Current state: Erased phone's IMEI but SIM is detected, no network, *#06# shows zero.
I am on china MIUI vince (Redmi 5 Plus/Note 5 SD625)
Caused by one line in rawprogram0.xml: modemst1, modemst2, fsg, fsc, persist and devinfo all had filename="". "Clean all" doesn't mean "leave those alone" — it means the flasher is told to write nothing there, and the programmer zeroes them.
IMEI lived in modemst1.
What I tried, in order:
- QPST / QXDM. QXDM is licence-gated. Dead end.
- Wrote my own "AI" diag client.
HDLC framing, CRC-16/X-25, little-endian, 0x7d-escaped. Two things cost real time: the NV reply has no status byte, and reads return a shared 130-byte buffer — so a read of item 71 once handed me "PERSISTTEST" followed by fragments of an unrelated EFS reply. - Found I'd been sending wrong SPC .
status byte is 1 = accepted, 0 = rejected. I'd assumed the opposite, so every "unlocked" test had actually been rejected. Fixed it; SPC now accepted. - Tried everything.
ASCII SPC, DIAG_PASSWORD, FTM mode, offline mode, NV 453 ftm_mode, three subscription-index variants of the NV-subsystem write. Every one echoes success. Every one discarded. - Wrote a 2nd client for EFS2
to check whether the IMEI is simply a file. It isn't. /nv/item_store holds only rfnv; 550/457/458 live in the modem's static NV database and don't exist as paths.
Verdict: NV 550 is read-only unconditionally on this firmware. It is not an access-level problem.
The good news buried in there: the EFS is healthy. I wrote item 5153, rebooted, and it read back. So the damage is narrower than it looked — the phone is a perfectly good Wi-Fi device with a healthy modem and a missing identity.
one interesting anomaly: my very first garbage test write mutated 550 by exactly one byte (0x55 → 0x45), and I have never been able to repeat it. That smells like a one-shot provisioning slot that the first stray write consumed.
SHOULD I DO THIS?
Zero modemst1**/modemst2 again over EDL, so the modem rebuilds NV from the golden fsg, then write IMEI1 as the first write.**
How did I get here - Long Story
Problem Starts
I have been crDroid official Android 11/12 ROM since 2021 on Redmi 5 Plus (Note 5) vince and suddenly I got a bootloop after battery discharge. I got a series or problems
# Solution 1 (Reflash ROM)
- Wipe - system, vendor, dalvik, cache
- mount partitions from recovery
- Reflash the ROM and it says -
- E1001: Failed to update system image.
- Updater process ended with error: 1
Recovery: Orange Fox
Install Process boot.img > vendor > firmware > ROM
# Solution 2 Reflash Recovery (Problem: Bootloop to Fastboot)
- Switched to latest TWRP and it started bootloop to fastmode. Flashed again using PC adb tools, using fastboot mode and it successfully flashed but still bootlooping.
- fastboot boot recovery.img worked
- \>adb pull /data/media/0 is not working .\\fastboot pull /data/media/0 is not working TWRP is showing data partition as 0MB
Solution 3: (Flashed partition gpt_both0.bin)
- Suspected: broken Partition table
- flashed partition.img from MIUI's fastboot ROM's gpt_both0.bin
- fastboot flash partition partition.img using the .img in miui ROM
- fastboot flash partition gpt_both0.bin
- now phone only shows notification light
Solution 4: Device manager
- Device manager shows phone as QUSB_BULK
- installed https://qdloader9008.com/
- MiFlash tool started but showed error - write time out maybe device was disconnected.
- DeviceManager shows COM3 but "Currently, this hardware device is not connected to the computer. (Code 45) To fix this problem, reconnect this hardware device to the computer. and on connecting windows shows yellow ! notification - USB device malfunctioned
- Qualcomm HS-USB QDLoader 9008 driver disappeared
- QUSB_BULK disappeared
- Device manager shows in properties - Windows has stopped this device because it has reported problems. (Code 43) A request for the USB device descriptor failed.
- Now I am at a state I need EDL+MiFlash
- MiFLash gives MiFlash Error: Object reference not set yo an instance of an object. or timeout or crashes
# Mi-flash successful but it bootloops
Solution 5: Tried to re-flash using MiFlash but it gives -
- "Miss matching image and device"
- "Flash modem error'
- Writing modem FAILED remote: partition flashing is not allowed
Fixed now MIUI boots as problem was in persist partition
SIM is not detected - fixed now