diff --git a/xperia-firmware-upgrade/5g-policyman/diag_probe.py b/xperia-firmware-upgrade/5g-policyman/diag_probe.py new file mode 100644 index 0000000..25124a9 --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/diag_probe.py @@ -0,0 +1,51 @@ +import serial, time + +def fcs16(data): + fcs = 0xFFFF + for b in data: + fcs = (fcs >> 8) ^ TAB[(fcs ^ b) & 0xFF] + return (~fcs) & 0xFFFF + +# build CRC-CCITT (reflected, 0x8408) table +TAB = [] +for i in range(256): + c = i + for _ in range(8): + c = (c >> 1) ^ 0x8408 if (c & 1) else (c >> 1) + TAB.append(c) + +def hdlc(payload): + crc = fcs16(payload) + frame = bytes(payload) + bytes([crc & 0xFF, (crc >> 8) & 0xFF]) + out = bytearray() + for b in frame: + if b == 0x7E: out += b'\x7d\x5e' + elif b == 0x7D: out += b'\x7d\x5d' + else: out.append(b) + out.append(0x7E) + return bytes(out) + +def unhdlc(data): + if not data: return data + data = data.rstrip(b'\x7e') + out = bytearray(); esc = False + for b in data: + if esc: out.append(b ^ 0x20); esc = False + elif b == 0x7D: esc = True + else: out.append(b) + return bytes(out) + +for dev in ['/dev/ttyUSB0','/dev/ttyUSB1']: + try: + s = serial.Serial(dev, 115200, timeout=1.5) + s.reset_input_buffer() + # DIAG_VERNO_F = 0x00 + s.write(hdlc([0x00])) + time.sleep(0.4) + r = s.read(256) + print(dev, 'raw', r[:40].hex()) + dec = unhdlc(r) + print(' decoded first byte:', hex(dec[0]) if dec else 'none', 'len', len(dec)) + s.close() + except Exception as e: + print(dev, 'ERR', e) diff --git a/xperia-firmware-upgrade/5g-policyman/efs2.py b/xperia-firmware-upgrade/5g-policyman/efs2.py new file mode 100644 index 0000000..b949df1 --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/efs2.py @@ -0,0 +1,249 @@ +#!/usr/bin/env python3 +"""Minimal Qualcomm DIAG EFS2 client over a serial diag port. + +Packet layouts and opcodes replicate JohnBel/EfsTools exactly. Used to +back up and replace policyman RF-band config on a rooted Sony Xperia 1 VI. +""" +import sys, os, time, struct, serial + +PORT = os.environ.get("DIAGPORT", "/dev/ttyUSB0") + +DIAG_SUBSYS = 0x4B +SUBSYS_EFS = 19 +# EFS opcodes (EfsTools QcdmEfsCommand) +HELLO, QUERY, OPEN, CLOSE, READ, WRITE = 0, 1, 2, 3, 4, 5 +UNLINK, MKDIR, OPENDIR, READDIR, CLOSEDIR, STAT = 8, 9, 11, 12, 13, 15 +# open flags +O_WRONLY, O_RDONLY, O_CREAT = 0o1, 0o0, 0o100 + +# CRC-16 CCITT reflected (HDLC FCS-16) +_TAB = [] +for _i in range(256): + _c = _i + for _ in range(8): + _c = (_c >> 1) ^ 0x8408 if (_c & 1) else (_c >> 1) + _TAB.append(_c) + +def fcs16(data): + fcs = 0xFFFF + for b in data: + fcs = (fcs >> 8) ^ _TAB[(fcs ^ b) & 0xFF] + return (~fcs) & 0xFFFF + +def hdlc_encode(payload): + crc = fcs16(payload) + frame = bytes(payload) + struct.pack("= 4 and p[0] == DIAG_SUBSYS and p[1] == SUBSYS_EFS \ + and struct.unpack(" ignore + raise TimeoutError("no matching response for efs cmd %d" % efs_cmd) + + # ---- EFS operations ---- + def hello(self): + win, wbyte, ver = 0x100000, 0x100000, 1 + body = struct.pack(" 1 else "probe" + d = Diag() + ver = d.hello() + print("EFS hello ok, version=%d" % ver) + + if cmd == "probe": + entries = d.listdir(TARGET_DIR) + print("%s: %d entries" % (TARGET_DIR, len(entries))) + for name, etype, size in entries: + mark = " <== TARGET" if name in TARGETS else "" + print(" %-40s type=%d size=%d%s" % (name, etype, size, mark)) + for t in TARGETS: + err, mode, size = d.stat("%s/%s" % (TARGET_DIR, t)) + print("stat %s -> err=%d mode=%o size=%d" % (t, err, mode & 0xffff, size)) + + elif cmd == "backup": + os.makedirs(BACKUP, exist_ok=True) + for t in TARGETS: + data = d.read_file("%s/%s" % (TARGET_DIR, t)) + open("%s/%s" % (BACKUP, t), "wb").write(data) + print("backed up %s (%d bytes)" % (t, len(data))) + + elif cmd == "write": + for t in TARGETS: + data = open("%s/%s" % (SRC, t), "rb").read() + n = d.write_file("%s/%s" % (TARGET_DIR, t), data) + print("wrote %s (%d bytes)" % (t, n)) + + elif cmd == "verify": + ok = True + for t in TARGETS: + want = open("%s/%s" % (SRC, t), "rb").read() + got = d.read_file("%s/%s" % (TARGET_DIR, t)) + same = want == got + ok = ok and same + print("verify %s: %s (device %d bytes, source %d bytes)" % + (t, "MATCH" if same else "DIFFER", len(got), len(want))) + print("ALL VERIFIED" if ok else "MISMATCH!") + + d.s.close() + +if __name__ == "__main__": + main() diff --git a/xperia-firmware-upgrade/5g-policyman/new_files_written/band_set_01.xml b/xperia-firmware-upgrade/5g-policyman/new_files_written/band_set_01.xml new file mode 100644 index 0000000..e084d37 --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/new_files_written/band_set_01.xml @@ -0,0 +1,2317 @@ + + + + + + + + + + + + + 0 2 4 6 19 27 31 37 39 40 65 70 + + 0 2 6 19 27 76 77 78 70 + 0 2 6 19 27 76 77 78 70 + + + + + + 0 2 4 6 27 + + 0 2 27 76 77 + 0 2 27 76 77 + + + + + 0 2 4 6 27 + + 0 2 27 76 77 + 0 2 27 76 77 + + + + + 0 4 6 27 + + 0 27 76 77 + 0 27 76 77 + + + + + 0 2 6 19 27 + + 0 2 6 19 27 77 + 0 2 6 19 27 77 + + + + + 1 3 4 11 16 28 29 65 70 + + 0 1 65 70 76 + 0 1 65 70 76 + + + + + 0 2 18 20 27 41 + + 76 77 78 + 0 2 76 77 78 + + + + + 0 2 10 17 25 27 40 41 + + 76 77 27 + 0 2 27 76 77 + + + + + 0 2 7 10 27 40 41 + + 76 77 27 + 0 2 27 76 77 + + + + + 2 17 27 41 + + 76 + 2 27 76 + + + + + 0 2 7 10 17 18 20 25 27 40 41 + + 27 76 77 78 + 0 2 27 76 77 78 + + + + + 0 2 4 7 38 39 40 + + 40 78 27 + 0 2 40 78 27 + + + + + 0 2 7 39 + + 77 0 7 + 77 0 2 7 + + + + + 0 2 4 39 + + 77 0 4 + 77 0 4 + + + + + + + 27 + 27 + + + + + 0 2 4 7 38 39 40 + + 0 4 7 27 40 77 78 + 0 2 4 7 27 40 77 78 + + + + + 0 2 6 7 37 39 + + 77 27 0 2 6 + 77 27 0 2 6 + + + + + 0 2 6 7 37 39 + + 77 27 0 2 6 + 77 27 0 2 6 + + + + + 0 2 6 7 37 39 + + 77 27 0 2 6 + 77 27 0 2 6 + + + + + 0 2 6 7 37 39 + + 0 2 6 27 77 + 0 2 6 27 77 + + + + + 0 2 6 7 27 + + 77 27 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 77 27 + 77 27 0 2 + + + + + 0 2 6 + + 77 + 77 0 2 + + + + + 39 + + 77 + 77 + + + + + 0 2 6 7 27 39 + + 27 77 + 0 2 27 77 + + + + + 0 2 6 7 27 + + 40 27 + 40 27 0 2 + + + + + 0 2 6 7 27 + + 40 27 + 40 27 0 2 + + + + + 0 2 6 7 27 + + 40 27 + 40 27 0 2 + + + + + 0 2 6 7 27 + + 27 40 + 0 2 27 40 + + + + + 0 2 7 + + 77 + 77 0 2 + + + + + 0 2 7 + + 77 + 77 0 2 + + + + + 0 2 7 + + 77 + 77 0 2 + + + + + 0 2 7 + + 77 + 0 2 77 + + + + + 0 2 7 39 + + 39 0 + 39 0 2 + + + + + 0 2 7 + + 39 0 + 39 0 2 + + + + + 0 2 7 + + 39 0 + 39 0 2 + + + + + 39 + + 39 + 39 + + + + + 0 2 7 39 + + 0 39 + 0 2 39 + + + + + 0 2 6 27 + + 77 27 + 77 27 0 2 + + + + + 0 2 6 27 + + 77 27 + 77 27 0 2 + + + + + 27 40 + + 77 27 + 77 27 + + + + + 0 2 6 27 40 + + 27 77 + 0 2 27 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 0 2 7 39 + + 77 + 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 0 2 7 39 + + 77 + 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 0 2 7 + + 77 + 77 + + + + + 2 7 + + 77 + 77 + + + + + 2 7 + + 77 + 77 + + + + + 2 7 + + 77 + 77 + + + + + 2 7 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 + + 77 0 2 + 77 0 2 + + + + + 0 2 6 7 27 + + 0 2 27 77 + 0 2 27 77 + + + + + 0 2 6 7 31 37 + + 77 0 2 27 + 77 0 2 27 + + + + + 0 2 6 7 31 37 + + 77 0 2 27 + 77 0 2 27 + + + + + 0 2 6 7 31 37 + + 77 0 2 27 + 77 0 2 27 + + + + + 0 2 6 7 37 40 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 31 37 40 + + 0 2 27 77 + 0 2 27 77 + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 77 27 0 2 + 77 27 0 2 + + + + + 0 2 6 7 27 + + 0 2 27 77 + 0 2 27 77 + + + + + + 2 27 39 + + 77 27 + 77 27 0 2 + + + + + 2 + + 77 + 77 0 2 + + + + + 2 + + 77 + 77 + + + + + 2 + + 77 + 77 + + + + + 2 27 39 + + 27 77 + 0 2 27 77 + + + + + 2 6 19 + + 77 + 77 2 6 + + + + + 2 6 19 + + 77 + 77 2 6 + + + + + 2 6 19 + + 77 + 77 2 6 + + + + + 2 6 19 + + 77 + 77 2 6 + + + + + 2 6 19 + + 77 + 2 6 77 + + + + + 2 6 + + 77 + 77 2 6 + + + + + 27 2 6 + + 77 27 + 77 27 2 6 + + + + + 19 2 + + 77 + 77 2 + + + + + 2 27 + + 77 27 + 77 27 2 + + + + + + + + + + + + + 39 + + + + + + + + 2 6 19 27 39 + + 27 77 + 2 6 27 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 6 + + 77 + 77 + + + + + 2 19 + + 77 + 77 + + + + + 2 + + 77 + 77 + + + + + 2 + + + + + + + + 2 + + + + + + + + 2 19 + + 77 + 77 + + + + + 2 + + + + + + + + 2 + + + + + + + + + + + + + + + + 2 + + + + + + + + 19 2 6 + + 77 40 + 77 40 2 6 + + + + + 19 2 6 + + 77 40 + 77 40 2 6 + + + + + 2 6 19 + + 40 77 + 2 6 40 77 + + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 6 + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 + + + 77 27 0 2 + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 6 + + + + + + + + 0 2 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 0 2 6 19 27 + + + + 0 2 27 77 + + + 0 2 6 27 77 + + + + + + + + 0 2 6 19 27 + + + + 77 0 27 2 6 + + + 77 0 27 2 6 + + + + + + + + 0 2 6 19 27 + + + + 77 0 27 2 6 + + + 77 0 27 2 6 + + + + + + + + 0 2 6 19 27 + + + + 77 0 27 2 6 + + + 77 0 27 2 6 + + + + + + + + 0 2 6 19 27 + + + + 0 2 6 27 77 + + + 0 2 6 27 77 + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 0 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 0 2 6 27 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 0 2 6 19 27 + + + + 0 2 27 77 + + + 0 2 27 77 + + + + + + + + 2 7 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 7 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 7 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 7 19 27 + + + + 0 2 27 77 + + + 0 2 27 77 + + + + + + + + 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 6 19 27 + + + + 77 27 0 2 + + + 77 27 0 2 + + + + + + + + 2 6 19 27 + + + + 0 2 27 77 + + + 0 2 27 77 + + + + + + + + 2 6 19 27 + + + + 77 + + + 77 0 2 27 + + + + + + + + 2 6 19 27 + + + + 77 + + + 77 0 2 27 + + + + + + + + 2 6 19 27 + + + + 77 + + + 0 2 27 77 + + + + + + + + 2 19 27 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 19 27 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 19 27 7 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 7 19 27 + + + + 27 77 + + + 0 2 27 77 + + + + + + + + 2 19 27 37 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 19 27 37 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 19 27 + + + + 77 27 + + + 77 27 0 2 + + + + + + + + 2 19 27 37 + + + + 27 77 + + + 0 2 27 77 + + + + + + + + 2 + + + + 40 + + + 40 77 + + + + + + + + 2 + + + + 40 + + + 40 77 + + + + + + + + 2 + + + + 40 + + + 40 77 + + + + + + + + 2 + + + + + + + 40 + + + + + + + + 2 + + + + 40 + + + 40 77 + + + + + + + + 2 6 19 + + + + 77 + + + 77 + + + + + + + + 2 6 19 + + + + 77 + + + 77 + + + + + + + + 2 6 + + + + + + + 77 + + + + + + + + 2 6 19 + + + + 77 + + + 77 + + + + + + + + 37 40 + + + + 77 40 + + + 77 40 + + + + + + + + 2 6 19 37 40 + + + + 40 77 + + + 40 77 + + + + + + + + 2 19 + + + + 77 + + + 77 + + + + + + + + 2 19 + + + + 77 + + + 77 + + + + + + + + 2 19 + + + + 77 + + + 77 + + + + + + + + 2 19 + + + + 77 + + + 77 + + + + + + + + + 1 3 4 11 65 70 + + + + + 70 40 76 + + + + 70 40 1 65 76 + + + + + + + + + + 1 3 4 12 65 + + + + + 70 65 76 4 259 260 + + + + 70 65 76 4 259 260 + + + + + + + + + + 1 3 4 11 12 28 29 65 70 + + + + + 4 40 65 70 76 259 260 + + + + 1 4 40 65 70 76 259 260 + + + + + + + 450 + + 450-05 450-11 + 450-08 + 450-06 + + + + + 428 + + + + 428-88 + + + + 428-99 + + + + 428-00 428-91 + + + + 428-98 + + + + + + + 401 + + + + 401-02 + + + + 401-01 + + + + 401-77 + + + + 401-07 401-08 + + + + + + + 434 + + + + 434-04 + + + + 434-05 + + + + 434-07 + + + + 434-08 434-03 + + + + 434-06 + + + + 434-09 + + + + + + + 437 + + + + 437-01 + + + + 437-05 + + + + 437-09 + + + + + + + 436 + + + + 436-01 436-02 436-12 + + + + 436-03 + + + + 436-04 436-10 + + + + 436-05 + + + + + + + 438 + + + + 438-02 + + + + 438-01 + + + + 438-03 + + + + + + + 424 + + + + 424-02 + + + + 424-03 + + + + + + + + 466 + + + + + + 454 + + + + + + 455 + + + + + + + 440 441 + + + 440-10 440-11 440-12 440-13 440-20 + + + + 440-50 440-51 440-52 440-53 440-54 440-70 440-71 440-72 440-73 440-74 + + + + 440-20 440-30 440-31 440-32 440-40 440-41 440-42 440-88 440-89 + + + + 440-11 441-10 441-11 441-12 441-13 441-14 441-15 441-16 + + + + + + + 460 + + + 460-00 460-02 460-07 + + + + 460-01 460-09 + + + + 460-03 460-11 + + + + 460-15 + + + + + + + 525 + + + 525-01 + + + + 525-05 + + + + 525-03 + + + + + + + 502 + + + 502-12 + + + + 502-16 502-19 + + + + 502-18 + + + + 502-11 + + + + + + + 520 + + + 520-01 + + + + 520-05 + + + + 520-18 + + + + + + + 452 + + + 452-04 + + + + 452-02 + + + + 452-01 + + + + + + + 510 + + + 510-10 + + + + 510-11 + + + + 510-01 + + + + 510-09 + + + + + + + 515 + + + 515-02 + + + + 515-03 + + + + 515-66 + + + + + + + 456 + + + 456-01 + + + + 456-02 + + + + 456-08 + + + + + + + 457 + + + 457-08 + + + + 457-01 + + + + 457-02 + + + + + + + 414 + + + 414-01 + + + + 414-05 + + + + 414-09 + + + + + + + 528 + + + 528-11 + + + + 528-02 + + + + + + + + + 202 204 206 208 212 213 214 218 219 220 221 222 225 226 228 230 231 + 232 234 238 240 242 244 246 247 248 260 262 266 268 270 272 274 276 + 278 280 284 286 288 289 292 293 294 295 297 + + + + + + 310 311 312 313 314 315 316 + + + + + + + + + + + 234 235 + + + 234-30 234-31 234-32 234-33 234-34 + + + + 234-10 234-11 234-02 + + + + 234-15 234-07 234-09 + + + + 234-20 235-94 + + + + + + + 262 + + + 262-01 262-06 262-78 + + + + 262-02 262-09 262-04 + + + + 262-07 262-03 262-05 262-08 262-11 262-17 262-77 + + + + + + + 208 + + + 208-01 208-02 208-91 + + + + 208-10 208-09 208-13 + + + + 208-20 208-88 208-21 + + + + 208-15 208-16 208-35 208-36 + + + + + + + 420 + + + 420-01 + + + + 420-03 + + + + 420-04 + + + + + + + 419 + + + 419-02 + + + + 419-03 + + + + 419-04 + + + + + + + 427 + + + 427-01 + + + + 427-02 + + + + + + + 426 + + + 426-01 426-05 + + + + 426-02 + + + + 426-04 426-06 + + + + + + + 422 + + + 422-02 422-04 + + + + 422-03 + + + + 422-06 + + + + + + + 602 + + + 602-01 + + + + 602-02 + + + + 602-03 + + + + 602-04 + + + + + + + 655 + + + 655-01 + + + + 655-10 655-12 + + + + 655-07 + + + + 655-02 655-05 + + + + 655-19 655-38 + + + + + + + 604 + + + 604-01 604-06 + + + + 604-00 + + + + 604-02 604-05 + + + + + + + 310 311 312 313 314 315 316 + + + 310-410 310-070 310-080 310-380 310-560 + + + + 310-260 310-160 310-200 310-210 310-220 310-230 310-240 310-250 310-270 + + + + 311-480 311-481 310-012 310-010 + + + + + + + \ No newline at end of file diff --git a/xperia-firmware-upgrade/5g-policyman/new_files_written/plmn_mcc_supported_01.xml b/xperia-firmware-upgrade/5g-policyman/new_files_written/plmn_mcc_supported_01.xml new file mode 100644 index 0000000..4618fdc --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/new_files_written/plmn_mcc_supported_01.xml @@ -0,0 +1,445 @@ + + + + + + + + + + 202 204 206 208 212 213 214 218 219 220 221 222 225 226 228 230 231 232 234 238 240 242 244 246 247 248 260 262 266 268 270 272 274 276 278 280 284 286 288 289 292 293 294 295 297 310 311 312 313 314 315 316 450 440 441 460 525 502 520 452 510 515 456 457 414 528 + 466 + 454 + 455 + 428 + 401 + 434 + 437 + 436 + 438 + 424 + 235 419 420 422 426 427 602 604 655 + + + 450 + + 450-05 + 450-11 + 450-08 + 450-06 + + + + + 440 441 + + 440-10 + 440-11 + 440-12 + 440-13 + 440-20 + 440-50 + 440-51 + 440-52 + 440-53 + 440-54 + 440-70 + 440-71 + 440-72 + 440-73 + 440-74 + 440-30 + 440-31 + 440-32 + 440-40 + 440-41 + 440-42 + 440-88 + 440-89 + 441-10 + 441-11 + 441-12 + 441-13 + 441-14 + 441-15 + 441-16 + + + + 460 + + 460-00 + 460-02 + 460-07 + 460-01 + 460-09 + 460-03 + 460-11 + 460-15 + + + + 525 + + 525-01 + 525-05 + 525-03 + + + + 502 + + 502-12 + 502-16 + 502-19 + 502-18 + 502-11 + + + + 520 + + 520-01 + 520-05 + 520-18 + + + + 452 + + 452-04 + 452-02 + 452-01 + + + + 510 + + 510-10 + 510-11 + 510-01 + 510-09 + + + + 515 + + 515-02 + 515-03 + 515-66 + + + + 456 + + 456-01 + 456-02 + 456-08 + + + + 457 + + 457-08 + 457-01 + 457-02 + + + + 414 + + 414-01 + 414-05 + 414-09 + + + + 528 + + 528-11 + 528-02 + + + + + + 466 + + + + + + 454 + + + + + + 455 + + + + + + + 428 + + 428-88 + 428-99 + 428-00 + 428-91 + 428-98 + + + + 401 + + 401-02 + 401-01 + 401-77 + 401-07 + 401-08 + + + + 434 + + 434-04 + 434-05 + 434-07 + 434-08 + 434-03 + 434-06 + 434-09 + + + + 437 + + 437-01 + 437-05 + 437-09 + + + + 436 + + 436-01 + 436-02 + 436-12 + 436-03 + 436-04 + 436-10 + 436-05 + + + + 438 + + 438-02 + 438-01 + 438-03 + + + + 424 + + 424-02 + 424-03 + + + + + + + 234 235 + + 234-30 + 234-31 + 234-32 + 234-33 + 234-34 + 234-10 + 234-11 + 234-02 + 234-15 + 234-07 + 234-09 + 234-20 + 235-94 + + + + + 262 + + 262-01 + 262-06 + 262-78 + 262-02 + 262-09 + 262-04 + 262-07 + 262-03 + 262-05 + 262-08 + 262-11 + 262-17 + 262-77 + + + + + 208 + + 208-01 + 208-02 + 208-91 + 208-10 + 208-09 + 208-13 + 208-20 + 208-88 + 208-21 + 208-15 + 208-16 + 208-35 + 208-36 + + + + + 420 + + 420-01 + 420-03 + 420-04 + + + + + 419 + + 419-02 + 419-03 + 419-04 + + + + + 427 + + 427-01 + 427-02 + + + + + 426 + + 426-01 + 426-05 + 426-02 + 426-04 + 426-06 + + + + + 422 + + 422-02 + 422-04 + 422-03 + 422-06 + + + + + 602 + + 602-01 + 602-02 + 602-03 + 602-04 + + + + + 655 + + 655-01 + 655-10 + 655-12 + 655-07 + 655-02 + 655-05 + 655-19 + 655-38 + + + + + 604 + + 604-01 + 604-06 + 604-00 + 604-02 + 604-05 + + + + + 310 311 312 313 314 315 316 + + 310-410 + 310-070 + 310-080 + 310-380 + 310-560 + 310-260 + 310-160 + 310-200 + 310-210 + 310-220 + 310-230 + 310-240 + 310-250 + 310-270 + 311-480 + 311-481 + 310-012 + 310-010 + + + + \ No newline at end of file diff --git a/xperia-firmware-upgrade/5g-policyman/new_files_written/policies.xml b/xperia-firmware-upgrade/5g-policyman/new_files_written/policies.xml new file mode 100644 index 0000000..f449d7d --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/new_files_written/policies.xml @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/band_set_01.xml b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/band_set_01.xml new file mode 100644 index 0000000..df85630 --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/band_set_01.xml @@ -0,0 +1,660 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + +0 1 2 3 4 6 7 11 12 16 18 19 24 25 27 28 33 37 38 39 40 45 65 + + + +0 2 4 6 7 27 39 40 76 77 78 + + +0 2 4 6 7 27 37 39 40 76 77 78 + + + + + + +0 1 2 3 4 6 7 11 12 16 18 19 24 25 27 28 33 37 38 39 40 45 65 + + + + +0 2 4 6 7 27 29 37 39 40 76 77 78 + + + + + + +0 2 6 7 19 27 37 39 45 + + + + +0 2 6 7 27 37 39 40 76 77 + + + + + + +0 2 6 7 19 27 37 39 45 + + + + +0 2 6 7 27 37 39 40 76 77 + + + + + + +0 2 6 7 19 37 39 + + + + + + + + + +0 2 4 7 + + + + + + + + + +0 2 4 6 27 37 39 + + + + +27 77 + + + + + + +0 2 6 7 37 39 + + + +0 2 7 77 + + +0 2 7 39 77 + + + + + + +0 2 4 7 27 39 40 45 + + + +0 2 7 27 40 + + +0 2 4 7 27 39 40 + + + + + + +0 2 4 7 33 38 39 40 + + + +0 7 27 40 77 78 + + +40 77 78 + + + + + + +0 2 4 6 7 27 39 + + + + +0 2 6 7 27 39 76 77 78 + + + + + + +0 2 4 6 7 27 39 + + + +0 2 6 7 27 39 76 77 78 + + +0 2 6 7 27 39 76 77 78 + + + + + + +0 2 4 6 7 27 39 + + + +0 2 6 7 27 77 78 + + +0 2 6 7 27 77 78 + + + + + + +0 2 4 6 7 27 + + + +0 2 4 6 7 27 77 78 + + +0 2 4 6 7 27 76 77 78 + + + + + + +0 2 6 7 39 + + + + +0 2 6 7 76 77 78 + + + + + + +0 2 6 7 + + + +0 77 78 + + +0 76 77 78 + + + + + + +0 2 6 7 + + + + +76 77 78 + + + + + + +0 2 6 7 27 40 45 + + + + +0 2 6 7 27 77 + + + + + + +0 2 6 7 45 + + + + +0 2 6 7 77 + + + + + + +0 2 6 27 37 40 45 + + + + +0 2 6 27 37 40 77 + + + + + + +0 2 6 7 27 37 40 45 + + + + +0 2 6 7 27 37 40 77 + + + + + + +1 3 4 11 28 65 + + + + + + + + + +1 3 4 11 24 40 45 65 + + + + + + + + + +1 3 4 11 12 28 45 65 + + + + + + + + + +1 3 4 11 16 40 45 65 + + + + + + + + +22 27 49 60 + + +0 2 7 18 25 27 40 + + + + +0 2 27 40 76 77 78 + + + + + + +0 27 + + + + + + + + + + + + + ONLINE + + + + + + + + + + + + + FULL + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/plmn_mcc_supported_01.xml b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/plmn_mcc_supported_01.xml new file mode 100644 index 0000000..159b723 --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/plmn_mcc_supported_01.xml @@ -0,0 +1,40 @@ + + + +001 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 020 021 022 023 024 025 026 027 028 029 030 031 032 033 034 035 036 037 038 039 040 041 042 043 044 045 046 047 048 049 050 051 052 053 054 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 +202 204 206 208 212 213 214 216 218 219 220 221 222 225 226 228 230 231 232 234 235 238 240 242 244 246 247 248 259 260 262 266 268 270 272 274 276 278 280 284 286 288 290 292 293 294 295 297 308 340 647 +250 +257 +401 +255 +434 +452 +502 +525 +520 +460 +454 +455 +466 +310 311 312 313 314 315 316 330 332 544 +440 441 +991 999 +234-53 234-54 240-99 +234-10 234-30 244-05 244-21 262-02 262-03 262-07 262-09 262-11 262-77 +454-03 454-04 454-05 454-14 +454-12 454-13 454-30 +454-00 454-02 454-10 454-16 454-18 454-19 454-20 454-29 +454-06 454-15 454-17 +455-01 455-04 +466-89 466-97 466-99 +466-92 +466-01 466-02 466-05 +310-030 310-070 310-090 310-150 310-170 310-280 310-380 310-410 310-560 310-680 310-950 311-180 +310-160 310-200 310-210 310-220 310-230 310-240 310-250 310-260 310-270 310-300 310-310 310-490 310-530 310-640 310-660 310-800 +310-590 310-599 310-890 311-270 311-280 311-480 + + diff --git a/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/policies.xml b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/policies.xml new file mode 100644 index 0000000..7f132aa --- /dev/null +++ b/xperia-firmware-upgrade/5g-policyman/policyman_backup_device_original/policies.xml @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/xperia-firmware-upgrade/SKILL.md b/xperia-firmware-upgrade/SKILL.md new file mode 100644 index 0000000..6c89903 --- /dev/null +++ b/xperia-firmware-upgrade/SKILL.md @@ -0,0 +1,143 @@ +--- +name: xperia-firmware-upgrade +description: Upgrade Sony Xperia 1 VI (XQ-EC72) firmware with newflasher without wiping data, keeping Magisk root. Use when asked to flash, upgrade, or update Xperia firmware downloaded with XperiFirm. +--- + +# Xperia firmware upgrade (keep data + Magisk root) + +Device: Sony Xperia 1 VI, model XQ-EC72, region `Customized SEA`. +Firmware lives in `/home/grmrgecko/Downloads/XperiFirm 5.8.1 (by Igor Eisberg)/` in folders named `XQ-EC72_Customized_SEA_`. +Tools: `~/bin/newflasher` (v57), `~/bin/unsin`, `fastboot`. + +## 1. Download firmware + +XperiFirm (Windows .exe in the folder above, runs under Wine/mono) downloads the +firmware into a new `XQ-EC72_Customized_SEA_` folder. Never downgrade — +the bootloader enforces anti-rollback (see `securitypatchlevel.dat`). + +## 2. Patch init_boot with Magisk + +Inside the new firmware folder: + +```sh +mkdir init_boot_X-FLASH-ALL-88DF +cd init_boot_X-FLASH-ALL-88DF +unsin ../init_boot_X-FLASH-ALL-88DF.sin # produces init_boot.img +``` + +Copy `init_boot.img` to the phone, patch it in the Magisk app +("Install" → "Select and Patch a File"), and copy the resulting +`magisk_patched-_.img` back into this same directory. + +## 3. Prepare the flash copy + +newflasher flashes every `.sin`/`.ta` in its working directory, so work on a +copy with the dangerous bits removed. From the XperiFirm folder: + +```sh +cp -r --reflink=auto "XQ-EC72_Customized_SEA_" "XQ-EC72_Customized_SEA_ copy" +cd "XQ-EC72_Customized_SEA_ copy" +rm persist_X-FLASH-ALL-88DF.sin +cp -r "../XQ-EC72_Customized_SEA_ copy/tadump" . +``` + +- **Remove `persist_X-FLASH-ALL-88DF.sin`** — persist holds per-device + calibration/DRM data; flashing it overwrites yours. This is the only file + removed. +- **`userdata_X-FLASH-ALL-88DF.sin` stays.** Data is preserved by answering + the "keep userdata?" prompt, not by deleting the file. +- **Carry the `tadump/` folder forward** from the previous version's copy. It + accumulates trim-area dumps (`tadump_N.ta`, numbered upward) — hard-brick + insurance. newflasher appends a new dump to it each flash. + +Verify the prep by diffing against the previous prepared copy: the only +differences from a fresh download should be `persist*.sin` gone, the +`init_boot_X-FLASH-ALL-88DF/` workspace dir, and `tadump/`. + +## 4. Flash with newflasher + +Power the phone off, then hold **Volume-Down** while plugging in USB — +**green LED** = flashmode (`lsusb` shows a `0fce:` Sony device). + +```sh +cd "XQ-EC72_Customized_SEA_ copy" +~/bin/newflasher +``` + +Prompt answers, in order: + +| Prompt | Answer | +|---|---| +| "…if you understand the risk" | `y` | +| "dump trim area" (optional) | `y` — saves into `tadump/` | +| "Do you want to keep userdata?" | **`y`** — this is the no-wipe step | +| "Reboot mode at the end of flashing" | `f` — go straight to fastboot for re-rooting | + +Non-interactive equivalent: `printf 'y\ny\ny\nf\n' | ~/bin/newflasher` + +## 5. Re-flash Magisk root + +The flash wrote the stock init_boot, so root must be restored. With the phone +in fastboot (blue LED — it's already there if you answered `f`; otherwise hold +**Volume-Up** while plugging in USB from power-off): + +```sh +fastboot flash init_boot init_boot_X-FLASH-ALL-88DF/magisk_patched-*.img +fastboot reboot +``` + +First boot after an upgrade takes a while. Open Magisk afterward to confirm +root survived. + +## 6. Re-enable US 5G (SEA firmware in the US) + +Flashing includes `modemst1`/`modemst2` `.sin` files, which reset the modem +EFS — any modem-side band/5G configuration is lost on every upgrade and must +be redone. + +- Old quick trick (worked through 69.2.A.4.16): dial `*#*#4636#*#*` → Phone + Information → toggle "Enable DSDS" off, re-enable, reboot (some users must + leave DSDS off). May only force the 5G icon rather than real NR. +- Current method: replace three RF-band policy files in the modem EFS + `/policyman` folder with the versions from XDA thread 4753150 ("Enable 5G & + Global RF Bands on Xperia", by htcmage) — `band_set_01.xml`, + `plmn_mcc_supported_01.xml`, `policies.xml` (adds T-Mobile / Verizon / AT&T / + Dish LTE+NR bands). The guide uses Windows QPST EFS Explorer; the Linux path + below is what actually worked here and needs no Windows. + + **Working Linux / adb procedure (done 2026-08-27, verified):** + 1. Download the 3 attachments from the thread (Chrome navigates directly to + each `xdaforums.com/attachments/...` URL — script-triggered downloads are + blocked; a real navigation downloads fine). Validate each is well-formed + XML with root `` / `` and `schema_ver="1"` matching + the device's existing files. + 2. Open the Qualcomm diag port: `adb shell su -c + 'setprop sys.usb.config diag,serial_cdev,rmnet,adb'`. Phone re-enumerates + as USB `05c6:9091` (adb survives). Bind the serial driver (needs root on + the PC): `sudo modprobe option && echo 05c6 9091 | sudo tee + /sys/bus/usb-serial/drivers/option1/new_id`. Diag port = `/dev/ttyUSB0` + (the one that answers a DIAG version request; ttyUSB1 is silent). + 3. Talk EFS2 over DIAG. EfsTools (JohnBel) is the usual tool but its + libnserial hits EIO on the option-driver port; the reliable path was a + small pyserial EFS2 client (HDLC + FCS-16, subsys 0x4B/EFS 19). Scripts + kept at `~/.../scratchpad/efs2.py` (+ `diag_probe.py`). It does: + hello → list `/policyman` → **back up** the 3 files → write new ones + (unlink then open `O_WRONLY|O_CREAT` perm 0777, 1 KB write chunks) → + read back and byte-compare to verify. + 4. `adb reboot`. Reboot clears diag mode back to normal adb. + 5. Verify: `dumpsys telephony.registry | grep isNrAvailable` → `true` + (stock SEA firmware shows false); `settings get global + preferred_network_mode` should be an NR mode (26 = NR_LTE_GSM_WCDMA). + + Backups of the device's original `/policyman` files: + `~/.../scratchpad/policyman_backup/`. Invalid XML can stop the modem from + booting — restore by writing the backups back, or reflash the modem `.sin` + files with newflasher. +- Hardware limit: band n71 does not work on the 1 VI; T-Mobile users see + LTE 2/12/66 and NR n41; n66 confirmed on Verizon. + +## 7. Cleanup + +Keep both the original and the " copy" folder for at least one more upgrade — +the copy is the reference for preparing the next version, and `tadump/` is +carried forward from it. Older versions than the previous one can be deleted.