[Guide][Technical]Restoring your device specific data (including Service Tag)

[TheManii]

Introduction:
See: Dell Streak 7: Partition Layout

The Streak 7 stores it's device specific data in partitions WP1 and WP2, which are partitions 23 and 24 respectively.

Due to the overzealous and blind use of NVflash, many Streak 7 users have overwritten their device specific data, this guide will document it's layout so you can regenerate some of the values stored in it.

You should NEVER modify WP1 and WP2 under normal usage, only partitions 2-21 should be modified, even then it is good practice to avoid modifying anything but the relevent partitions.

Requirements:

• A Streak 7
• A template p23.img and p24.img
• Ability to use a hex editor
• Understanding of hexadecimal addresses
• Understanding of how to use NVflash

As stated: this is a TECHINCAL GUIDE, if you do not understand how to use a hex editor and NVflash without relying on batch scripts, THIS GUIDE IS NOT FOR YOU.

WP1 Layout:

0x85  - 0x91:  Unknown version number
0x92  - 0x103: Picasso Number
0x521 - 0x543: PPID
0x548 - 0x554: Service tag
0x559 - 0x573: IMEI

WP2 Layout:

0x0  - 0x11: Wifi MAC address
0x16 - 0x27: Bluetooth MAC address

Values:

• Unknown version number - self-explanitory [Cannot be regenerated]
• Picasso number - use unknown, viewable in fastboot mode on 50x roms [Cannot be regenerated]
• PPID - self-explanitory [Listed on flap]
• Service tag - self-explanitory [Listed on flap]
• IMEI - self-explanitory [Listed on flap]
• Wifi MAC address - self-explanitory [Cannot be regenerated]
• BT MAC address - self-explanitory [Cannot be regenerated]

Notes:
INTENTIONALLY CHANGING YOUR IMEI IS ILLEGAL, DO NOT CHANGE IT UNLESS YOU ARE ATTEMPTING TO FIX IT
INTENTIONALLY CHANGING YOUR SERVICE TAG CAN BE CONSIDERED WARENTEE FRAUD
If you do not fully understand this guide you are not the target audience for it, this guide is for able users to repair other's devices.

 

[alchrisr01]

Good info

I am new to this device and have found flashing ROMs can really cause issue in the areas you described. I changed the service tag on ln220/pg23 but did not know about the other issues. I have checked the flap on my device and don't seem to see any IMEI number. Appreciate you sharing your knowledge. Could you explain a little more on this? I want to make the changes and reflash stock 2.2.2 for now. I got the box from Dell this week to send it back but I had rather not. Thanks

 

[TheManii]

If your service tags are still correct, dont ever flash p23/p24 unless it is the one dumped from your own device.

Is your a tmo one, and the imei isnt on the flap? I was only assuming it's on the flap, i havnt actually been able to compare the flaps from US4Gs and wifis

 

[stevedebi]

If your service tags are still correct, dont ever flash p23/p24 unless it is the one dumped from your own device.

Is your a tmo one, and the imei isnt on the flap? I was only assuming it's on the flap, i havnt actually been able to compare the flaps from US4Gs and wifis

I have the USTMO 4g, and the asset tag is on the flap - it is very small.

 

[alchrisr01]

flap info

Mine is a US wi-fi only bought at Staples. If you refer to an earlier post, I scewded the pooch when trying to manually install HC and wiped the memory with CWM. I flashed a TMO rom thinking it was the right one, later found the correct stock ROM and flashed it. I had never read anywhere about the information you provided about pg23/24. The only thing on my flap is the ppid (which is wrong on my ROM flash), service tag, some kind of E service number, model number, type, and fcc id that starts with an E. The later three are not on a white background like the others. There is also some sort of barcode. There is a thread about service tags being wrong after flashing, so I changed it using HxD. I would like to get the other entries fixed as well. I'm just a noob, but I ain't scared to try!

 

[TheManii]

Like on the post, the Service tag, IMEI and PPID are the only ones that can be regenerated as they're the only ones written down somewhere.

They're both written on that flap and on the retail box (as each box has that devices's unique info on the sticker.

The e service number isnt ever listed in p23/24, nor is the serial number ever listed on the flap/box.

The only reason some values cant be regenerated is because they were simply never written down anywhere, if you did in fact have the MAC addresses written down along with the other values, you could just plug them back in.

For P24 the only unique data is the mac addresses, the rest of the partition seems to be bit identical across all devices.

P23 is the main one, on top of the plaintext values, there's a couple fields in binary that are no zeroed, and are unique across devices. I havnt even listed those since I have absolutely no idea what they do/contain.

Without knowing how dell generates them in the first place you will never be able to fully regenerate them, the only right way would be to back up your originals and not ever update P23/24.

-----------------------------

Could you take a clear picture of your flap (or anyone that's on a 3/4g model), I only assumed the IMEI is there as the wifi ones seem to have a blank space on the label where you might be able to squeeze in the IMEI tag.

It SHOULD also be on your retail box as the IEMI on a barcode is usually how stores identify them when selling them.

 

[alchrisr01]

I will check my box when I get home in a day or so, will also get a pic of the flap.

 

[spinixguy]

You also might be able to get your mac address from your wireless router. I know my netgear shows the mac of the devices connected to the dhcp server.

 

[alchrisr01]

box pic

This is a pic of the box info. It is of course the same as on the flap. The fcc id shown here is the only item on the flap that is not printed on a white background.

If I am not mistaken, MAC adresses on the router are picked up from the connected device. So if the MAC address on pg24 is wrong the router just picks it up. The only way to find your correct address would be if you had some sort of router history file of devices that had connected and you had connected before you flashed a new ROM. I am definatly not an expert.

I have found the correct line to adjust for the ppid number but what about the imei number? If I send this back to Dell they could do a complete restore but they could see that I flashed and cancel me out, even though I told the tech I talked to that I flashed in an attempt to get running again. I had rather just fix it myself.

BTW, if it is not, then the original post on this thread should be stickied as mandatory reading before you flash. I thought I had read everything.

 

[TheManii]

You stated yours is a wifi model, so I dont even know why wifi ones have an imei stored in them, obviously it isnt actually used by the device since there's no modem (or is there? noone's ever taken apart a wifi s7 and checked the slot)

The mac: yes if your router has it's history, if it doesnt for any reason you're SOL.

The imei on wifi ones prob isnt checked at all unless something like the service tag looks wrong and they examine the entirety of p23. I would imagine they have factory tools that can pharse it and not simply look at it in a hex editor

The PPID is also device specific, but it's contents are partially unknown, it's
PPID: CN-<product number>-<unknown 5>-<unknown 3>-<unknown 4>-A00
The 3 unknown fields might be related to something, they might be serial numbers.

74261 is a common value for us wifis,
one of the ones I have a ppid from differs from yours by only the last 2 digits in unknown 4.
Getting entire historys of devices might provide more clues on generating the PPID (yes looking at the box will give you it, but I would be interested in knowing what it contains)

I still need shots from a 3/4G one, i assume their boxes/flaps list the imei (as the previous poster suggested that they did)

 

[STINGWRAY]

Thanks for the post, excellent. I have restored to stock following one of the other posts here & have the issue with Tag No. etc changing, so now I can sort it hopefully.

One question though, I noticed my Bluetooth Mac address is sequential to the wireless MAC address. Can others confirm this is the case on their devices, as I have found the Wireless MAc from my router history. If they are sequential it means the Bluetooth MAC can be sorted as well.

 

[TheManii]

For the s5 and apparently on the s7, the bt mac is the next hex digit after the wifi one, so if you have the wifi one just increment by one

 

[alchrisr01]

Glad you found your router history. I looked all through my Linksys router pages and can find nothing.

 

[alchrisr01]

more info on the subject

I am continuing to learn more on this subject. I found that in My Phone Explorer you can find the IMEI number along with a link that tells you exactly what it is. I wrote down the number as it was displayed and opened up the PG23 files and could not find anything that comes close to matching it. The correct lines show only 15 digits whereas the number shown in My phone Explorere is 16 digits. As my unit is a wi-fi only one I wonder if it needs an IMEI number at all. I opened PG24 and found that my bluetooth and wi-fi MAC addresses are the same. I was curious to see what the Tmo ROM I flashed contained and opend it. I was suprised to see that it ended with PG22. So I now know that I had all my information correct after I flashed that ROM and lost it after flashing the "original" ROM. As the OP stated, never flash PG23,24.

 

[alchrisr01]

new info

I changed the ppid and reflashed, just to try and get it back completly stock. When I connected to My Phone Explorer to sync, a new relationship had to be established. When I looked at the status, the IMEI number had changed and I think also the MAC address also but not sure. So these numbers must somehow be related. When you compare the ppid and the IMEI they are different numbers completely but changing the ppid on PG23 results in a change of the IMEI number.