Root Accidental MEID change

[Goofee691]

So I made a backup of my old triumph with ddrescue in linux of the full device ie(/dev/sdc) in download mode and my dad wanted his phone brought back to stock vm so I restored that backup to his phone thinking the MEID was stored in the radio and access that would not be on the same flash but as it turns out restoring this image to the phone swapped his MEID to mine.

I need to change it back can anyone supply some help?

 

[Goofee691]

So it turns out that it also changed the wifi MAC address.

this is a serious security issue on the phone since anyone can make a exact clone of your phone in less than 10min all they need is access to the phone

 

[shmackshmack]

wow. that sucks.

why didnt you do it the easy way in CWM? you wanted to be all technically proficient and do it the hard way that i havent seen documented.

there is a process of restoring roms thats known to work, thats why its the most common way to do it. should have done that.

message brought to you by Captain Hindsight

edit* CDMA workshop might be able to flash a new mied to the phone, you would have to know the old one, but I suspect its written on sticker under the battery. I have no idea about the mac address though. yeah, just looked on the sticker under my battery, its not there. if you didnt already know it, thats going to be tough to figure out.

 

[marc12868]

I found this forum where someone had deleted there mac address off of there tablet or something like that... Anyways hope this will help you. And you should be able to restore your meid through QPST or #program## (#776426##) And change it in there... For both you need to be on a stock rom and have your msl/spc.

 

[Goofee691]

I didn't do it to be technical, I did it this way so that if I had a issue I could restore the phone to a untouched state to return it which I had done with my own phone which the backup was made from. this being the case I know longer own the phone that I ended up making a clone of and can't seem to grab the MSL code to try to recover it. I'm going to attempt to clone my current phone to this phone as I should be able to get the MSL from my working phone and then be able to reprogram it.

It will be interesting to see if in the process I get a fully functional clone of my phone.....

 

[marc12868]

I didn't do it to be technical, I did it this way so that if I had a issue I could restore the phone to a untouched state to return it which I had done with my own phone which the backup was made from. this being the case I know longer own the phone that I ended up making a clone of and can't seem to grab the MSL code to try to recover it. I'm going to attempt to clone my current phone to this phone as I should be able to get the MSL from my working phone and then be able to reprogram it.

It will be interesting to see if in the process I get a fully functional clone of my phone.....

I wouldn't be too surprised... If you flashed over all your system information through QPST... QPST is a pretty powerful program... Also I can almost guarantee that you won't be able to activate the "clone" as it would have the same info as the original and would be verified as already being activated as the original... So if you want the "clone" activated you are going to have to change the meid...

 

[Goofee691]

I would think that in theory the clone would be already active as my phone so if mine is off it would work as if it was mine.

in any case the whole reason for cloning it to mine is to then get my MSL code to reprogram it to what it should be.

as for reactivating a phone that thinks its not active on the network it is totally possible as when I used the backup on the phone that the backup was made from on first boot the phone was inactive and needed to be reactivated to the network.

so hopefully using my phone I can bring the phone back to its real MEID and MAC addresses. I already have QPST but I just need the MSL to do anything. on the bright side if I mess up in QPST I know I can restore it using download mode.

also while doing this I'm going to try to ID what partition actually contains all this information as it might be important if someone messes up in QPST trying to change their PRL. I still don't get why the phone has 17 partitions

 

[Goofee691]

So new news, aparently my phones internal flash is 2MB bigger than the phone I messed up..... however my old phone and the messed up phone have identical flash sizes here are the partition layouts of the stock VM 2.2 phone and my current phone running CM7

VM:

CM7:

 

[Goofee691]

So I was unable to do a full clone as for some reason the system partition became invalid however once I restored the stock VM backup from cwm the phone was fully functional, I even made a phone call with it, browsed the web and sent and received a text message.

now I just need to get my MSL code and I should be golden to get the phone back to where it needs to be

 

[shmackshmack]

I didn't do it to be technical, I did it this way so that if I had a issue I could restore the phone to a untouched state to return it which I had done with my own phone which the backup was made from. this being the case I know longer own the phone that I ended up making a clone of and can't seem to grab the MSL code to try to recover it. I'm going to attempt to clone my current phone to this phone as I should be able to get the MSL from my working phone and then be able to reprogram it.

It will be interesting to see if in the process I get a fully functional clone of my phone.....

my point was that since the triumph can boot into download mode to replace the recovery (its easily the simplest recovery swap method, drag and drop, no adb, nothing) and that the recovery itself can back up the stock rom without root, why would you ever need to do it any other way?

should have backed up stock rom with custom recovery for when its needed, restore it, then swap recovery back to stock in download mode. that would get you to a pure untouched state, especially if you backed up the stock rom before you root it, since it CAN be done.

just saying, there was no reason for you to do it any other way than that, thats why your in this mess hahaha

anyways, ill be watching the thread to see how it gets fixed, looks to be an interesting read.

 

[Goofee691]

Well right now I'm at a standstill at trying to restore the phone as I was unable to get my MSL with this method How to EASILY get your MSL Code on Motorola Triumph - xda-developers and it seems the snoop page is no longer working. I might try calling VM and see if I can get them to give it to me since I am now working on a phone that I do in fact own unlike the one I returned.

in the meantime I may try to figure out what partition contains the MEID

it is my own stupidity that got me here but in the long run this may be helpful to others. now that I'm thinking about it maybe the PRL is located in its own partition which could make updating it very easy since you would no longer need the MSL or QPST

 

[rb64]

Re: getting msl via aLogcat app

As long as you're running the stock rom, this method works perfectly

 

[Goofee691]

it gives me a error when I try to use 000000, and if I try it a second time the phone shuts off and reboots

 

[marc12868]

it gives me a error when I try to use 000000, and if I try it a second time the phone shuts off and reboots

make sure you run aLogcat and do the "sec_code" filter I believe then typ #program## (#776426##) type in 000000 when asking for the spc it will give you an error (since your spc/msl isn't 000000). go back into aLogcat and under "sec_code" there should e a 6 digit number that is your spc/msl.

 

[Goofee691]

well for some reason the filter did not work. when I actually looked at the logs without the filter I saw the code so we shall see what I can accomplish in qpst

 

[Goofee691]

So my dad got another phone to replace his since I couldn't get the MEID back. however I started on my quest to find out more information about the partitions.

as for his new phone, it has yet and even smaller flash size than the other 3 and this time I could tell where the size was taken out of, the userdata partition.

I also updated the prl to a new version so I could tell when I hit that partition by copying over one by one the unknown partitions from my CM7 phone.

partitions 2 and 3 did nothing to the phone that I could tell, 4 is the extended partition holding more and partition 5 from what I can tell holds boot data as the boot splash changed when I changed it. partition 6 threw the phone into 3 boot loops after getting to the main lock screen but then let me use the phone.
partition 13, 14, 15, 16, 17 sent the phone into 5 boot loops till I reverted it back

when I copied partitions 6, 13, 14, 15, 16 and 17 to the phone it then was fully functional with my phones MEID and the old PRL so I am guessing that their is some check amongst the partitions to make sure they all match with the radio

 

[Goofee691]

Here is the partition layout of the new phone.

 

[Goofee691]

now that I have 2 phones with a full stock(never booted) backup I should be able to do a bit for bit compare of each partition that I don't know what is contained to maybe ID what is where

 

[Goofee691]

well I did try to find out stuff but looking at it in a hex editor is way over my head and my dad decided he wants to use both phones one with stock Froyo and the other CM7 while only keeping one on at a time. since they are clones(radio info) it works without a problem

 

[Chairshot215]

There are a few utilities floating around to add an IMEI number to Tablets like Nook and Kindle after flashing a Rom because some apps do not work without one. You can try this one for the Kindle only replace the fake number with your number before writing it to the device. It may just work. I believe there may be a mac address tool included also.

http://forum.xda-developers.com/showthread.php?t=1436486

Actually I just read the post again for the first time since using with my Kindle in December and I am now not so sure it will work for you.