What is Radio.img; why downgrades fail.

[Skrilax_CZ]

Since I see many questions about the radio.img; I'll try to explain it:

radio.img is a image of partition table + several partitions, which are defined in the header.

You can open the file in hex editor and see it (starting at 0x18 offset):

MAGIC-NOTHING2DO: does nothing
OTA-QCSBL-UPDATE: updates qcsblhd_cfgdata.mbn and qcsblsec.mbn
OTA-OMSBL-UPDATE: updates oemsblhd.mbn and oemsblsec.mbn
OTA-RADIO-UPDATE: updates amsshd.mbn and amsssec.mbn (the actual baseband firmware)
OTA-APSBL-UPDATE: updates appsboothd.mbn and appsbootsec.mbn
OTA-CEFS--UPDATE: updates cefs.mbn (on some radio.img files this is done implicitly)

!BE AWARE THAT THE BOOTLOADERS ARE SIGNED!

Not all have to be present in the radio.img, but so far I always found oemsblhd.mbn and oemsblsec.mbn in it.

Oemsbl prevents downgrading by using a backup and comparing the version with the one flashed. As for other paritions, the integrity checking consists of a signature check, then if it suceeds it checks secure version (against the one stored in 0:SECURE_VERSION parititon). Thus with the new phones or phones flashed with new SBF (as RAMDLD's secure version becomes the requirement if it's higher than the actual) you won't be able to use the old amss.mbn software (cefs.mbn is not signed, therefore use at will).

The new SBF / MBN (De)packer is also able tho extract the radio.img into the partitions. They are named as if you were extracting them from the shx / sbf.

[fogozito]

i can help u out to test stuff on my dext

[kileak]

How can i know the currently version of the bootloader in my phone, is there any comand for the virtual console to know it ?

I got kb7sqi-cliq-V1.4.8 ROM and use RSD Lite and it says: 1446. This is correct ?

Thanks in advance

EDIT: I got it... Hold power + Menu on the DEXT/Cliq (blue screen) , connect to RSD Lite and there is the Bootloader version

[fogozito]

there is anyway to downgrade the radio yet?

[Skrilax_CZ]

No (it is checked by bootloader, which is not downgradeable if not rooted).

[Danation]

Well, if you are rooted, how do you downgrade the bootloader?

[juanmre]

Does this mean that if boot loader is downgraded, radio could be downgraded???
(this would be useful for LA users who lost 3G services with radio update from Tmobile)

[Skrilax_CZ]

Well, if you are rooted, how do you downgrade the bootloader?

First someone must complete the partitioning with a module for example. We need to fill the rest of the partitions, including the bootloader.

[Denis_Dext]

Since I see many questions about the radio.img; I'll try to explain it:

radio.img is a image of partition table + several partitions, which are defined in the header.

You can open the file in hex editor and see it (starting at 0x18 offset):

MAGIC-NOTHING2DO: does nothing
OTA-QCSBL-UPDATE: updates qcsblhd_cfgdata.mbn and qcsblsec.mbn
OTA-OMSBL-UPDATE: updates oemsblhd.mbn and oemsblsec.mbn
OTA-RADIO-UPDATE: updates amsshd.mbn and amsssec.mbn (the actual baseband firmware)
OTA-APSBL-UPDATE: updates appsboothd.mbn and appsbootsec.mbn
OTA-CEFS--UPDATE: updates cefs.mbn (on some radio.img files this is done implicitly)

!BE AWARE THAT THE BOOTLOADERS ARE SIGNED!

Not all have to be present in the radio.img, but so far I always found oemsblhd.mbn and oemsblsec.mbn in it.

The oemsblhd.mbn and oemsblsec.mbn is the blue bootloader and it will prevent downgrading to a lower version. This will prevent you from flashing old radio.img. In the firmware superthread, I called these firmwares "STICKY". Bootloaders with version 05.15+ will prevent you from using the old RAMDLD with exploit and won't let you to downgrade back to 04.CC bootloader (or we have not achieved that yet (without root permissions)).

The new Mbn (De)packer (version 1.1g) is also able tho extract the radio.img into the partitions. They are named as if you were extracting them from the shx / sbf.

Skrilax_CZ Hello, I'm in big trouble ... I installed a ROM American, and now I dont have 3G access here in Brazil (I think due to frequencies).
Do you have any solution for this problem?
I tried to read the topic, but I'm very secular, and did not understand much.
Sorry for my English I am using the "Google translator "....
On behalf of all Brazilians who are BIG problem with that, thank you!

[OCM]

No, If you updated the radio there is no way as of now to downgrade and therefore you are stuck without 3G.

[adlx]

@Skrilax_CZ:

Someone at my blog has just commented that Movistar is selling Dext phones in Venezuela with 76XXC-6380525-SDBALUM baseband version, and that there it operates at 850 Mhz/1900 Mhz.

Seeing the baseband version (like 1.3.18 T-Mobile one) it may come also with a new 5.* bootloader. Do you believe there is any hope someone could "find" the radio.img or the firmware out there, so Brasilian and Mexican people (who have lost there 3g after flashing T-Mobile 1.3.18/1.4.8) could hopefully flash that new radio and recover 3g back?

[Denis_Dext]

@Skrilax_CZ:

Someone at my blog has just commented that Movistar is selling Dext phones in Venezuela with 76XXC-6380525-SDBALUM baseband version, and that there it operates at 850 Mhz/1900 Mhz.

Seeing the baseband version (like 1.3.18 T-Mobile one) it may come also with a new 5.* bootloader. Do you believe there is any hope someone could "find" the radio.img or the firmware out there, so Brasilian and Mexican people (who have lost there 3g after flashing T-Mobile 1.3.18/1.4.8) could hopefully flash that new radio and recover 3g back?

Good question, Alex

[fogozito]

any news?

[kileak]

@Skrilax_CZ:

Someone at my blog has just commented that Movistar is selling Dext phones in Venezuela with 76XXC-6380525-SDBALUM baseband version, and that there it operates at 850 Mhz/1900 Mhz.

Seeing the baseband version (like 1.3.18 T-Mobile one) it may come also with a new 5.* bootloader. Do you believe there is any hope someone could "find" the radio.img or the firmware out there, so Brasilian and Mexican people (who have lost there 3g after flashing T-Mobile 1.3.18/1.4.8) could hopefully flash that new radio and recover 3g back?

Thanks Alex Hope this works and a developer can help us

[faramisimo]

what does downgrading the boot loader do for us?


-edit-
im a noob here i was trying to find out the boot loader version i got the following. does that mean it's v 515? does that make any sense?

IMEI/ESN/MEID: N / A
Technology: N / A
Software Version: N / A
Flex Version: N / A
Bootloader Version: v0x000515
DRM Version: N / A
Phone Type: Engineering (E100000000000000000000000000)