I have created this thread in order to have one thread that details just the solution to fixing your persist, identifying whether or not you have an issue with your persist, and how you can restore your IMEI without hacks. This guide is written for Motorola Moto G5 Plus (Potter). The issue also affects other models, e.g. G5, G5S, G5S Plus, but the guide appears to apply consistently to all of these models. Note that links in this thread are of course for potter.
For information on the history of this issue, refer to the following thread:
[dev][info] imei 0
IMPORTANT: There are a number of poor copy/paste jobs of parts of this guide floating around. Please link to this guide rather than posting only select parts of this (i.e. flashable zips, list of commands with no explanation). One of the lessons we all should have learned from this issue is to not just blindly follow guides because of "Hey this really works you should do it too trust me it works". The explanation and understanding is important, which is why I have taken the time to be as detailed as I have.
This thread is broken down into the following sections:
- Asking for help
- Pre-requisites
- How to tell if you have an issue with your persist, and if it is recoverable
- How to fix persist
- Explanation
Before starting though, there is one thing to keep in mind - for this to work YOU MUST HAVE YOUR OWN PERSIST. If you flashed someone else's persist, or a persist from another device, the fix will not work. Your only hope is to have a backup of your own persist that you can restore.
0) Asking for help
If you need to ask for help in following this guide (specifically about any problems you have trying to restore your persist and/or IMEI), please provide the following information (preferably copy/paste this into your post):
- Which version of STOCK rom are you on?
- Are you rooted, and running the commands under root privileges?
- Have you ever flashed someone else's, or another device's persist?
- What functionality are you missing and trying to restore (e.g. IMEI=0, VolTE, etc)?
- Do you get any error messages when trying to execute the commands?
Please also include the full output of the commands below. Ideally wrap the output in 'code tags' so it is nicely formatted
Update 2018-09-16
Now that stock Oreo is starting to roll out (ever so slowly...), it is an important point to note that you can now simply upgrade to stock Oreo to overcome the issue described in this guide. Stock Oreo changes the ownership of the relevant folders in persist on every boot.
TWRP flashable Oreo builds are available here [Oreo][Stock][Rom] TWRP Flashable Stock Builds. Do also read the first two posts in detail, as they also cover how to revert to stock Nougat, should you ever wish to move to a custom Oreo rom.
1) Pre-requisites
- You must currently be on a Stock Nougat ROM. Either the fastboot or TWRP flashable stock roms. You can get the latest TWRP flashable stock roms from this thread: [New][Stock][Rom] TWRP Flashable Stock Builds
- You must be using your own persist.
- You must have root access within the stock ROM. All scripts below MUST be run with root permissions
2) How to tell if you have an issue with your persist, and if it is recoverable
From a shell (either adb, or a terminal app on your device), type in the following commands:
The su command is to get root, and the 'ls' command lists details about the files in persist, including owners and permissions. On a fully operational persist, you will get a listing like this:
Code:
potter_n:/ # ls -l /persist
total 168
drwxrwx--- 2 system system 4096 2018-08-04 16:44 alarm
drwxr-xr-x 2 mot_pwric mot_pwric 4096 1970-01-01 12:03 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2018-08-04 16:44 bluetooth
drwx------ 2 root system 4096 1970-01-01 12:03 bms
drwxr-xr-x 2 mot_tcmd bluetooth 4096 1970-01-01 12:03 bt
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 2018-08-04 16:44 camera
drwx------ 6 system system 4096 2018-08-04 16:44 data
drwxrwx--- 2 system system 4096 1970-01-01 12:03 drm
drwxr-xr-x 5 mot_tcmd mot_tcmd 4096 2018-08-04 16:44 factory
[COLOR="red"]drwxrwx--- 3 rfs rfs_shared 4096 2018-08-04 16:44 hlos_rfs[/COLOR]
drwxrwx--- 2 root root 4096 2018-08-04 16:44 lost+found
drwxrwx--- 2 radio radio 4096 2018-08-04 16:44 mdm
drwxrwx--- 2 system system 4096 1970-01-01 12:03 misc
drwxrwx--- 2 system system 4096 1970-10-15 07:43 properties
drwxr-xr-x 8 mot_tcmd mot_tcmd 4096 2018-08-04 16:44 public
[COLOR="red"]drwx------ 6 rfs rfs 4096 2018-08-04 16:44 rfs[/COLOR]
drwxrws--- 2 mot_tpapi mot_tpapi 4096 2018-08-04 16:44 security
drwxrwxr-x 2 root root 4096 2018-08-04 16:44 sensors
drwxrwx--- 2 system system 4096 2018-08-04 16:44 time
drwxr-xr-x 2 mot_tcmd mot_tcmd 4096 1970-01-01 12:03 wifi
drwxrwxr-x 2 mot_drm mot_drm 4096 1970-01-01 12:03 wmdrm
The key here, is the rfs folder, and to a lesser degree, the hlos_rfs folder. Notice how the owner is rfs, and in the case of hlos_rfs, the group is rfs_shared.
Important - if you ran these commands from within an Oreo rom, you will see owners such as oem_2903 etc. These owners are valid for Oreo (custom or stock). The point of this guide is so that you know whether or not you have an ownership / permissions issue on Stock Nougat.
Additionally, if you run the following to look for files within persist:
You will see something like this:
Code:
potter_n:/ # find /persist -type f
/persist/sensors/sensors_settings
/persist/data/prov/eyBMMa7Jo5Dwo4LigJCHx3WxPUdQ9y8GJKIBae9bic
/persist/data/prov/prov
/persist/data/prov/prov.bak
/persist/data/prov/eyBMMa7Jo5Dwo4LigJCHx3WxPUdQ9y8GJKIBae9bic.bak
/persist/data/prov/T2pluw0BDr+EpzrrpM4aIMo1xKHY-DMHg3Uk3GF5yq
/persist/data/prov/T2pluw0BDr+EpzrrpM4aIMo1xKHY-DMHg3Uk3GF5yq.bak
/persist/data/widevine/Saljqyb2k7jJt0wZSxpXq0sdCZJH4urJjb-qcgkn7H
/persist/data/widevine/Saljqyb2k7jJt0wZSxpXq0sdCZJH4urJjb-qcgkn7H.bak
/persist/data/widevine/+CdCfjxBGljLnuTN7yCnhuY3WzhxbvHOjc-rac35xw
/persist/data/widevine/+CdCfjxBGljLnuTN7yCnhuY3WzhxbvHOjc-rac35xw.bak
/persist/camera/ledcal/rear
/persist/mdm/oma_dm_update
/persist/factory/regulatory/regulatory_info.png
/persist/factory/fti
/persist/public/hiddenmenu/data/mobile_data_rx
/persist/public/hiddenmenu/data/mobile_data_tx
/persist/public/hiddenmenu/data/wifi_data_rx
/persist/public/hiddenmenu/data/wifi_data_tx
/persist/security/18.bin
/persist/bluetooth/.bt_nv.bin
/persist/alarm/powerOffAlarmSet
/persist/alarm/timezone
/persist/alarm/powerOffAlarmInstance
/persist/time/ats_1
/persist/time/ats_2
/persist/time/ats_15
/persist/time/ats_12
/persist/time/ats_13
/persist/rfs/shared/server_info.txt
/persist/rfs/msm/mpss/datablock/id_00
/persist/rfs/msm/mpss/datablock/id_01
/persist/rfs/msm/mpss/server_check.txt
[COLOR="red"]/persist/rfs/msm/mpss/dhob.bin
/persist/rfs/msm/mpss/shob.bin
/persist/rfs/msm/mpss/dhob.bin.bak
[/COLOR]
The key files here are those in the /persist/rfs folder, mainly the dhob.bin file, which is used in creation of the EFS (i.e. the modemst1 and modemst2 partitions).
If you do not have the files under the /persist/rfs folder, then you will not be able to restore your persist through this method. Also see post #3 for information on when you have a dhob.bin but no dhob.bin.bak.
Now, if you run the ls command on a 'bad persist', you will get the following output from the ls command:
Code:
potter_n:/ # ls -l /persist
total 208
drwxrwx--- 2 system system 4096 2018-08-05 11:48 alarm
drwxr-xr-x 2 mot_pwric mot_pwric 4096 1970-01-01 12:03 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2018-08-05 11:48 bluetooth
drwx------ 2 root system 4096 1970-01-01 12:03 bms
drwxr-xr-x 2 mot_tcmd bluetooth 4096 1970-01-01 12:03 bt
drwxr-xr-x 4 mot_tcmd mot_tcmd 4096 2018-08-05 11:48 camera
drwxrwx--- 2 system system 4096 2018-08-05 11:48 chargeonly
drwx------ 6 system system 4096 2018-08-05 11:48 data
drwxrwx--- 2 system graphics 4096 1971-01-22 16:48 display
drwxrwx--- 2 system system 4096 1970-01-01 12:03 drm
drwxr-xr-x 5 mot_tcmd mot_tcmd 4096 2018-08-05 11:48 factory
[COLOR="Red"]drwxrwx--- 3 2951 2952 4096 2018-08-05 11:48 hlos_rfs[/COLOR]
drwxrwx--- 2 root root 4096 2018-08-05 11:48 lost+found
drwxrwx--- 2 radio radio 4096 2018-08-05 11:48 mdm
drwxrwx--- 2 system system 4096 1970-01-01 12:03 misc
drwxrwx--- 2 system system 4096 1970-10-15 07:43 properties
drwxr-xr-x 11 mot_tcmd mot_tcmd 4096 2018-08-05 11:48 public
[COLOR="Red"]drwx--x--x 6 2951 2951 4096 2018-08-05 11:48 rfs[/COLOR]
drwx------ 2 root root 4096 1971-01-22 16:48 sds
drwxrwx--- 2 system system 4096 1971-01-22 16:48 secnvm
drwxrws--- 2 mot_tpapi mot_tpapi 4096 2018-08-05 11:48 security
drwxrwxr-x 2 root root 4096 2018-08-05 11:48 sensors
drwxrwx--- 2 system system 4096 2018-08-05 11:48 time
drwxrwx--- 2 media media 4096 1971-01-22 16:48 vpp
drwxr-xr-x 2 mot_tcmd mot_tcmd 4096 1970-01-01 12:03 wifi
drwxrwxr-x 2 mot_drm mot_drm 4096 1970-01-01 12:03 wmdrm
The lines above in red, show that the ownership of the rfs and hlos_rfs folders are numbers, i.e. they are unknown to the system. To resolve, we need to change the ownership.
3) How to fix your persist
To fix the ownership, use the following commands (use su if not in a root shell):
Code:
chown -R rfs:rfs /persist/rfs
chown -R rfs:rfs_shared /persist/hlos_rfs
ls -l /persist
Now when the ls command shows the ownership of the folders, you should see the correct ownership.
Fixing your IMEI if it was zero
If your IMEI was zero, reboot, and cross your fingers that you will have your IMEI back (Settings > About Phone > Status > IMEI information).
NEW - TWRP flashable Stock Persist Fix
I've created a TWRP flashable zip that does the above ownership fixes. The script has slight differences, it uses the AIDs (Android IDs) of rfs and rfs_shared in stock.
potter-stock-persist-fix.zip
4) Explanation
4a) What happened to persist.
To understand what happened, you need to know a few things about filesystem permissions in Linux. Files and folders have user and group ownership, and permissions. Examples of owners are the system, root, user, etc. Examples of permissions are read access, write access, execute access. The permissions are applied at three levels 1) the user, 2) the group, 3) everyone else.
@rachitrawat's investigation into the failures showed that the issue was relating to the persist partition, specifically some files dhob.bin etc that are under the rfs sub folder in this partition. Under stock, these files/folders are owned by a user called rfs, and have group ownership under a group also called rfs. Additionally, the permissions on these files/folders are limited - only the rfs user can read/write/execute these files. Other users, groups, or everyone else, cannot access the files.
Edit: This part here wasn't quite correct, it is fixed below. It kind of still applies, but only if looking from within TWRP (I wrongly assumed that TWRP had the same user names as Lineage, my bad!):
So something happened in the Oreo roms. If you flash and boot into an Oreo rom, and you look at the permissions/ownership, you will see exactly the same ownership patterns as stock. But there's a catch!
There was a change in the Oreo roms. If you flash and boot into an Oreo rom, and you look at the permissions/ownership, you will see that a user and group oem_2951 owns the rfs folder, and a group oem_2952 owns the hlos_rfs folder. Now this is a different name, but on its own, a different name does not mean different ownership.
In Linux, all users and groups are assigned an ID, i.e. a number. So for example, on my phone, the rfs user has ID 3012 under stock. In lineage oreo, the oem_2951 user has ID 2951. So something happened in lineage that changed the user IDs that are applied to the rfs folder.
If you look at the ownership of persist files/folders within TWRP, you will see that a STOCK PERSIST has the owner of the rfs folder as rfs_old. Similarly in TWRP, a LINEAGE PERSIST has the owner of the rfs folder as rfs. So TWRP is seeing owners differently again to stock and Lineage. Trying to run the above commands in TWRP will not fix the issue, as it will use ID 2951 for the user rfs, but we need it to be 3012 in stock (which TWRP sees as rfs_old).
In addition to the rfs folder, there is also another folder that is impacted - hlos_rfs. Its user owner is rfs, but its group owner if rfs_shared. A stock rfs_shared is shown as rfs_shared_o in TWRP. It appears that this folder is not as important in getting the IMEI back, but I have included the commands to restore ownership, to ensure there are no future errors.
4b) What happened to IMEI.
Despite the issue above, many people who flashed Oreo roms would have had no problems (other than I guess, bugs in the roms themselves). The change of ownership of the rfs folder didn't change the actual file content, so essentially all is intact. In fact, I verified that my dhob.bin and other files had the same md5sum in stock and lineage persist.
The issue of the IMEI changing to zero has only happened when people have flashed Stock roms. All of the guides that I have seen, have included the following commands (and equivalent commands have been included in the TWRP flashable stock builds as well):
Code:
fastboot erase modemst1
fastboot erase modemst2
The partitions modemst1 and modemst2 are your EFS. Normally, if your persist is pure stock, if either is erased, the modem re-creates them. But, referring to the above about permissions, if the rfs user (which is presumably used by the modem) cannot access the files (because the owner of the files is someone else, and the permissions on the files mean that only the owner can access them), then the modem cannot recreate the EFS, and the IMEI is left as zero.
4c) Restoring IMEI.
Changing the ownership of your otherwise untouched persist allows the rfs user to access those files. Rebooting will result in the modem checking the EFS, and when it sees that it is still blank, it will recreate the IMEI.
However, the dhob.bin file in persist is encrypted, and goes through some sort of hash check. You can only use your own dhob.bin to recreate the IMEI. This is why it is essential that you have your own persist, and no one else's will work.
5) Other info
Other things that may be good to know about this issue.
5a) Why did flashing another device's persist fix Volte?
Or rather, why did flashing another device's persist "fix Volte" at the expense of permanently breaking key functionality of your device?
Flashing another device's persist gave the impression of working, but most probably this was due to one thing alone - the permissions on the persist partition of Moto devices is similar. That is, other Moto devices have rfs and hlos_rfs folders, and the owner is the same (both in name and AID - Android ID).
So, after flashing a custom Oreo rom, then going back to stock, Volte would not work. However, if they hadn't erased modemst1/2 (EFS) they would still have IMEI, but other functionality would be broken (Volte, 4G, possibly others). Flashing the other persist changed the permissions to the right ones, and boom all of a sudden Volte worked. The regret comes after, when the user has erased EFS through an update or other flash.
XDA:DevDB Information
The Persist Project, Tool/Utility for the Moto G5 Plus
Contributors
NZedPred,
rachitrawat
Version Information
Status: Stable
Created 2018-08-05
Last Updated 2018-09-15
