So far this fix has worked on several Note 3 models: SM-N900V, sprint SM-N900P SM-N900R4, N9005, N900T, and Claro Puerto Rico SM-N900W8
I lost my IMEI after sending command "reboot nvbackup" Phone rebooted into bootloops, was stuck for over 6 weeks. I was able to get everything working again after restoring "FSG", and "backup" mounts from a good SM-N900V DE phone. FSG is not an EFS copy in our Note 3's. Samsung left in a command that will brick these phones. Samsung is negligent by leaving this kill command in Note 3's.
The command "reboot nvbackup" will brick Note 3's, (and S5's). Mine is a verizon model SM-N900V Developer Device. I studied block partitions, and searched for weeks. I started looking at "FSG" and "backup" partitions since "reboot nvbackup" writes partitions modemst1 and modemst2 to Backup and FSG. In other phones this makes a backup copy. "reboot nvrestore" would restore bad modemst's mounts. In Note 3's FSG partition is a system partition. Reboot nvbackup overwrote FSG. My blocks were obviously corrupted.
A friend of mine with a DE and sent me his "FSG" and "backup" partitions, so I could compare backup-mmblk0p17 and FSG-mmblk0p18. FSG is not a "golden copy of efs in Note3', and "Backup" partition should be completely empty.
My FSG was corrupted with efs backup "IMGEFS1". The "backup" partition was filled with IMGEFS2. "reboot nvbackup" caused the toxic condition.
I simply copied and pasted both clean mounts into my /dev/block/ replacing the corrupt ones. I didn't even have to reboot, the MEID, PRL, and MIN all instantly showed up in the status screen after pasting FSG. The note 3 is Back 100%.
This is a specific problem to note 3's caused by performing "reboot nvbackup" on newer Samsung phones that use FSG in the operating system. this partition is very interesting. For those of us that entered this command, or ran efs backup software that called up this command, and then there phone immediately rebooted into endless boot loops. This procedure might work to get your IMEI / MEID back too. I am guessing that the Verizon note 3 FSG is identical in all US Qualcomm note3's. I hope someone will help me confirm this by checking their MD5 on their FSG mount. The command "reboot nvrestore" will probably corrupt modemst1 and modemst2 too. I'm not gonna try it
Clean copy of FSG (mmcblk0p18) MD5 221daabe2e089699626e4b22606ad621 (folks with working note 3's please verify this check sum and post your model and MD5, You should have a backup anyway, the latest EFS Professional is now compatible with our snapdragon note 3's.
Backup mmcblk0p18 and the MD5 can be copied (Ctrl + C) directly from EFS Professional.
These "TOXIC" commands should not be in our note 3's, or S5's, shame on you Samsung!
EFS Professional has been updated so These important partitions can be backed up very easily, link below
Important partition that could save us note 3 owners:
aboot -> /dev/block/mmcblk0p6
efs -> /dev/block/mmcblk0p11
modemst1 -> /dev/block/mmcblk0p12
modemst2 -> /dev/block/mmcblk0p13
fsg -> /dev/block/mmcblk0p18
Prior to my fix, I was able to get my phone to run for several minutes at a time after flashing AOKP T-mobile ROM. (They now have a unified build). This ROM let me get logcats, access to play store through wifi, and in the end was able to drop the clean FSG into /dev/block with root explorer. Without even rebooting I looked at the status screen to my amazement and read my MEID, PRL, ESN were all there!
Another tip, by entering safe mode (hold power down until note3 screen shows up, then hold volume down until fully booted). The Safemode watermark will be on bottom left corner of screen. Airplane mode and wireless off helped too.
Six weeks of hell and way over 300 hours learning about Android's FS, and severe hacking on my phone finally paid off.
Thanks to all that helped me, and this forum!
I will add more info later, so others hopefully will be able to recover from this. Time to play with my note 3
Please use a hex editor to confirm FSG and backup are corrupt (HxD Hex Editor is good). See attached thumbnails at the bottom of this post comparing good partitions on top and corrupt on bottom. FSG should have "IMGEFSG" in hex, not IMGEFS1x. Backup should be completely empty, all 00000, if block17 has any hex data it's been "Samsunged".
If you want help from me please do the following steps:
Using your recovery program's File Manager, copy mmcklb0p18 and 17 to your External sd, save them, change names to mmcklb0p18bak and **17bak. Then it will be easy to view the mounts in hex editor on your computer, and have backups just in case. Once you confirm they're corrupt please post your note 3 model, describe what triggered bootloops, and paste the first 4 lines of FSG hex code. This fix will only help those that had their note-3 FSG corrupted by "reboot nvbackup", or possibly while using an EFS backup program that calls the command (EFS by Boris or early versions of EFS pro).
Tips on how to backup and replace FSG
(Note: I have also looked at my S5 developer edition (ET-G900V) it looks like it is susceptible to being be bricked too. I also have a clean copy of S5 FSG)
Attached is my /dev system details:
adb shell
ls -lR /dev
I lost my IMEI after sending command "reboot nvbackup" Phone rebooted into bootloops, was stuck for over 6 weeks. I was able to get everything working again after restoring "FSG", and "backup" mounts from a good SM-N900V DE phone. FSG is not an EFS copy in our Note 3's. Samsung left in a command that will brick these phones. Samsung is negligent by leaving this kill command in Note 3's.
The command "reboot nvbackup" will brick Note 3's, (and S5's). Mine is a verizon model SM-N900V Developer Device. I studied block partitions, and searched for weeks. I started looking at "FSG" and "backup" partitions since "reboot nvbackup" writes partitions modemst1 and modemst2 to Backup and FSG. In other phones this makes a backup copy. "reboot nvrestore" would restore bad modemst's mounts. In Note 3's FSG partition is a system partition. Reboot nvbackup overwrote FSG. My blocks were obviously corrupted.
A friend of mine with a DE and sent me his "FSG" and "backup" partitions, so I could compare backup-mmblk0p17 and FSG-mmblk0p18. FSG is not a "golden copy of efs in Note3', and "Backup" partition should be completely empty.
My FSG was corrupted with efs backup "IMGEFS1". The "backup" partition was filled with IMGEFS2. "reboot nvbackup" caused the toxic condition.
I simply copied and pasted both clean mounts into my /dev/block/ replacing the corrupt ones. I didn't even have to reboot, the MEID, PRL, and MIN all instantly showed up in the status screen after pasting FSG. The note 3 is Back 100%.
This is a specific problem to note 3's caused by performing "reboot nvbackup" on newer Samsung phones that use FSG in the operating system. this partition is very interesting. For those of us that entered this command, or ran efs backup software that called up this command, and then there phone immediately rebooted into endless boot loops. This procedure might work to get your IMEI / MEID back too. I am guessing that the Verizon note 3 FSG is identical in all US Qualcomm note3's. I hope someone will help me confirm this by checking their MD5 on their FSG mount. The command "reboot nvrestore" will probably corrupt modemst1 and modemst2 too. I'm not gonna try it
Clean copy of FSG (mmcblk0p18) MD5 221daabe2e089699626e4b22606ad621 (folks with working note 3's please verify this check sum and post your model and MD5, You should have a backup anyway, the latest EFS Professional is now compatible with our snapdragon note 3's.
Backup mmcblk0p18 and the MD5 can be copied (Ctrl + C) directly from EFS Professional.
These "TOXIC" commands should not be in our note 3's, or S5's, shame on you Samsung!
EFS Professional has been updated so These important partitions can be backed up very easily, link below
Important partition that could save us note 3 owners:
aboot -> /dev/block/mmcblk0p6
efs -> /dev/block/mmcblk0p11
modemst1 -> /dev/block/mmcblk0p12
modemst2 -> /dev/block/mmcblk0p13
fsg -> /dev/block/mmcblk0p18
Prior to my fix, I was able to get my phone to run for several minutes at a time after flashing AOKP T-mobile ROM. (They now have a unified build). This ROM let me get logcats, access to play store through wifi, and in the end was able to drop the clean FSG into /dev/block with root explorer. Without even rebooting I looked at the status screen to my amazement and read my MEID, PRL, ESN were all there!
Another tip, by entering safe mode (hold power down until note3 screen shows up, then hold volume down until fully booted). The Safemode watermark will be on bottom left corner of screen. Airplane mode and wireless off helped too.
Six weeks of hell and way over 300 hours learning about Android's FS, and severe hacking on my phone finally paid off.
Thanks to all that helped me, and this forum!
I will add more info later, so others hopefully will be able to recover from this. Time to play with my note 3
Please use a hex editor to confirm FSG and backup are corrupt (HxD Hex Editor is good). See attached thumbnails at the bottom of this post comparing good partitions on top and corrupt on bottom. FSG should have "IMGEFSG" in hex, not IMGEFS1x. Backup should be completely empty, all 00000, if block17 has any hex data it's been "Samsunged".
If you want help from me please do the following steps:
Using your recovery program's File Manager, copy mmcklb0p18 and 17 to your External sd, save them, change names to mmcklb0p18bak and **17bak. Then it will be easy to view the mounts in hex editor on your computer, and have backups just in case. Once you confirm they're corrupt please post your note 3 model, describe what triggered bootloops, and paste the first 4 lines of FSG hex code. This fix will only help those that had their note-3 FSG corrupted by "reboot nvbackup", or possibly while using an EFS backup program that calls the command (EFS by Boris or early versions of EFS pro).
- confirm FSG is corrupt with hex editor,
- post your note 3 model, what triggered your problem, and the first 4 lines of hex from your **bak's to this thread. (first line using wordpad will work too)
- Then PM me for faster response.
- copy & paste the clean FSG to your /dev/block (You can use several methods to do this: TWRP or CWM's File Manger, or adb).
- Sip Iced Tea and enjoy your note 3
Tips on how to backup and replace FSG
(Note: I have also looked at my S5 developer edition (ET-G900V) it looks like it is susceptible to being be bricked too. I also have a clean copy of S5 FSG)
Attached is my /dev system details:
adb shell
ls -lR /dev
Code:
/dev/block/platform/msm_sdcc.1/by-name:
lrwxrwxrwx 1 root root 20 Jan 2 18:08 aboot -> /dev/block/mmcblk0p6 <-------aboot
lrwxrwxrwx 1 root root 20 Jan 2 18:08 apnhlos -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Jan 2 18:08 backup -> /dev/block/mmcblk0p17 <-----backup
lrwxrwxrwx 1 root root 21 Jan 2 18:08 boot -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Jan 2 18:08 cache -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 20 Jan 2 18:08 dbi -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Jan 2 18:08 ddr -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 Jan 2 18:08 efs -> /dev/block/mmcblk0p11 <------EFS
lrwxrwxrwx 1 root root 21 Jan 2 18:08 fota -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 Jan 2 18:08 fsc -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Jan 2 18:08 fsg -> /dev/block/mmcblk0p18 <-----FSG
lrwxrwxrwx 1 root root 20 Jan 2 18:08 modem -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 Jan 2 18:08 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 Jan 2 18:08 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 Jan 2 18:08 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Jan 2 18:08 param -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Jan 2 18:08 persdata -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 Jan 2 18:08 persist -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 Jan 2 18:08 recovery -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 20 Jan 2 18:08 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 Jan 2 18:08 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 Jan 2 18:08 ssd -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 Jan 2 18:08 system -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 20 Jan 2 18:08 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 Jan 2 18:08 userdata -> /dev/block/mmcblk0p25
#
Last edited:
