• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root in need of a Data Done Right zv5 boot.img

I am not sure what changes VM made to the update, but the MAC address isn't stored in the boot.img though because everyone has the same one. If some device specific partitions are messed up, you might need to restore a backup of them. And if you don't have a backup, then I don't know what you can do. If the wrong MAC is caused by some wrong settings and the actual MAC is not corrupt, then perhaps restore/reset would help. Unfortunately, I don't have a DDR version to help you.
 
Upvote 0
No dice. I've got a Virgin and hers is DDR. I'm getting a Volt from Virgin (as replacement), so....
The problem was that if she tried to go on WiFi when I was on, it would kill WiFi for both of us (same MAC address). Also her data got wonky. There wasn't any APN or any other settings as such that were touched nor changed.
 
Upvote 0
I spent some time to take a brief look at your problem. I searched the raw hex bytes of my phone's MAC address in the internal flash memory. The byte sequence appeared in two places: in the "misc" partition and in the file /data/misc/wifi/WCNSS_qcom_wlan_nv.bin. Also, in the config file /data/misc/wifi/WCNSS_qcom_cfg.ini, the line "Intf0MacAddress=" contained the address as a hex string. Since the "data" partition can be wiped, I assume the MAC address has been put there by some setup/configuration mechanism. In fact, it seems they'd be replaced by a default version (which contains some default MAC address) in the boot-up script /system/etc/init.zetaw.wifi.sh.

So if I have to guess, some device-specific info was stored in "misc" somehow. Since your "misc" partition was zeroed when you recovered from the bootloop, the device lost its MAC address. I don't know whether "misc" can be recreated by some other mechanism. I don't have all the information. It's possible that radio.img and/or the stock recovery is responsible for device configuration but that didn't happen properly during the failed update.

So now, on your own phone, do you still retain your real MAC address? The first three bytes should be 0C:48:85, which indicates an LG device. If they're something like 00:0A:F5 or 00:90:4C, then they've become the default value and maybe that's why you have MAC address collision. Perhaps other people who have troubles with wifi connections after taking the update (and fixing the bootloop by zeroing out "misc") are experiencing the same issue.

I don't have enough time to dig deeper. So I can only suggest going back to stock as much as possible and try to make a successful update to see whether that puts the real MAC back. Failing that, you can try to put the correct MAC in the aforementioned "Intf0MacAddress=" line to see whether a config file edit would work.
 
  • Like
Reactions: HasH_BrowN
Upvote 0
@WarrantyVoider excellent find.
Mine is showing 00:90:4c, I'm also on Virgin mobile.
Ill take your findings and run with them. See what I can get out of it, then figure out if this is able to be reversed. I'm getting a Volt as a replacement from Virgin, so I need to send mine back within a week. Ill make a backup of the Tribute and start tearing it apart. I still have my wife's to examine (Data Done Right).

As far as I can remember, my MAC address was the same before I rooted. Although I'm not quite sure.
Assuming that I don't have the real MAC address, how can I re-obtain it? Is there a way to recreate it? Do I call "tech" support? We all know how forthcoming they are with information.

I'm going to have to tear into the update and see if the MAC address is getting set to default before or after the bootloop fix. Any suggestions on testing?
 
Upvote 0
My phone has 0C:48:85. If you look up the vendor info from that, you'd see that's LG. Is yours 00:90:4C:C5:12:38? That's the default value stored in the system partition. Everyone probably has the same one. So if multiple phones are using the default value, that probably explains the wifi connectivity issues. When the default WCNSS_qcom_wlan_nv.bin in "system" gets copied to "data" ("userdata" partition), something must have updated the MAC address to the real MAC because the copy in "data" should contain the a unique MAC. On my phone, the WCNSS_qcom_wlan_nv.bin in "data" indeed contains a different MAC than the one in "system". If the real MAC address comes from the value stored in "misc", it probably shouldn't be wiped.

Looking inside "misc", it seems there are other device specific data. Unfortunately, like I said, I don't have enough data to figure it out. If I have another unmodified "misc" image from another device, maybe I can compare it against mine to what's the same and what's different.
 
  • Like
Reactions: HasH_BrowN
Upvote 0
WCNSS_qcom_wlan_nv.bin - which line, there are 26?
Also how do I view properly? See photo
Screenshot_2015-10-08-12-30-02.png


Here is WCNSS_qcom_cfg.ini
Screenshot_2015-10-08-12-32-25.png

All of them are default. What type of garbage is this?? (Deep sigh of annoyance)
What are NV items line 40

Wow, this is a problem.
 
Upvote 0
Could a /misc partition from another device work? Say an LG Volt? I'm suppose to get in the mail today. If so I can pull it from that, being NIB (new in box). OR is there too many differences in makeup?
Maybe. There are probably some similarities. Engineers at LG/Qualcomm aren't going to make each new device completely unique and independent.

WCNSS_qcom_wlan_nv.bin - which line, there are 26?
Also how do I view properly?
Here is WCNSS_qcom_cfg.iniWhat are NV items line 40
View WCNSS_qcom_wlan_nv.bin in a hex editor. The value of MAC address starts at offset 0xA. There are 4 addresses, but it seems only Intf0MacAddress is used (one wifi adapter, I guess). NV items are probably values stored in the NV ram. If you google, you can read discussions about people accessing NV items to tweak settings. So it's possible the MAC (and other device specific data like IMEI) are stored in NVRAM, but I don't know how those values are used and accessed.

My /system/etc/init.zetaw.wifi.sh has 106 lines. 2 blank lines at end, with no reference anywhere leading to a MAC address. Only thing mentioned was restart and something with bluetooth.
I was talking about this code block:
Code:
  # Populate the writable driver configuration file
  #if [ ! -e /data/misc/wifi/WCNSS_qcom_cfg.ini ]; then
  rm /data/misc/wifi/WCNSS_qcom_cfg.ini
  cp /system/etc/wifi/WCNSS_qcom_cfg.ini \
     /data/misc/wifi/WCNSS_qcom_cfg.ini
  chown system:wifi /data/misc/wifi/WCNSS_qcom_cfg.ini
  chmod 660 /data/misc/wifi/WCNSS_qcom_cfg.ini
  #fi
  rm /data/misc/wifi/WCNSS_qcom_wlan_nv.bin
  cp /system/etc/wifi/WCNSS_qcom_wlan_nv.bin \
     /data/misc/wifi/WCNSS_qcom_wlan_nv.bin
  chown system:wifi /data/misc/wifi/WCNSS_qcom_wlan_nv.bin
  chmod 660 /data/misc/wifi/WCNSS_qcom_wlan_nv.bin


  # The property below is used in Qcom SDK for softap to determine
  # the wifi driver config file
  setprop wlan.driver.config /data/misc/wifi/WCNSS_qcom_cfg.ini

  rm /etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin
  ln -s /data/misc/wifi/WCNSS_qcom_wlan_nv.bin \
    /etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin

  rm /etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
  ln -s /data/misc/wifi/WCNSS_qcom_cfg.ini \
    /etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
Don't worry about it if you are not familiar with unix shell scripting. The script basically removes the copy in /data and copies the file from /system (the default one) to /data.

WCNSS_qcom_wlan_nv.bin is found at 3 locations. View attachment 95051
All with different dates and middle one a different size
The middle one is just a symlink to the first one. The third one (in /system) is the default I was talking about. The same one for everyone. The first one (in /data) should be the configured one containing device-specific data.

Anyway, the files in /data should be editable. Whether editing them fixes the problem or not, I don't know.
 
  • Like
Reactions: HasH_BrowN
Upvote 0
Thanks, I will try searching for NV tweaks for further reading.

So the portion of the script is part of the issue then. To bad there isnt a process step-by-step app/program, like Windows has on selective boot up (I forget what its called). Could scrutinize the update with exacting precision.

BTW, I really enjoyed read your thread, plus original thread about the SD hack/tweak. Can that be used on other devices? If so what changes need to be made?
If i have any other questions about your thread I'll post them there.

I got my Volt today. Rooted, TWRP, UNO kernel, my Adreno mod, and just disabled apps (no system bloatware removed just yet). What is the best command to get a perfect 1:1 copy of the /misc partition? And while I'm at it use it for the /fota too.
 
  • Like
Reactions: WarrantyVoider
Upvote 0
Re: my SD hack
I tried to make it as generic as I can, but some things aren't universal. I made and tested it on an F6. I also tested it on an old Nook Color I have. Other people have tried and used it on other devices, but some have reported troubles getting it to work. There are differences between devices/platforms. Without an actual device in my hand, I can't really help them troubleshoot.

Re: misc partition
I was checking something else, and saw this: https://source.android.com/devices/tech/ota/
misc
Tiny partition used by recovery to stash some information away about what it's doing in case the device is restarted while the OTA package is being applied.
So it's possible data in /misc come from somewhere else, and we can put things back, so to speak, to fix the problem. In my "misc" image, I've found MEID, wifi MAC, and another MAC-address-like byte sequence. If I treat that byte sequence as a MAC address, its vendor id would also be LG. Maybe that's the MAC used for cellular data?

Anyway, you'll probably get the update notification. Make a copy of "misc" before the update. Another after the update. Compare them. If you're willing to share, send both to me privately (since they contain device-specific data) and I'll check them against my "misc" image. The "fota" partition consists of all zeros on mine, so I think any piece of data it contains is temporary. If you want to see what it's used for, you can also save its image during and/or after OTA update.

To get the the image of /misc with ADB via TWRP:
adb pull /dev/block/platform/msm_sdcc.1/by-name/misc misc.img
The size for Tribute is 16MiB. Not sure about Volt. Probably the same.

To get it with dd in TWRP:
dd if=/dev/block/platform/msm_sdcc.1/by-name/misc of=/sdcard/misc.img
I'm assuming in Volt's TWRP the SD card is located at /sdcard. If not, change to the correct path.

For other partition (e.g. /fota), change the "/by-name/misc" part to "/by-name/fota" and the output name ("misc.img") to somthing else (e.g. fota.img).
 
  • Like
Reactions: HasH_BrowN
Upvote 0
@WarrantyVoider
So it's possible data in /misc come from somewhere else, and we can put things back, so to speak, to fix the problem. In my "misc" image, I've found MEID, wifi MAC, and another MAC-address-like byte sequence. If I treat that byte sequence as a MAC address, its vendor id would also be LG. Maybe that's the MAC used for cellular data?
Do I read the byte sequence with a hex reader/editor? I don't normally mess with type of stuff, but this is interesting. :)
 
Upvote 0
As far as the update on the Volt, I'm going to hold off. I edited settings for the stagefright fix. I just don't see anything beneficial from flashing it, plus its my daily driver now, aside from being able to get a copy of the /misc after update. If anything mucks up a restore won't help.
But I'm going to use the info, you have provided, to fix the MAC address on my wifes DDR LS660.
 
  • Like
Reactions: WarrantyVoider
Upvote 0
Do I read the byte sequence with a hex reader/editor? I don't normally mess with type of stuff, but this is interesting. :)
Yes. The wifi MAC is at offset 0x3000. The bluetooth MAC (duh, so that's what it was, not cellular data; I forgot about BT) is at 0x4000. MEID is at 0x6800 as a text string.

I am not sure if this works, but you might be able to take a peek on the phone in TWRP with:
hexdump -C /dev/block/platform/msm_sdcc.1/by-name/misc
 
  • Like
Reactions: HasH_BrowN
Upvote 0
I have a DDR LG volt from verizon.... i effed my phone up REAL good!

First thing to do is use a TWRP to wipe out ALL the memory partitions....
Then I used LG Flash tool and flashed the zv3 .tot
Boot it up, connect to wifi.
Let it do HFA, PRL and Profile update

Use LG one click root and root the device.
Install Link2SD and ES File explorer.

Get copies of the "ItsOnDashboard.apk" (a.k.a the default app "Virgin Mobile"), "ItsOnService.apk" and "ItsOnSprintProxy.apk" - I have backups of each if you need them.

Goto ES File Explorer and in the menu on the bottom, click Enable Root and Show Hidden. Then copy those 3 .apk files to the folder "app" located here: Device/carrier/itson/app

Use Link2SD to convert them to system apps. Reboot.

Install and Run the new System Apps.
Connected to Wifi: -LOGIN to your new Virign Mobile icon, Check for Updates, ect. Let that catch up. Then use your ##72786# -> The process should cycle HFA; PRL; Profile, again, just let it run.

Check your status after that.

If still not working, Shut off Wifi, Shut off Data and use ##DATA#
It will probably not let you Diasble "ItsOn" so "Disable eHRPD" instead. Let it reboot. Keep the wifi and data off.... Give it about 10 Minutes and Enable the eHRPD you disabled, and then after reboot, keep wifi off, and Turn on Data.

I have not had the DDR firmware on my Volt since day one. I never had any major problems at first, then the custom roms took it wonkers and i only had TALK and TEXT and wifi. LTE /3G were unable to reach the device. This was how i how i got it fixed.

You may have to throw a ##MSL" - Reset in there after, but thats if all that fails.
 
  • Like
Reactions: HasH_BrowN
Upvote 0
I have a DDR LG volt from verizon.... i effed my phone up REAL good!

First thing to do is use a TWRP to wipe out ALL the memory partitions....
Then I used LG Flash tool and flashed the zv3 .tot
Boot it up, connect to wifi.
Let it do HFA, PRL and Profile update

Use LG one click root and root the device.
Install Link2SD and ES File explorer.

Get copies of the "ItsOnDashboard.apk" (a.k.a the default app "Virgin Mobile"), "ItsOnService.apk" and "ItsOnSprintProxy.apk" - I have backups of each if you need them.

Goto ES File Explorer and in the menu on the bottom, click Enable Root and Show Hidden. Then copy those 3 .apk files to the folder "app" located here: Device/carrier/itson/app

Use Link2SD to convert them to system apps. Reboot.

Install and Run the new System Apps.
Connected to Wifi: -LOGIN to your new Virign Mobile icon, Check for Updates, ect. Let that catch up. Then use your ##72786# -> The process should cycle HFA; PRL; Profile, again, just let it run.

Check your status after that.

If still not working, Shut off Wifi, Shut off Data and use ##DATA#
It will probably not let you Diasble "ItsOn" so "Disable eHRPD" instead. Let it reboot. Keep the wifi and data off.... Give it about 10 Minutes and Enable the eHRPD you disabled, and then after reboot, keep wifi off, and Turn on Data.

I have not had the DDR firmware on my Volt since day one. I never had any major problems at first, then the custom roms took it wonkers and i only had TALK and TEXT and wifi. LTE /3G were unable to reach the device. This was how i how i got it fixed.

You may have to throw a ##MSL" - Reset in there after, but thats if all that fails.
But did it fix/correct a MAC address issue? That's the main issue/concern. My wifes DDR VM's Tribute reverted to a default Android MAC address.
 
Upvote 0

BEST TECH IN 2023

We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.

Smartphones