General Firmware and Combination Firmware and FOTA Delta and CSC change and...

Search This thread

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
I will check EFS Folder...

And Backup few files...

Code:
D:\Android\ADB>adb shell
freshbl:/ $ su
freshbl:/ # cp -r -vv /efs /sdcard/Download
cp '/efs'
cp '/efs/biometrics'
cp '/efs/biometrics/meta'
cp '/efs/pdp_bkup'
cp '/efs/pdp_bkup/pdp_pers.log'
cp '/efs/recovery'
cp '/efs/recovery/mf_supplicant.log'
cp '/efs/recovery/history'
cp '/efs/recovery/dmesg.log.old'
cp '/efs/recovery/mf_supplicant.log.1'
cp '/efs/recovery/wifi_mf.log.old'
cp '/efs/recovery/dmesg.log'
cp '/efs/recovery/wifi_mf.log'
cp '/efs/recovery/extra_history'
cp '/efs/recovery/mf_supplicant.log.0'
cp '/efs/lpm_boot.log'
cp '/efs/cpdebug'
cp '/efs/cpdebug/node'
cp: /sdcard/Download/efs/cpdebug/node: Function not implemented
cp '/efs/Battery'
cp '/efs/Battery/batt_capacity_max'
cp '/efs/lpm'
cp '/efs/lpm/lpm_info.log'
cp '/efs/pfw_data'
cp '/efs/pfw_data/.reset'
cp '/efs/FactoryApp'
cp '/efs/FactoryApp/hist_nv'
cp '/efs/FactoryApp/batt_discharge_level'
cp '/efs/FactoryApp/max_current'
cp '/efs/FactoryApp/cal_date'
cp '/efs/FactoryApp/cisd_wc_data'
cp '/efs/FactoryApp/serial_no'
cp '/efs/FactoryApp/cable_detect_count_octa'
cp '/efs/FactoryApp/HwParamBattQR'
cp '/efs/FactoryApp/HwParamData'
cp '/efs/FactoryApp/baro_delta'
cp '/efs/FactoryApp/hw_ver'
cp '/efs/FactoryApp/asoc'
cp '/efs/FactoryApp/fdata'
cp '/efs/FactoryApp/cisd_data'
cp '/efs/FactoryApp/gyro_cal_data'
cp '/efs/FactoryApp/keystr'
cp '/efs/FactoryApp/air_command_wifi'
cp '/efs/FactoryApp/batt_cable_count'
cp '/efs/FactoryApp/prepay'
cp '/efs/FactoryApp/max_temp'
cp '/efs/FactoryApp/control_no'
cp '/efs/FactoryApp/batt_temp_charge'
cp '/efs/FactoryApp/test_nv'
cp '/efs/FactoryApp/factorymode'
cp '/efs/FactoryApp/HwPartInform'
cp '/efs/FactoryApp/HwPartSMDDate'
cp '/efs/FactoryApp/bia_data'
cp '/efs/FactoryApp/prev_batt_data'
cp '/efs/FactoryApp/jhist_nv'
cp '/efs/FactoryApp/hrm_eol_data'
cp '/efs/sec_efs'
cp '/efs/sec_efs/fraResult'
cp '/efs/sec_efs/sem_sk.dat'
cp '/efs/sec_efs/.ffw'
cp '/efs/sec_efs/ssp_data'
cp '/efs/sec_efs/sem_data'
cp '/efs/gatekeeper'
cp '/efs/lost+found'
cp '/efs/imei'
cp '/efs/imei/mps_code.dat'
cp '/efs/imei/prodcode.dat'
cp '/efs/imei/omcnw_code.dat'

For study etc...

And maybe really I try for CSC change in this way...

Best Regards
 

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Found nice Video about Screen timeout...

Code:
freshbl:/ # settings get system screen_off_timeout
60000
freshbl:/ # settings put system screen_off_timeout 1800000

Maybe not required root but works as it seems... in EVA8 Firmware.


Because it su x ... to move or tap or click every minute on this f.$%ing Watch to see the screen.

Best Regards
 
  • Like
Reactions: galaxys

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Maybe later usefull...

Code:
dd if=/dev/block/mmcblk0p1 of=/sdcard/efs_dump.bin


dd if=/dev/block/mmcblk0p3 of=/sdcard/steady_dump.bin


dd if=/dev/block/mmcblk0p5 of=/sdcard/param_dump.bin


dd if=/dev/block/mmcblk0p18 of=/sdcard/bootKernel_dump.bin


dd if=/dev/block/mmcblk0p23 of=/sdcard/vbmeta_dump.bin

Output looks like this on my SM-R870:

Code:
freshbl:/sdcard # dd if=/dev/block/mmcblk0p1 of=/sdcard/efs_dump.bin
16384+0 records in
16384+0 records out
8388608 bytes (8.0 M) copied, 0.259212 s, 31 M/s
freshbl:/sdcard # dd if=/dev/block/mmcblk0p3 of=/sdcard/steady_dump.bin
8192+0 records in
8192+0 records out
4194304 bytes (4.0 M) copied, 0.242779 s, 16 M/s
freshbl:/sdcard # dd if=/dev/block/mmcblk0p5 of=/sdcard/param_dump.bin
16384+0 records in
16384+0 records out
8388608 bytes (8.0 M) copied, 0.357223 s, 22 M/s
freshbl:/sdcard # dd if=/dev/block/mmcblk0p18 of=/sdcard/bootKernel_dump.bin
73728+0 records in
73728+0 records out
37748736 bytes (36 M) copied, 1.794212 s, 20 M/s
freshbl:/sdcard # dd if=/dev/block/mmcblk0p23 of=/sdcard/vbmeta_dump.bin
1024+0 records in
1024+0 records out
524288 bytes (512 K) copied, 0.023225 s, 22 M/s

Best Regards
 

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
About CSC...

In my Europe "country locked" I see this in Log... and in other files after Root...

Code:
androidboot.pow.param.offset=7340656 sales_code=EUX

EUX


Maybe I have chance to check what XAA have for real...

Hmmmmmmmmmmmm... this seems easy...

XAA CSC has XAA as "sales_code"...

Code:
androidboot.pow.param.offset=7340656 sales_code=XAA

productCode=SM-R870NZKAXAA
 
Last edited:

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Code:
freshbl:/efs # cd imei
freshbl:/efs/imei # ls
mps_code.dat  omcnw_code.dat  prodcode.dat
freshbl:/efs/imei # ls -a1l
total 28
drwxrwxr-x  2 root   radio  4096 2021-11-07 18:15 .
drwxrwx--x 14 system radio  4096 2021-11-07 18:03 ..
-rwxrwxr-x  1 radio  system    3 2022-07-17 15:03 mps_code.dat
-rwxrwxr-x  1 radio  root      3 2022-07-17 15:03 omcnw_code.dat
-rwxrwxr-x  1 system radio    14 2021-11-07 18:03 prodcode.dat

I will try to change the 3 files to XAA...


I did something like this...

Code:
D:\Android\ADB>adb push prodcode.dat /sdcard
prodcode.dat: 1 file pushed. 0.0 MB/s (14 bytes in 0.134s)

D:\Android\ADB>adb push omcnw_code.dat /sdcard
omcnw_code.dat: 1 file pushed. 0.0 MB/s (3 bytes in 0.045s)

D:\Android\ADB>adb push mps_code.dat /sdcard
mps_code.dat: 1 file pushed. 0.0 MB/s (3 bytes in 0.201s)

D:\Android\ADB>adb shell
freshbl:/ $ su
freshbl:/ # cd /sdcard
freshbl:/sdcard # ls -a1l
total 57967
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Alarms
drwxrws--x 5 media_rw media_rw     3452 2022-07-17 15:02 Android
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Audiobooks
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 DCIM
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Documents
drwx------ 3 u0_a115  u0_a115      3452 2022-07-19 02:59 Download
drwx------ 3 u0_a115  u0_a115      3452 2022-07-17 15:02 Movies
drwxrwxr-x 4 media_rw media_rw     3452 2022-07-17 15:02 Music
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Notifications
drwx------ 3 u0_a115  u0_a115      3452 2022-07-17 15:02 Pictures
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Podcasts
drwx------ 2 u0_a115  u0_a115      3452 2022-07-17 15:02 Ringtones


drwx------ 2 u0_a115  u0_a115      3452 2022-07-19 09:55 imei
-rw------- 1 u0_a115  u0_a115         3 2022-07-19 09:59 mps_code.dat
-rw------- 1 u0_a115  u0_a115         3 2022-07-19 10:00 omcnw_code.dat

-rw------- 1 u0_a115  u0_a115        14 2022-07-19 10:00 prodcode.dat


freshbl:/sdcard # cp prodcode.dat /efs/imei
freshbl:/sdcard # cp omcnw_code.dat /efs/imei
freshbl:/sdcard # cp mps_code.dat /efs/imei
freshbl:/sdcard # cd /efs/imei
freshbl:/efs/imei # ls -1al
total 28
drwxrwxr-x  2 root   radio  4096 2021-11-07 18:15 .
drwxrwx--x 14 system radio  4096 2021-11-07 18:03 ..
-rwxrwxr-x  1 radio  system    3 2022-07-19 10:06 mps_code.dat
-rwxrwxr-x  1 radio  root      3 2022-07-19 10:06 omcnw_code.dat
-rwxrwxr-x  1 system radio    14 2022-07-19 10:06 prodcode.dat
freshbl:/efs/imei # cat prodcode.dat
SM-R870NZKAXAAfreshbl:/efs/imei # cat omcnw_code.dat
XAAfreshbl:/efs/imei # cat mps_code.dat

Now I will reboot and check...

Then check Factory Reset...

A

It is visible after Reboot under Software (tap tap trick)... now Product Code ends with XAA instead DBT
 
Last edited:

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Sorry.

All other things I have tried failed.

Secret Codes and Activity Launch also failed on rooted SM-R870...


This is at the moment the only way worked for me to change CSC like I wish.


Rooting kills Knox/Warranty...

... and at the moment without connected USB cable not possible...


So if this really makes sense is another Question...

Still I hope somebody else find easy 1 Click Solution for all users...
Without Root.

Best Regards
 

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Funny.

For users from India with CSC INU simple CSC change possible via Code... look at this Thread:


I was able to change and try self... look at Video


Best Regards
 

Attachments

  • INU_CSC_change.zip
    1.4 MB · Views: 109
  • Like
Reactions: DerpSpears

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Wow...

Changed successfully in this way from INU to KOO:

No in KOO this Code not work...

Will check few other Codes...

I have logcat from INU... maybe I can check how this magic work...

Best Regards
 

DerpSpears

Member
Apr 21, 2021
32
6
India
Nokia 8
Xiaomi Redmi 6
Funny.

For users from India with CSC INU simple CSC change possible via Code... look at this Thread:


I was able to change and try self... look at Video


Best Regards
Hi with root how did you change to inu csc to do that?
 

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
@DerpSpears

Please look at this post:

With ADB and changing 3 files...

Maybe only 1 mandatory... Because allready known way in Android world...

But I am feeling more safe to change all 3...

Best Regards
 
  • Like
Reactions: galaxys

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
We have all this APK...

Question is only why for INU work this old Code for CSC change...

Best Regards

Edit 1.

Edit 2.

I will check what happens if I "uninstall"...

Code:
freshbl:/ $ pm path com.sec.android.app.parser
package:/system/priv-app/DRParser/DRParser.apk


Code:
pm uninstall -k --user 0 com.sec.android.app.parser


Looks like htis to me:
Code:
freshbl:/ $ pm uninstall -k --user 0 com.sec.android.app.parser
Success
 
Last edited:

adfree

Senior Member
Jun 14, 2008
9,862
5,835
Samsung Galaxy Watch 4
Meanwhile more Combination Firmwares leaked... examples for SM-R870

Code:
COMBINATION_FAC_FBR0_R870XXU1AVE2_FACFAC_CL24349936_QB52279853_REV00_user_mid_noship_MULTI_CERT.tar.md5

COMBINATION_FAC_FBR0_R870XXU1AVF1_FACFAC_CL24506647_QB53168108_REV00_user_mid_noship_MULTI_CERT.tar.md5

COMBINATION_FAC_FBR0_R870XXU1AVG1_FACFAC_CL24635223_QB53582221_REV00_user_mid_noship_MULTI_CERT.tar.md5

COMBINATION_FAC_FBR0_R870XXU1AVG3_FACFAC_CL24733448_QB54122854_REV00_user_mid_noship_MULTI_CERT.tar.md5

Best Regards
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Since Tizen...

    I have never any Watch nor Phone with eSIM.

    So I have 0 own knowledge about eSIM.

    All I "know" is eSIM is more joke... as easy to handle.

    I love my old SIM cards. I can hold them with my big fat fingers.
    I can cut them if they are tooo big after 20 years...

    eSIM sounds more pia... with all this Security Region Lock crap...

    Sorry, my private opinion.


    Best Regards
    1
    A

    I was able to fix my FOTA Update problem on my SM-R870 and my SM-R860...

    SM-R860 stupid me set something and disabled access to Recovery... only black screen...

    Long time ago I did something stupid...

    Only realized how deadly... as I was not able to finish Update to GVH2...

    Solution for my SM-R860:
    Bootloader unlock... this Reset param etc and Recovery is avalaible again...
    Then lock Bootloader again...
    Knox NOT dripped because nothing flashed...

    B

    My Update Problem with SM-R870 was deeper because rooted...

    Solution for me:

    Bootloader Lock
    Then downgrade via Odin to DUK1... via USB cable...

    Then FOTA worked...

    DUK1 ---> FVD4 ---> GVH2

    And my Root with help of Magisk 24.3 also work.


    C

    I have nothing tested under DUK1... not sure if same result. If flashed EVA8 files to my SM-R870... EVA8.

    But as FOTA work... correctly...


    This means sboot.bin downgrade really work.
    From EVA8 to DUK1


    Only as info.

    Best Regards
    1
    This video explains how to gain access to "non-supported" eSIM of independent carriers the world over
    Thank you. Would you mind to share or refer the link of the video please?
    1
    Thank you. Would you mind to share or refer the link of the video please?
    Sorry thought had added the link - find it here
    1
    i'm trying to launch but I haven't succeed with that
    shell am broadcast -W -a android.provider.Telephony.SECRET_CODE -d android_secret_code://9920
  • 5
    Looks like it could be harder since Tizen...

    A
    Stock Firmware for netOdin/Odin not available yet...

    B
    Combination Firmware not available yet

    C
    FOTA Delta File for study I have:
    Code:
    current_version=R860XXU1AUGE/R860OXM1AUGE/
    updated_version=R860XXU1BUH9/R860OXM1BUH9/

    D

    In this FOTA Delta file from SM-R860 I can see overview... from CSC... Region Code OXM:
    Code:
    csc_information=OXM
    
    ACR
    AFR
    ARO
    ASA
    ATO
    AUT
    BGL
    BNG
    BRI
    BTU
    BVO
    CAC
    CAM
    CHO
    CIS
    COO
    DBT
    DKR
    ECT
    EGY
    EUR
    EUX
    ILO
    INU
    ITV
    KOO
    KSA
    LTA
    LUX
    MEA
    MID
    MRU
    MWD
    MXO
    MYM
    NEE
    NPL
    PAK
    PEO
    PHE
    PHN
    ROM
    SEB
    SEE
    SEK
    SER
    SIO
    SKZ
    SLK
    SWA
    TGY
    THO
    TPA
    TPH
    TTT
    TUN
    TUR
    UPO
    UYO
    XAA
    XAC
    XEF
    XEH
    XEO
    XEZ
    XFA
    XJP
    XME
    XNZ
    XSA
    XSE
    XSG
    XSK
    XSP
    XTC
    XXV
    ZTO

    More things... comes... later...

    Best Regards
    5
    No idea when Full firmwares for study leak...

    Meanwhile to understand maybe more about funny Region... helpfull this Android App to check Firmware:

    It is possible to decrypt from Test Server...

    Then maybe more clear...


    OXM seems also for DBT ZTO and so on...

    A
    In theory linked FOTA Delta should work for AUGE DBT or SER or ZTO...

    Question is only how to update manually...

    B
    Roll out official could be in waves... but could be also more funny like we allready knows...

    We will see the future of GW4 support.

    Best Regards
    5
    Tiny progress...

    GFX Card is Nvidia GTX 460...

    I thought this is Samsung joke with G account...

    Anyway. I have Root access to this Image...

    So will do some stupid tests...

    Best Regards
    5
    Tiny progress...

    Searched in system.img... 3 GB File for text string:
    Code:
    sdk_gwear_x86

    27 hits... then I changed few of them and renamed...
    Now I see:
    Code:
    sdk_gwear_x05

    05 is inside:
    Code:
    # begin common build properties
    # autogenerated by build/make/tools/buildinfo_common.sh
    ro.product.build.date=Thu Dec 16 16:58:02 UTC 2021
    ro.product.build.date.utc=1639673882
    ro.product.build.fingerprint=google/sdk_gwear_x86/generic_x86_arm:11/RWD4.211013.004/8008904:userdebug/dev-keys
    ro.product.build.id=RWD4.211013.004
    ro.product.build.tags=dev-keys
    ro.product.build.type=userdebug
    ro.product.build.version.incremental=8008904
    ro.product.build.version.release=11
    ro.product.build.version.release_or_codename=11
    ro.product.build.version.sdk=30
    ro.product.product.brand=google
    ro.product.product.device=generic_x86_arm
    ro.product.product.manufacturer=unknown
    ro.product.product.model=sdk_gwear_x05
    ro.product.product.name=sdk_gwear_x06
    # end common build properties
    #
    # ADDITIONAL PRODUCT PROPERTIES
    #
    ro.build.characteristics=emulator,nosdcard,watch
    persist.traced.enable=1
    ro.com.google.ime.system_lm_dir=/product/usr/share/ime/google/wear_lms
    dalvik.vm.systemservercompilerfilter=speed-profile
    ro.product.vndk.version=30


    Okidoki:
    Code:
    ro.product.product.model=sdk_gwear_x05


    Need few attempts...

    But good I can edit system.img without crash... so no Hash check or something in this Direction...

    Edit 1.

    Step 1 done in funny riddle... puzzle...

    Need more time to correct the other props...

    Goal is to enter exact Playstore for GW4... and/or Samsung Apps...

    In Emulator on PC...
    5
    "We" have still tiny problems...

    My problemS

    A
    I have NO device nor plan to buy in near future...

    B
    + no full Firmware for Odin/netOdin nor study...
    + no Combination Firmware...

    C
    No Service Manual leak...

    D
    Community to find solution is sooooooo f. huge...
    This problem is not new... something like this I know since years...

    Feel free to find solution for us. :cowboy:


    Thanx in advance.


    No joke.

    Feel free to do something.

    Best Regards