Replicant

This xda post from last year might be helpful for this: https://forum.xda-developers.com/galaxy-s3/orig-development/official-lineageos-14-1-i9300-t3544531/post75981429#post75981429

I didn't understand where the interesting part was in that link.

In any case I've advanced a bit on this.

I've a Galaxy S that I need t fix as I need it for libsamsung-ipc work as we intend to continue supporting it in libsamsung-ipc but not in Replicant.

I don't know if I messed up and completely lost the EFS data or if it was like that when it was shipped to me (more likely).

• I've done tests with it and so far the proprietary RIL is able to recreate some files in /efs/ however if you do that you end up with a default IMEI (004999010640000).
• I've done some research on the modem firmware by reading libsamsung-ipc and looking at firmware headers, and I found that there is a NV partition inside the modem firmware. I've documented it in the Modem-partitions section of the XMMBoot page

So the next step would be to check if this NV partition is similar to the data that is created in the efs partition.

• Remove the GSM antenna and the SIM card to reduce the amount of sources of information that can result in the EFS being updated, and/or block and/or log the EFS update from the RFS protocol by patching the kernel.
• remove the nv_data.bin (after a good backup of course) and prevent access to the /efs filesystem after boot
• mount a local or remote filesystem backed by a log based filesystem to be able to easily reconstruct all the operations
• restart the ril through strace to validate that the NV partition is being copied later on
• Give back the permissions to write nv_data.bin, make sure that no nv_data.bin is present
• wait a bit for the file to be created
• recover and diff the various version of the nv_data file through the log based filesystem utilities

update: we can also block or log RFS messages

I've tried something faster on a Galaxy S (GT-I9000).

As libsamsung-ipc checks for the size of nv_data.bin, I did that:

$ adb shell "rm /efs/nv_data.bin /efs/nv_data.bin/md5 /efs/.nv_data.bak /efs/.nv_data.bak.md5" 
$ ddrescue -s 2097152 /dev/zero zero.bin
$ ./nv_data-md5 zero.bin
  5293814414abb3831e3fc1a1b35e69bc
$ adb push zero.bin /efs/nv_data.bin
$ adb shell "echo -n 5293814414abb3831e3fc1a1b35e69bc > /efs/nv_data.bin.md5" 
$ adb shell "killall rild" 

Then I wait several seconds and observe the message flowing in logcat -b radio

Then:

$ adb pull /efs/nv_data.bin ./
$ strings nv_data.bin

And I can observe the similar strings than with the nv_data.bin having been recreated by LineageOS.