Quectel module adb key generation algorithm

Standard

Quectel 5G module, open adb, you need to enter a key to open

 

python:

import crypt

#sn = '18700338'
#sn = '40901409'
sn = '12741851'


def generateUnlockKey(sn):
    """
    @param sn: the serial number to generate an unlock key for
    """
    salt = "$1${0}$".format(sn)
    c = crypt.crypt("SH_adb_quectel", salt)
    print("Salt: {0}\nCrypt: {1}\nCode: {2}\n".format(salt, c, c[12:27]))
    return c[12:27]
    
    
xx = generateUnlockKey(sn)    

print(xx)


def old_key(salt):
    code = crypt.crypt("SH_adb_quectel", "$1$" + salt)
    #code = crypt.crypt("SH_adb_quectel", "$1$" + salt + '$')
    code = code[12:27]
    
    return code
       
       
yy = old_key(sn)    

print('jiandan=', yy)

 

c#”


using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    static void Main()
    {
        string sn = "12741851";
        string xx = GenerateUnlockKey(sn);
        Console.WriteLine(xx);

        string yy = OldKey(sn);
        Console.WriteLine("jiandan=" + yy);
    }

    static string GenerateUnlockKey(string sn)
    {
        string salt = "$1$" + sn;
        string key = GenerateHash("SH_adb_quectel", salt);
        string code = key.Substring(12, 15);
        Console.WriteLine("Salt: {0}\nCrypt: {1}\nCode: {2}\n", salt, key, code);
        return code;
    }

    static string OldKey(string salt)
    {
        string key = GenerateHash("SH_adb_quectel", "$1$" + salt);
        string code = key.Substring(12, 15);
        return code;
    }

    static string GenerateHash(string password, string salt)
    {
        using (var rfc2898 = new Rfc2898DeriveBytes(password, Encoding.UTF8.GetBytes(salt), 10000, HashAlgorithmName.SHA256))
        {
            return Convert.ToBase64String(rfc2898.GetBytes(20));
        }
    }
}

Xiaomi Qualcomm EDL Authentication Exploit + Loaders

Standard

Exploit for bypassing Xiaomi Qualcomm Devices Authentication in EDL Mode

how is work?

when writing firehose loader in EDL Mode, device requests AUTH to continue operation

in this solution, exist function for bypassing auth request of device to continue any operation in EDL Mode (like frp, mi account bypass, flash , read, write, erase)

Some of the devices on which it has been successfully tested are as follows:

phone models not limited for this list, can be support more models

MI 10_umi
MI 11 Lite 56 (lisa)
Mi 11 Pro Ultra
Mi 11 Venus
Mi10T 5G 10T Pro 5G Redmi K30S apollo
Note 5 pro_whyred
Note 11 NFC Spesn
Note 11 Spes
Pocophone M2 Pro (Gram)
Pocophone X3 NFC surya
Redmi 10C power
Redmi K40 Pro
Redmi K40 Pro+
POCO F3 Pro Mi 11i
Redmi K40 POCO F3 Mi 11X (alioth)
Redmi Note 9 Pro (joyeuse)
Redmi Note 9 Pro Max (Excalibur)
Redmi Note 10 sunnym,mojito
Redmi Note 12 4G (tapas)
Redmi Note6 Pro Tulip
Mi 9
Mi 8
Mi 9
Note 9s
Redmi 7
redmi 8_olive
Redmi 9T_Redmi 9 Power
Redmi Note 9 4G
Redmi K20 Pro Mi 9T Pro
Redmi K40S POCO F4 (munch)
Redmi Note 8T ginkgo
Redmi 6Pro
Redmi Pro Sakura
Redmi 7A Pine
Redmi K20 Mi9T Davinci
Redmi Note7 Lavender
Redmi Note8 Ginkgo
Redmi S2 Ysl

To get source code and solution contact us in telegram: https://t.me/GsmCoder

algorithm for Calculate NCK Code from imei number

Standard

NCK Calculator Code from IMEI

 

with this algorithm,  you can calculate Network Control Key (NCK) Code from IMEI of device

How is work? (Video):

 

To get source code and solution contact us in telegram: https://t.me/GsmCoder

What device supported?

Azumi

L4K , V4 , K242 , A4 , A4 GO , L4Z , L3Z , Speed V5+ ,
A35s , 5 plus , 5 , V4 , Q15 , Q10 , LT40 , L2Z , Chic , A5 Plus 

Tecno

SA2S , RB2S , SC6S , SC7S , RB7S , SA7S , RB6S , RB8S ,
SPARK 7 PRO , Camon 17P (CG7) , CG7 , Pop 2x Plus ,
Pop 2x Air , Pop 2 mini , Pop 2 , RA8 , N11 , RC6 ,
N11 , N13 , SPARK 7 (PR651H) , T920D , R7 Plus , KG5K,
Pop 7 Pro [BF6] - (1 Credit )

Itel

A14 , A23S , A23 , AC60(L6004l) , AC13(W4001P) , VISION 1 PRO ( L6502 ) ,
W4001 , W5004D , A16 Plus , A16 , A48 , AC33 (MTN) , AC32 (MTN) ,
P36 PRO , A37 , A571W , L5007S , V51 LTE , W4001S , V41 , L6006F ,
L6502 , V51 , V41 LTE , A2160S , V14 , it1407 , AC50 , itel A05s 4G, itel A18, itel V52 LTE

Hurricane

Pulse , Vortex , Ultra , Link , Iris Plus (2021) , Storm (Gold) , T10 TAB , Curve , H61

Hisense

U40 (HLTE228E) , U30 (U606.10-DF) , U50 , U605 , Infinity E50 Lite , E50 Lite , (HLTE228E) ,
U963 , (HLTE228E) , H30 , E40 , Infinity E30 Lite , U605DF , U40-HLTE103E , U963 (HLTE100) ,
U30 , U963 (HLTE100E) , U40 LITE , E31 , E50 , E31 lite , E30 , HLTE102E , 606 , HLTE105E ,
HLTE105E , HLTE232E , HLTE229E , U50 lite , HWCD100E , H30 Lite , H40 Lite , M50 Lite 2021 ,
H50s 5G , U8 , H12 Lite , H50 Zoom , H60 5G , H50 Lite , U972 , E60 LITE , E60 LITE (HLTE235E) ,
V40 , U965 (2020) , U964 All Variant , U963 All Variant , U962 (2020) , U8 (U605) , W500 4D (AC33) ,
W4001S(V41) , E32 PRO , [HLTE242E] , E32 Lte , U50 Lite ( HWCD100E ), U60, U60 Lite, HLTE262E , E70 ,
E33 , HWCD108E , U70 , U607, M50-LITE, E30 SE, E30-LITE, E32-lite, E40-LITE, E60, H40, H40 ROCK, H50,
U606, Hisense U61, HWCD1118E

Smart Vitochi

L4K , Condor , Zantel-FP78L-Z , Tigo Smart 4G -[FP789L-T] , Tigo Smart 3G -[F789L-T] 

Stylo

S40 Life , LIFE DHP99 , Life 2 Network , Bold Plus Bold DDJ18 , Stylo S40 Life ,
Stylo S40 Life CQY88 , BRAVE ( DHR22 ) , DRB45 , Step Up ( DRB46) V05 , 721 Pro (DRB42) ,
721 (DFM64) , 222 (DFM48) 

Mobiwire

Vibe 4G , Vibe 3G , Kicka 4 plus 4G , Kicka zoom (H5024) 4G , Kicka zoom 4G , Kicka zoom (H5024)
, Kicka 5 Plus 4G , Kicka 4 Plus , Kicka 5 Plus (H5032) 4G , Kicka 5 Plus , Kicka 5 (H5062) ,
Kicka 4 Plus (H4023) , Kicka 5 (H5062) 4G , Kicka 4 Plus (H4023) 4G , Kicka 6 Plus , KICKA 5 ( H5068 ) ,
Nokosi , Doli 2 , Ogima 

Mobicel

Berry , Beam , Legend , Fame , Fendy , Hero , GEO , Rubby , Force , TRENDY 2 , Epic Dual ,
Force Plus , Cosmo LTE Dual Sim , S1 , Epic Pro Dual SIM , Titan, Epic Pro Dual SIM 32GB

Premio

S51 , S53 , P90 

Movitel

M9108 , M9110 , M8416 , M8422 , M8423 , M8424 , M9106 , M9107 , M9109 

Safaricom

Ray 2 , Neon Ray Pro (V1.0) 

Vodafone

VFD-210 , VFD-200 , VFD-320 

Wiko

Sunny 2 , Sunny 3 , UFeel , SunSet , Y80 (V720) , Fever , Freddy , Jerry , Lenny , Harry 2 ,
Tommy 3 Redmi note 11 , W-V600 , Y80(V720), Y62 (W-K610), WIM Lite, View3 Pro, View2 Pro,
View2 Plus, View2 Go, View XL, View Prime, View Max, Upulse lite, U Feel Prime, U Feel Lite,
Ufeel fab, Ufeel go

Imo

M23 , Orange , DASH-UK 

Sky

4.0s , 4.0T , 6.0 , 5.0LT , Elite 4.0S, Fuego 4.0T

Blue

C5L , J7L , 8Ml , M8L 

MobiGo2

MobiGo 2 , MobiGo2 Airtel , Mobigo2+, Mobigo2P

Faiba 4G

Wonder ( L2407 ) 

TNM

Mobigo 2 (TNM) 

Digicel

DL3 , DL4 , DL3 PRO 

verykool

S5005, Lotus II

Oysters

Arctic 450

To get source code and solution contact us in telegram: https://t.me/GsmCoder

SAMSUNG MTK MT67xx LD0B_001 key and algorithm

Standard

in Mediatek chipset device, imei region is in NVDATA partiton >LD0B_001 file

for getting IMEI Slot1 and Slo2 of mediatek device we have to parse LD0B_001 file from nvdata partition, for this operation we must have key + algorithm of this file

we already shared post about LD0B_001 for generic device, you can read about this here

so what is diffrent in SAMSUNG device

KEY of LD0B_001 SAMSAUNG device is diffrent than of Generic devices

in this solution We will send you key + source code for read and parse IMEI Slot1I, Slot1 from LD0B_001  +source code for remake LD0B_001 with your custom IMEI Number , so you can read or repair imei of device by this solution

basicly this is algorithm of NVDATANvram, just samsung devices like OPPO/XIAOMI required patch cert after imei repair (we no have this solution yet)

To get source code and solution contact us in telegram: https://t.me/GsmCoder

c++\QT qualcomm diagnostic source code

Standard

Qualcomm diagnostic tool source code is ready for c++\QT

this is best and full source code for qualcomm diagnostic for C++\QT

for some device with qualcomm chip, cannot repair imei with diagnostic, because imei parameter in qcn of device is Ready-Only , in this source code , included EFS Method for repair imei so by this feature, you can bypass easy protection of imei and repair with EFS feature

follow Test video:

Features exist:
1- Repair IMEI1,IMEI2 [EFS Method, Normal method]
2- Repair MEID, ESN
3- Write and Restore QCN
4- Read information
5- using custome SPC , PWD

Screenshot from Code:

screenshot from UI:

 

video of how is work:

 

CDN for downloading Xiaomi firmware

Standard

The CDN for downloading Xiaomi firmware has a speed limit.
It is said that a group of people who work on PCDN deliberately increased the downlink traffic in order to reduce the proportion of their uplink traffic. The download address of Xiaomi firmware is easy to obtain, so a lot of traffic was used.
In fact, it is useless. Now the operators do not look at the proportion, but the upstream traffic exceeds a certain number of GB to stop the broadband.
These people did some unethical things that harmed others and themselves: Xiaomi paid an unnecessary amount of traffic fees, and ordinary users had a bad download experience; their broadband was still stopped by the operator.

The default address is bigota.d.miui.com, change it to

CDN for downloading Xiaomi firmware

cdn-ota.azureedge.net
cdnorg.d.miui.com
bn.d.miui.com
bkt-sgp-miui-ota-update-alisgp.oss-ap-southeast-1.aliyuncs.com

Sometimes it can increase download speed

https://bn.d.miui.com/V12.5.15.0.RGGEUXM/begonia_eea_global_images_V12.5.15.0.RGGEUXM_20220826.0000.00_11.0_eea_b8c6b15c15.tgz

or

https://cdn-ota.azureedge.net/V12.5.15.0.RGGEUXM/begonia_eea_global_images_V12.5.15.0.RGGEUXM_20220826.0000.00_11.0_eea_b8c6b15c15.tgz

or

https://cdn-ota.azureedge.net/V13.0.8.0.SJHCNXM/atom_images_V13.0.8.0.SJHCNXM_20230630.0000.00_12.0_cn_acca549dfc.tgz

 

new EDL loader for SAMSUNG devices 2024.05

Standard

newer EDL loader for following SAMSUNG devices exist

SM-A207F BIT5
SM-N975U BIT8
SM-N970U BIT8
SM-F721U BIT4
SM-A236E BIT5
=============
SM-057F BIT1
SM-A057F BIT2
SM-A235F BIT4
SM-A235F BIT5
SM-A235M Bit4
SM-A236E BIT5
SM-A236U BIT4
SM-A236U BIT5
SM-A236W BIT4
SM-A236W BIT5
SM-A426U BIT7
SM-A426W BIT7
SM-A525F BIT6
SM-A526B BIT6
SM-A526U BIT10
SM-A526U BIT-C
SM-A526W BIT-A
SM-A528B BIT6
SM-A605F BIT4
SM-A605G BIT4
SM-A705F BIT5
SM-A705MN BIT5
SM-A705Y BIT3
SM-A715F BIT3
SM-A716U BIT9
SM-A716W BIT9
SM-A725F BIT6
SM-A736B BIT5
SM-A736B BIT6
SM-A805 BIT4
SM-A905F BIT4
SM-A920F BIT1
SM-C7000 BIT2
SM-E556B BIT1
SM-F711B BIT6
SM-F711B BIT7
SM-F711U BIT5
SM-F711W BIT5
SM-F721B BIT4
SM-F721B BIT5
SM-F721U BIT3
SM-F721U BIT4
SM-F731B BIT1
SM-F731U BIT1
SM-F731W BIT1
SM-F916U BIT2
SM-F916W BIT2
SM-F926B BIT4
SM-F926B BIT5
SM-F926N BIT2
SM-F926U BIT4
SM-F926U BIT5
SM-F936B BIT4
SM-F936B BIT5
SM-F936N BIT2
SM-F936U BIT3
SM-F936U BIT4
SM-F946B BIT1
SM-F946U BIT1
SM-F946W BIT1
SM-G780G BIT8
SM-G781B BIT8
SM-G781B BIT9
SM-G781U BIT8
SM-G781U BIT9
SM-G781U BIT12
SM-G781U BIT-E
SM-G781V BIT-B
SM-G781V BIT-C
SM-G885F BIT2
SM-G970U BIT9
SM-G970W BIT9
SM-G973U BIT9
SM-G973W BIT9
SM-G975U BIT9
SM-G975W BIT9
SM-G981U BIT7
SM-G981U BIT8
SM-G986N BIT1
SM-G986U BIT7
SM-G986U BIT8
SM-G988N BIT1
SM-G988U BIT7
SM-G988U BIT8
SM-G990B BIT6
SM-G990U BIT9
SM-G991U BIT9
SM-G991U BIT-A
SM-G996U BIT9
SM-G996U BIT-A
SM-G998U BIT9
SM-G998U BIT-A
SM-G8870 BIT1
SM-G9500 BIT4
SM-G9550 BIT4
SM-G9600 BIT5
SM-G9650 BIT5
SM-G9700 BIT2
SM-G9730 BIT2
SM-G9750 BIT4
SM-G9880 BIT1
SM-J250F BIT2
SM-J250M BIT5
SM-J410F BIT2
SM-J410G BIT1
SM-J415F BIT4
SM-J415G BIT2
SM-J610F BIT3
SM-J610G BIT2
SM-J810F BIT4
SM-J810G BIT2
SM-J810M BIT2
SM-J810Y BIT3
SM-M145F BIT1
SM-M145F BIT2
SM-M556B BIT1
SM-N970U BIT8
SM-N975U BIT8
SM-N976V BIT8
SM-N981U BIT5
SM-N981U BIT6
SM-N986U BIT5
SM-N986U BIT6
SM-N9500 BIT5
SM-N9600 BIT4
SM-N9700 BIT2
SM-S711U BIT1
SM-S711U BIT2
SM-S901E BIT7
SM-S901U BIT3
SM-S901U BIT4
SM-S906E BIT7
SM-S906U BIT3
SM-S906U BIT4
SM-S908E BIT7
SM-S908E Bit8
SM-S908N BIT3
SM-S908U BIT3
SM-S908U BIT4
SM-S911B BIT3
SM-S911U BIT2
SM-S911W BIT2
SM-S916B BIT3
SM-S916N BIT2
SM-S916U BIT2
SM-S916W BIT2
SM-S918B BIT3
SM-S918B BIT4
SM-S918N Bit2
SM-S918U BIT2
SM-S921U BIT1
SM-S926U BIT1
SM-S928B BIT1
SM-S928U BIT1
SM-S9010 BIT4
SM-SC02J BIT1
SM-SC03J BIT1
SM-T505 BIT3
SM-T595 BIT4
SM-T725 BIT1
SM-X210 BIT1
SM-X216B BIT1
SM-X900 BIT5

To get source code and solution contact us in telegram: https://t.me/GsmCoder

MTK’s NVRAM realizes data backup and recovery

Standard

In 2017, there was such a customized requirement: write a file data, and the file data also needs to be restored after restoring the factory settings.

Step 1: nvram lib id definition

vendor/mediatek/proprietary/custom/project/cgen/inc/Custom_NvRam_LID.h
typedef enum
{
    AP_CFG_RDCL_FILE_AUDIO_LID=AP_CFG_CUSTOM_BEGIN_LID, //AP_CFG_CUSTOM_BEGIN_LID: this lid must not be changed, it is reserved for system.
    AP_CFG_RDCL_FILE_AUDIO_MAGI_CONFERENCE_LID,
    AP_CFG_RDCL_FILE_AUDIO_HAC_PARAM_LID,
    AP_CFG_CUSTOM_TEST_CUSTOM1_LID, //zrx add defines lib id
    AP_CFG_CUSTOM_FILE_MAX_LID,
} CUSTOM_CFG_FILE_LID;

//zrx add Add LID version information
#define AP_CFG_CUSTOM_TEST_CUSTOM1_LID_VERNO "000"

Step 2: declare the data structure and version number of nvram lib id

vendor/mediatek/proprietary/custom/project/cgen/inc/Custom_NvRam_data_item.h
//zrx add
LID_BIT VER_LID(AP_CFG_CUSTOM_TEST_CUSTOM1_LID)
Test_Custom1_Struct *CFG_TEST_CUSTOM1_REC_TOTAL
{

};

Step 3: nvram lib data structure definition

vendor/mediatek/proprietary/custom/project/cgen/cfgfileinc/CFG_Custom1_File.h
//zrx add start
typedef struct
{
    unsigned char Array[1024];
}Test_Custom1_Struct;
//zrx add end

//zrx add start
#define CFG_TEST_CUSTOM1_REC_SIZE sizeof(Test_Custom1_Struct)
#define CFG_TEST_CUSTOM1_REC_TOTAL 1
//zrx add end

Step 4: nvram lib default value definition

vendor/mediatek/proprietary/custom/project/cgen/cfgdefault/CFG_Custom1_Default.h
Test_Custom1_Struct stCustom2Default =
{

    0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0
    
};

Step 5: Add the contents of nvram lib to the nvram array

vendor/mediatek/proprietary/custom/m107/cgen/inc/CFG_file_info_custom.h
#include "../cfgfileinc/CFG_Custom1_File.h"
#include "../cfgdefault/CFG_Custom1_Default.h"

 const TCFG_FILE g_akCFG_File_Custom[]=
    {

    { "/data/nvram/APCFG/APRDCL/Test_Custom1", VER(AP_CFG_CUSTOM_TEST_CUSTOM1_LID), CFG_TEST_CUSTOM1_REC_SIZE,
            CFG_TEST_CUSTOM1_REC_TOTAL, SIGNLE_DEFUALT_REC, (char *)&stCustom2Default, DataReset, NULL
        },
    };

Step 6: nvram lib id needs to be backed up to BinRegion

vendor/mediatek/proprietary/external/nvram/libcustom_nvram/CFG_file_info.c
FileName aBackupToBinRegion[]=
{
  {"CUSTOM_TEST",AP_CFG_CUSTOM_TEST_CUSTOM1_LID},
}

pfConvertFunc aNvRamConvertFuncTable[]=
{
  NULL, //AP_CFG_CUSTOM_TEST_CUSTOM1_LID
}

const TABLE_FOR_SPECIAL_LID g_new_nvram_lid[] =
{
    {AP_CFG_CUSTOM_TEST_CUSTOM1_LID, 1024 * 1024, 1024 * 1024},
};

Step 7: Upper layer read and write nvram data interface

NvRAMAgent.java
package com.example.nvram_test;

import android.os.IBinder;

public interface NvRAMAgent extends android.os.IInterface
{
    /** Local-side IPC implementation stub class. */
    public static abstract class Stub extends android.os.Binder implements NvRAMAgent
    {
        private static final java.lang.String DESCRIPTOR = "NvRAMAgent";
        /** Construct the stub at attach it to the interface. */
        public Stub()
        {
            this.attachInterface(this, DESCRIPTOR);
        }
        /**
         * Cast an IBinder object into an NvRAMAgent interface,
         * generating a proxy if needed.
         */
        public static NvRAMAgent asInterface(android.os.IBinder obj)
        {
            if ((obj == null)) {
                return null;
            }

            android.os.IInterface iin = (android.os.IInterface) obj.queryLocalInterface(DESCRIPTOR);

            if (((iin != null) && (iin instanceof NvRAMAgent))) {
                return ((NvRAMAgent) iin);
            }

            return new NvRAMAgent.Stub.Proxy(obj);
        }
        public android.os.IBinder asBinder()
        {
            return this;
        }
        public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException
        {
            switch (code)
            {
            case INTERFACE_TRANSACTION:
            {
                reply.writeString(DESCRIPTOR);
                return true;
            }
            case TRANSACTION_READFILE:
            {
                data.enforceInterface(DESCRIPTOR);
                int _arg0;
                _arg0 = data.readInt();
                byte[] _result = this.readFile(_arg0);
                reply.writeNoException();
                reply.writeByteArray(_result);
                return true;
            }
            case TRANSACTION_WRITEFILE:
            {
                data.enforceInterface(DESCRIPTOR);
                int _arg0;
                _arg0 = data.readInt();
                byte[] _arg1;
                _arg1 = data.createByteArray();
                int _result = this.writeFile(_arg0, _arg1);
                reply.writeNoException();
                reply.writeInt(_result);
                return true;
            }
            default:
            {
                break;
            }
            }

            return super.onTransact(code, data, reply, flags);
        }
        private static class Proxy implements NvRAMAgent
        {
            private android.os.IBinder mRemote;
            Proxy(android.os.IBinder remote)
            {
                mRemote = remote;
            }
            public android.os.IBinder asBinder()
            {
                return mRemote;
            }
            public java.lang.String getInterfaceDescriptor()
            {
                return DESCRIPTOR;
            }
            public byte[] readFile(int file_lid) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                byte[] _result;

                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeInt(file_lid);
                    mRemote.transact(Stub.TRANSACTION_READFILE, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.createByteArray();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }

                return _result;
            }
            public int writeFile(int file_lid, byte[] buff) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                int _result;

                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeInt(file_lid);
                    _data.writeByteArray(buff);
                    mRemote.transact(Stub.TRANSACTION_WRITEFILE, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.readInt();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }

                return _result;
            }

            public byte[] readFileByName(String filename) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                byte[] _result;

                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeString(filename);
                    mRemote.transact(Stub.TRANSACTION_READFILEBYNAME, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.createByteArray();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }

                return _result;
            }

            public int writeFileByName(String filename, byte[] buff) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                int _result;

                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeString(filename);
                    _data.writeByteArray(buff);
                    mRemote.transact(Stub.TRANSACTION_WRITEFILEBYNAME, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.readInt();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }

                return _result;
            }
        }
        static final int TRANSACTION_READFILE = (IBinder.FIRST_CALL_TRANSACTION + 0);
        static final int TRANSACTION_WRITEFILE = (IBinder.FIRST_CALL_TRANSACTION + 1);
        static final int TRANSACTION_READFILEBYNAME = (IBinder.FIRST_CALL_TRANSACTION + 2);
        static final int TRANSACTION_WRITEFILEBYNAME = (IBinder.FIRST_CALL_TRANSACTION + 3);
    }
    public byte[] readFile(int file_lid) throws android.os.RemoteException;
    public int writeFile(int file_lid, byte[] buff) throws android.os.RemoteException;
    public byte[] readFileByName(String filepath) throws android.os.RemoteException;
    public int writeFileByName(String filepath, byte[] buff) throws android.os.RemoteException;
}

Step 8: Read and write data helper class

Utils.java
ackage com.example.nvram_test;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.RandomAccessFile;
import java.util.ArrayList;

import android.content.Context;
import android.os.IBinder;
import android.os.ServiceManager;
import android.util.Log;
import android.widget.Toast;

public class Utils {
    final String TAG = "Utis";
    byte[] buff;
    Context mContext;
    public Utils(Context mContext){
        this.mContext=mContext;
    }   

    /**
     * Combine multiple byte arrays into one byte array
     * @param a byte array
     * @param b byte array
     * @return byte[]
     */
    public byte[] combineBytes(byte[] a, byte[] b) {
        byte[] bytes = new byte[a.length + b.length];
        System.arraycopy(a, 0, bytes, 0, a.length);
        System.arraycopy(b, 0, bytes, a.length, b.length);
        return bytes;
    }   

    /**
     * Write files to app
     */
    public void writeOwnFile(String fileName,String message){
        try {
            FileOutputStream fout = mContext.openFileOutput(fileName,
                    mContext.MODE_PRIVATE);
            byte[] bytes = message.getBytes();
            fout.write(bytes);
            fout.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    /**
     * Read files from app
     * @param fileName
     * @return
     */
    public String readOwnFile(String fileName){
        try {
            FileInputStream fis=mContext.openFileInput(fileName);
            ByteArrayOutputStream bos=new ByteArrayOutputStream();
            byte[] buffer = new byte[1024];
            int len=0;
            while((len=fis.read(buffer))!=-1){
                bos.write(buff, 0, len);
            }
            byte[] content_byte = bos.toByteArray();  
            String content = new String(content_byte);  
            return content;
        } catch (Exception e) {
            // TODO: handle exception
            e.printStackTrace();
        }
        return null;
    }

    /**
     * write file
     * @param fileName file name
     * @param bytes byte array
     */
    public void writeFile(String fileName,byte[] bytes){
         try {              
                FileOutputStream fout = new FileOutputStream(fileName);            
                fout.write(bytes);
                fout.close();               
            } catch (Exception e) {
                e.printStackTrace();
            }
    }

    /**
     * Read file
     * @param fileName file name
     * @return byte[]
     */
    public byte[] readFile(String fileName){
        try {
            FileInputStream fin = new FileInputStream(fileName);
            int length = fin.available();
            byte [] buffer = new byte[length];
            fin.read(buffer);
            fin.close();
            return buffer;
        } catch (Exception e) {
            // TODO: handle exception
            e.printStackTrace();
        }
        return buff;
    }

    /**
     * Write value to NvRam
     * @param file_name NvRam path
     * @param bytes byte array
     */
    public void writeData(String file_name, byte[] bytes) {
        byte[] buff = new byte[1024];
        if(bytes.length<buff.length){ for(int="" i="0;i<bytes.length;i++){" buff[i]="bytes[i];" }="" *for(int="" j="bytes.length;j<buff.length;j++){" buff[j]="(byte)0;" }*="" }else{="" ibinder="" binder="ServiceManager.getService("NvRAMAgent");" nvramagent="" agent="NvRAMAgent.Stub.asInterface(binder);" if="" (agent="" !="null)" {="" int="" flag="0;" try="" buff);="" catch="" (exception="" e)="" todo:="" handle="" exception="" e.printstacktrace();="" (flag="">0) {
                Toast.makeText(mContext, "write Success", Toast.LENGTH_SHORT).show();
            // Log.d(TAG, "zrx----write Success");
            } else {
                Toast.makeText(mContext, "write Failure", Toast.LENGTH_SHORT).show();
                Log.d(TAG, "zrx---- write Failure");
            }
        }
    }

    /**
     * Read value from NvRam
     * @param file_name NvRam path
     * @param offset starting position
     * @param byteCount number of bytes
     * @return
     */
    public byte[] readData(String file_name,int offset,int byteCount) {
        byte[] data = new byte[byteCount];
        IBinder binder = ServiceManager.getService("NvRAMAgent");
        NvRAMAgent agent = NvRAMAgent.Stub.asInterface(binder);
        if (agent != null) {
            try {
                buff = agent.readFileByName(file_name);
            } catch (Exception e) {
                // TODO: handle exception
                e.printStackTrace();
            }
        }
        if (buff != null) {
            try {
                for(int i=0;i<bytecount;i++){ data[i]="buff[offset+i];" }="" catch="" (exception="" e)="" {="" todo:="" handle="" exception="" e.printstacktrace();="" return="" data;="" <="" pre="">

Step 9: Verify

MainActivity.java
import android.app.Activity;
import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.Toast;

import com.example.nvram_test.R;

public class MainActivity extends Activity{
    String TAG="MainActivity";

    /**
     * The file name is defined in vendor/mediatek/proprietary/custom/m107/cgen/inc/CFG_file_info_custom.h
     */
    private static final String TEST_FILENAME = "/data/nvram/APCFG/APRDCL/Test_Custom1";
    Button btn1;
    Button btn2;
    Button btn3;
    Button btn4;
    Utils utils;
    /**
     * Test the path to the backup SecretKey file
     */
    private static final String secret_filename="/storage/emulated/0/SecretKey";

    /**
     * Test the path to the backup goc_database file
     */
    private static final String goc_database="/storage/emulated/0/goc_database";
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        // TODO Auto-generated method stub
        super.onCreate(savedInstanceState);
        setContentView(R.layout.main);
        utils=new Utils(this);
        btn1=(Button)findViewById(R.id.btn1);
        btn2=(Button)findViewById(R.id.btn2);

        btn3=(Button)findViewById(R.id.btn3);
        btn4=(Button)findViewById(R.id.btn4);

        /**
         * Test the backup of the SecretKey file bytes to NvRam
         */
        btn1.setOnClickListener(new View.OnClickListener() {

            @Override
            public void onClick(View arg0) {
                // TODO Auto-generated method stub
                byte[] a=utils.readFile(secret_filename); //Read SecretKey file
                utils.writeData(TEST_FILENAME, a); //Back up the bytes of the SecretKey file to NvRam

                //byte[] b=utils.readData(TEST_FILENAME, 0, a.length);
            /* if (!Arrays.equals(a, b)) {
                    utils.writeData(TEST_FILENAME, a);
                }else{
                    Toast.makeText(MainActivity.this, "SecretKey Data has existed, no need to backup!", Toast.LENGTH_SHORT).show();
                }*/
            }
        });

        /**
         * Test reading the bytes of the SecretKey file from NvRAM
         */
        btn2.setOnClickListener(new View.OnClickListener() {

            @Override
            public void onClick(View arg0) {
                // TODO Auto-generated method stub
                byte[] bytes=utils.readData(TEST_FILENAME,0,27); //Test the bytes of the SecretKey file read from NvRAM
                Toast.makeText(getApplicationContext(), "data = "+new String(bytes), Toast.LENGTH_LONG).show();
            }
        });

        /**
         * Test to write bytes of goc_database file to NvRAM
         */
        btn3.setOnClickListener(new View.OnClickListener() {

            @Override
            public void onClick(View arg0) {
                // TODO Auto-generated method stub
                byte[] bytes=utils.readFile(goc_database); //bytes of goc_database file
                byte[] a=utils.readData(TEST_FILENAME,0,27); //Read the bytes of the SecretKey file in NvRAM
                utils.writeData(TEST_FILENAME, utils.combineBytes(a, bytes));           
            }
        });

        /**
         * Test whether the bytes of the goc_database file written to NvRAM are the same as the original file goc_database.
         */
        btn4.setOnClickListener(new View.OnClickListener() {

            @Override
            public void onClick(View arg0) {
                // TODO Auto-generated method stub              
                byte[] bytes=utils.readFile(goc_database); //Read goc_database file
                byte[] b=utils.readData(TEST_FILENAME, 27, bytes.length); //Read goc_database bytes under NvRAM
                utils.writeFile("/storage/emulated/0/goc_database2", b); //Write the goc_database bytes under NvRAM to the goc_database2 file. Compare the goc_database2 file with the original file goc_database and find that they are the same.                   
            }
        });
    }


}

MT6763 modem compilation

Standard

In the modem section, MTK provides the complete source code only to major smartphone companies like Xiaomi, OPPO, Vivo, and significant design firms such as Huawei Communications, Longqi Technology, and Wentai Technology, as well as module manufacturers like Quectel, Broadlink, Meg, and Ruihai.

Smaller manufacturers receive binary libraries and partially customized parameter source code.

As for the recommended compilation environment, the magnet link provided contains the file “TK_MD_BASIC_MOLY.LR12A.R2.MP.V143.7.tar.zst.”

Recommended compilation environment


Recommended Build Environment 
******************************************* 
* [OS] : Linux 
* [PERL] : v5.14.2 or v5.18.4 / v5.26.1 
* [MAKE] : GNU Make v3.81 / v4.1 
* [SHELL] : GNU bash v4.2.25 or v4.3.11 
* [COMPILER] : v4.9.2 or above 
* [Host GCC] : gcc version 4.8.4 
* [Perl Module]: Switch.pm, File/Copy/Recursive.pm, XML/Simple.pm

 

Actual compilation environment
Debian Buster
[PERL] : v5.28.1
[MAKE] : GUN Make v4.2.1
[COMPILER] : v4.9.2(2016.05-08) [OK]
[HOST GCC] : v8.3.0

apt install build-essential 
apt install libswitch-perl libfile-copy-recursive-perl libxml-simple-perl
https://codescape.mips.com/components/toolchain/2016.05-08/Codescape.GNU.Tools.Package.2016.05-08.for.MIPS.MTI.Bare.Metal.CentOS-5.x86_64.tar.gz

( MTI Bare Metal Toolchain MIPS32R2-MIPS32R5, MIPS64R2-MIPS64R5 and microMIPS)

Compile hardware configuration 16G RAM, 100G Storage

mkdir ~/modem
cd ~/modem
tar xvaf ~/Downloads/TK_MD_BASIC_MOLY.LR12A.R2.MP.V143.7.tar.zst
cd mcu/common/tools
mkdir -p GCC/MIPS/4.9.2
cd GCC/MIPS/ 4.9.2
tar xvaf ~/Downloads/Codescape.GNU.Tools.Package.2016.05-08.for.MIPS.MTI.Bare.Metal.CentOS-5.x86_64.tar.gz
cd mips-mti-elf
mv 2016.05-08 / ../linux
cd ~/modem/
cd mcu
common/tools/GCC/MIPS/4.9.2/linux/bin/mips-mti-elf-gcc -v

The version of MIPS gcc should be 2016.05-08

cd ~/modem
cd mcu
ls -a make/projects

you can see
'TK_MD_BASIC(LWCTG_R2_6763).mak' 'TK_MD_BASIC(LWTG_R2_6763).mak'

Start compiling

./m "TK_MD_BASIC(LWTG_R2_6763).mak" new

Before compilation, modifications can be made to the contents of the custom directory at mcu/pcore/custom.

The compiled results will be located in the mcu/build/TK_MD_BASIC/LWTG_R2_6763/bin directory.

The files generated include:

  •  TK_MD_BASIC_MDBIN_PCB01_MT6763_S00.MOLY_LR12A_R2_MP_V143_7.bin (md1bin.img, also known as md1rom)
  • DbgInfo_LR12A.R2.MP_TK_MD_BASIC_MOLY_LR12A_R2_MP_V143_7_2024_02_15_09_49
    – md_all_in_one/single_bin_modem.bin

To execute the modemRenameCopy.pl script, which is a crucial step, ensure not to overlook it. This script collects all the files that need to be copied to the AP side into the temp_modem folder (located in the modem codebase root directory) and generates an Android.mk file.

To pack the modem image, execute the following command in the Android source code directory device/mediatek/build/build/tools:

 

./modemRenameCopy.pl ~/mtk/modem/mcu “TK_MD_BASIC(LWCTG_R2_6763).mak”

After executing the command, new modem image files will be generated in the modem code directory modem/mcu/temp_modem.

Finally, modify md1bin.img to md1img.img and place it together with md1dsp.img into the version directory for flashing purposes.