)) {
    			unsigned long code;
    			code = simple_strtoul(cmd + 4, NULL, 16) & 0xff;
    			__raw_writel(0x6f656d00 | code, restart_reason);
    #ifdef CONFIG_SEC_DEBUG
    		} else if (!strncmp(cmd, "sec_debug_hw_reset", 18)) {
    			__raw_writel(0x776655ee, restart_reason);
    #endif
    #ifdef CONFIG_SEC_PERIPHERAL_SECURE_CHK
    		} else if (!strncmp(cmd, "peripheral_hw_reset", 19)) {
    			__raw_writel(0x77665507, restart_reason);
    			printk(KERN_NOTICE "peripheral_hw_reset C777!!!!\n");
    #endif
    		} else if (!strncmp(cmd, "download", 8)) {
    			__raw_writel(0x12345671, restart_reason);
    		} else if (!strncmp(cmd, "sud", 3)) {
    			__raw_writel(0xabcf0000 | (cmd[3] - '0'),
    					restart_reason);
    		} else if (!strncmp(cmd, "debug", 5) /* set debug leve */
    				&& !kstrtoul(cmd + 5, 0, &value)) {
    			__raw_writel(0xabcd0000 | value, restart_reason);
    		} else if (!strncmp(cmd, "nvbackup", 8)) {
    			__raw_writel(0x77665511, restart_reason);
    		} else if (!strncmp(cmd, "nvrestore", 9)) {
    			__raw_writel(0x77665512, restart_reason);
    		} else if (!strncmp(cmd, "nverase", 7)) {
    			__raw_writel(0x77665514, restart_reason);
    		} else if (!strncmp(cmd, "nvrecovery", 10)) {
    			__raw_writel(0x77665515, restart_reason);
    		} else {
    			__raw_writel(0x77665501, restart_reason);
    		}
    	}
    #ifdef CONFIG_SEC_DEBUG
    	else {
    		printk(KERN_NOTICE "%s : clear reset flag\r\n", __func__);
    		/* clear abnormal reset flag */
    		__raw_writel(0x12345678, restart_reason);
    	}
    #endif
    7
    Just flashed CM10 09-01 nightly and lost data, confirmed I lost my IMEI. I had used the process in the OP a while ago to backup my IMEI. Just would like to confirm that I just flashed the backup it created and happy to report all is well again. Thanks for the post of this tool........saved my butt......
    5
    reboot nvrestore FIXED MY ROAMING ISSUE

    I'm not sure if this helps you at all, but I had a lost IMEI, had manually restored it (didn't have a valid backup) and was stuck in roaming. I went ahead and ran adb reboot nvrestore and the phone came back up with missing IMEI again.

    Another thing to note that I haven't seen discussed, which deals directly with the roaming issue, is that the "ERI version" is "None" when the IMEI is lost. On all the working GS3's I've looked at the "ERI version" is "5".

    well question is, does nvrestore also output to the screen when ran? if so, then it probably is not the case as I have yet to hear of anyone having there screen flasgh text after loosing a IMEI. Guess I need to test this quick ;)

    EDIT:
    Yep, restore outputs to the screen just like backup so unless its somehow executed in the background while the OS is running, this may not be the cause :(

    OMFG>... YOU GUYS ARE AWESOME.., I had the IMEI lost and then added it back.. was in roaming. I did the reboot NVRESTORE command from a terminal. The phone rebooted and then I could not get it to restart.. I pulled the battery and did a boot into RECOVERY. I did a NANDROID RESTORE of a backup I took.

    The PHONE BOOTED .. IT now shows I AM on Verizon Wireless and I have Roaming Turned OFF. THIS RESTORES you back to being NORMAL.

    Once Again It worked for me I HAVE my system looking NORMAL ... NO R or Triangle and Roaming is turned off. If you want I can send screen shots.

    Steps taken:

    1. Nandroid backup of current set up.
    2. Open Terminal enter su then reboot nvrestore
    3. Tried to boot up but was left on a black screen so I pulled the battery and booted into Recovery (vol up + home + power buttons).
    4. Restored the previous backup I had just done.
    5. Rebooted and turned off roaming after seeing that the phone is now finding Verizon Wireless and I get normal 4g and no R or Triangle.

    Again PROPS to you guys that have the time to research. Awesome.

    ---------- Post added at 01:32 PM ---------- Previous post was at 01:27 PM ----------

    Ziggy helped grep through kernel code - in /arch/arm/mach-msm/restart.c (http://git.ziggy471.com/i535.git/tree/arch/arm/mach-msm/restart.c) there's the following code for reboot reasons. Not entirely if you can just hit these reasons with something like -
    Code:
    adb shell reboot nvbackup
    -

    or if you have to hit it in fastboot (if you guys have it) with
    Code:
    fastboot oem reboot nvbackup

    but either may be possible to kick a stock backup with something similar. *use at own risk*

    Also if these nv reboot commands (nvbackup/nvrestore/nverase/nvrecovery) are just screwing you guys over instead of actually working, maybe kernel devs can patch them out? Or change them to boot into download mode or something similar so atleast people can track when something would have happened? Just throwing some ideas out there

    Code:
    	if (cmd != NULL) {
    		if (!strncmp(cmd, "bootloader", 10)) {
    			__raw_writel(0x77665500, restart_reason);
    		} else if (!strncmp(cmd, "recovery", 8)) {
    			__raw_writel(0x77665502, restart_reason);
    		} else if (!strncmp(cmd, "oem-", 4)) {
    			unsigned long code;
    			code = simple_strtoul(cmd + 4, NULL, 16) & 0xff;
    			__raw_writel(0x6f656d00 | code, restart_reason);
    #ifdef CONFIG_SEC_DEBUG
    		} else if (!strncmp(cmd, "sec_debug_hw_reset", 18)) {
    			__raw_writel(0x776655ee, restart_reason);
    #endif
    #ifdef CONFIG_SEC_PERIPHERAL_SECURE_CHK
    		} else if (!strncmp(cmd, "peripheral_hw_reset", 19)) {
    			__raw_writel(0x77665507, restart_reason);
    			printk(KERN_NOTICE "peripheral_hw_reset C777!!!!\n");
    #endif
    		} else if (!strncmp(cmd, "download", 8)) {
    			__raw_writel(0x12345671, restart_reason);
    		} else if (!strncmp(cmd, "sud", 3)) {
    			__raw_writel(0xabcf0000 | (cmd[3] - '0'),
    					restart_reason);
    		} else if (!strncmp(cmd, "debug", 5) /* set debug leve */
    				&& !kstrtoul(cmd + 5, 0, &value)) {
    			__raw_writel(0xabcd0000 | value, restart_reason);
    		} else if (!strncmp(cmd, "nvbackup", 8)) {
    			__raw_writel(0x77665511, restart_reason);
    		} else if (!strncmp(cmd, "nvrestore", 9)) {
    			__raw_writel(0x77665512, restart_reason);
    		} else if (!strncmp(cmd, "nverase", 7)) {
    			__raw_writel(0x77665514, restart_reason);
    		} else if (!strncmp(cmd, "nvrecovery", 10)) {
    			__raw_writel(0x77665515, restart_reason);
    		} else {
    			__raw_writel(0x77665501, restart_reason);
    		}
    	}
    #ifdef CONFIG_SEC_DEBUG
    	else {
    		printk(KERN_NOTICE "%s : clear reset flag\r\n", __func__);
    		/* clear abnormal reset flag */
    		__raw_writel(0x12345678, restart_reason);
    	}
    #endif

    OMFG>... YOU GUYS ARE AWESOME.., I had the IMEI lost and then added it back.. was in roaming. I did the reboot NVRESTORE command from a terminal. The phone rebooted and then I could not get it to restart.. I pulled the battery and did a boot into RECOVERY. I did a NANDROID RESTORE of a backup I took.

    The PHONE BOOTED .. IT now shows I AM on Verizon Wireless and I have Roaming Turned OFF. THIS RESTORES you back to being NORMAL.

    Once Again It worked for me I HAVE my system looking NORMAL ... NO R or Triangle and Roaming is turned off. If you want I can send screen shots.

    Steps taken:

    1. Nandroid backup of current set up.
    2. Open Terminal enter su then reboot nvrestore
    3. Tried to boot up but was left on a black screen so I pulled the battery and booted into Recovery (vol up + home + power buttons).
    4. Restored the previous backup I had just done.
    5. Rebooted and turned off roaming after seeing that the phone is now finding Verizon Wireless and I get normal 4g and no R or Triangle.

    Again PROPS to you guys that have the time to research. Awesome.
    4
    So, uh, anyone want to start a bounty to get TrevE an s3? I think the man deserves one!

    Sent from an overpriced Verizon tower.
    No doubt I think we should all pitch in. Between this thread and the synergy thread should have no issue drumming up enough donations to get TrevE this phone. That is if he wants it

    Sent from my SCH-I535 using Tapatalk 2

    Wow guys, pretty cool. I would never want to ask for something like this but if its something the community would like to do I wouldn't say no - it sure would make things easier (and I would appreciate it)


    -----------------------------------------------------------------------------
    So here's the most current up to date info:

    What we now have confirmed (because the synergy keyrestore.zip method works) is the issue is occurring in one of these following partitions.

    Code:
    [B]radio/nvdata partitions:[/B]
    13-modemst2 & 20-backup 
    12-modemst1 & 21-fsg 
    11-EFS

    The likely candidates are something is going bad modemst1/modemst2, one or both of these parts seem to be fusemounted(or something similar) to the EFS part (11). (see more here for EFS filesystem details)

    Anyway, my ongoing theory is this is happening one of two ways
    1. FSG & Backup contain a factory image and a new backup is never performed. A nvrestore somehow gets tripped and these partitions are copied over modemst1/modemst2 giving you a factory profile/imei.
    2. Actual corruption in modemst1/modemst2 (See GS2, they had EFS corruption issues on the EFS part). In this case the phone may just be able to run a nvrestore and fix IMEI from the backup partitions. There may just be no process for the phone to automagically do this.


    For reference, here are all the reboot codes and what they do:
    nvbackup == 0x77665511 - copy modemst1 to fsg partition and copy modemst2 to backup partition. sets param_header.nvdata_backup to 1
    nvrestore == 0x77665512 - copy fsg to modemst1 and copy backup to modemst2. checks to ensure param_header.nvdata_backup=1 first
    nverase == 0x77665514 - erase fsg and backup partitions. clears param_header.nvdata_backup
    nvrecovery == 0x77665515 - same as 0x77665511 but then reboots the device into RECOVERY_MODE



    So until the root cause is pinned down a bit more, I recommend the following. Following these backup steps exactly in this order gives you best chance of restoring, and it may cause you not to loose it in the first place. Please post if you loose your IMEI and have done a nvbackup

    Backup: (Script attached here)
    1. Run the below nvbackup command when you have a good IMEI. This will copy modemst2 -> backup and modemst1->fsg partitions. This is attempting to use stock functionality to protect yourself which should always be 1st.
      Code:
      adb shell reboot nvbackup
    2. Now that you have all 4 partitions in a state known to be valid (modemst1/2, fsg/backup) run the synergy backup script. This will create you a restore point that has the best possible chance of being restored. If you do not run the nvbackup step before the backup you cannot guarantee you will have good data in fsg/backup, and the IMEI issue could just reappear for you
    3. Optional Make a QCN backup. The above restore have been proven by a few users now, but if you want to be overly cautious do this as well for triple(?) redundancy.

    Please remember to protect your backup from step 2 (/sdcard/synergyrom/backup/keybackup_*.zip) its your failsafe if things go bad. Also note this data could be used to clone your phone if it got into the wrong hands so be safe

    Restore:
    You lost your IMEI and followed the above backup stuff, now what?
    first gather data - right now the following information would be helpful to the community. Go to Settings->About Phone->Status(No gs3, should be there tho) and write down your wifi mac address and bluetooth address. Hell just screenshot the whole page so you can compare before and after. Also eri prop data might be helpful - seems to be the "roaming issue" (skip the adb shell line if you use term)
    Code:
    adb shell
    getprop ril.eri_num
    getprop ril.eri_ver_1

    *Optional, but might be useful to the more advanced user* Before continuing run another Synergy_Backup_HWKeys_signed.zip. This will backup your data as is just so things cant get worse. Make sure you rename this backup to _bad or something - I heard CWM has issues with the datetime putting whack dates on the zip.


    Restoring IMEI- (Only follow steps until your phone is working again)

    1. Start with factory methods to restore your IMEI. Run the below command from shell When the phone comes back online, see if everything is good. If so rejoice and post here things worked. If not screenshot the IMEI page again in settings and continue on
      Code:
      adb shell reboot nvrestore
    2. ONLY IF ABOVE DIDN'T FIX YOU
      restore your known working /sdcard/synergyrom/backup/keybackup_*.zip file by flashing it in recovery. If it works rejoice and post here things worked. If not screenshot the IMEI page again in settings and continue on.
    3. ONLY IF ABOVE STILL DIDN'T FIX YOU
      try to nvrestore one more time. The keybackup.zip restores both the main and backup partitions, so theres a chance your stock backup will work now.
      Code:
      adb shell reboot nvrestore
    4. If you made it this far your really screwed - make sure you were working with a good keystore backup or else your on to QCN methods or IMEI injection if QCN fails