# [Guide] Convert 950 DS RM-1118_13058 (059X5G2) into an ATT Lumia 950 (RM-1105_12716)



## nate0 (Jan 8, 2017)

I could not find a thread to walk through being able to get my Dual Sim 950 to officially work on AT&T with VoLTE and other services (Enhanced LTE/HD Voice etc...).  I searched many forums and threads to find a way to do this.  I got tired of the lack of call quality and other quirks for my Lumia while on ATT.  After accumulating several different pieces of information from multiple sources and places on the xda forum I was able to make it work. This is my first official post with the intention of it being a guide, offer tips if you want.  Or if you see errors offer advice or suggestions if needed.  

I am only posting this in the event someone else needs the information or wants to use it in some way.  Messing with hidden partitions is risky and so if you brick your device using this thread, I'm sorry but I cannot help you.  So if you choose to use these directions, use them at your own risk.  I cannot be remote technical support.  Thanks.

Here is how I got this to work.

Steps I used to convert NAM 950 DS RM-1118_13058 (059X5G2) to an ATT Lumia 950 (RM-1105_12716 059X4D9)

-1- First I flashed this specific original rom for my Dual Sim 950. I used the ffu located here. 

-- thor2 -mode uefiflash -ffufile "RM1118_1078.0027.10586.13058.15358.030FF5_retail_ prod_signed.ffu"


-2- Second I manually pushed three cabs to my phone to alter the plat ID to  Microsoft.MSM8992.P6218_ATT.1.0. All three were alone in the directory. Listed them below:
mmo.device_talkman_lte_americas.phone.plat_d20cefe ddb10fb6737b56fa966533783b1288e44.cab
mmo.base.variant.plat_55ce525fdf57ab0d614ada3517c3 4c84029f5437.cab
mmo.base.phone.plat_96ea6a2d24151eaf6299c342f81f49 997ca44137.cab

-- iutool.exe -v -p "C:\CABs\Your_Location-of-RM-1105_Plat-cabs"


-3- Third I did a full NVI flash and Reset with an ATT ROM. Link to location of ffu I used here.
FFU File used: RM1105_1078.0053.10586.13169.12716.035044_retail_ prod_signed.ffu

-- thor2 -mode uefiflash -ffufile "RM1105_1078.0053.10586.13169.12716.035044_retail_ prod_signed.ffu" -do_full_nvi_update -do_factory_reset


-4- Fourth I updated the product code.  (Note: I never kept my phone on the ATT ROM long enough to see if this was really needed, but I suspected potentially an OTA update might revert it back to the Dual Sim variant.)

-- thor2 -mode uefiflash -ffufile RM1105_1078.0053.10586.13169.12716.035044_ret ail_prod_signed.ffu -productcodeupdate 059X4D9 -skip_flash

After it is finished while in this mode you can run thor2 -mode rnd -readdeviceinfo to check the device details also to verify the changes.

-5- Fifth I registered an imei of the att Lumia 950 I had to my ATT account to have ims registration complete.


Steps I used to convert back to NAM 950 DS RM-1118_13058 (059X5G2) from an ATT Lumia 950 (RM-1105_12716 059X4D9)

-1- First I flashed this specific ATT ROM. The one I used is located here.

-- thor2 -mode uefiflash -ffufile "RM1105_1078.0017.10586.13053.12716.02FBB4_retail_prod_signed.ffu"


-2- Second I manually pushed three cabs to my phone to alter the plat ID back to Microsoft.MSM8992.P6218.1.0. All three were alone in the directory. Listed them below:
mmo.base.phone.plat_8bab003dbd82a4acc5989f812a0dcd284eccfe43.cab
mmo.base.variant.plat_c7b2c481e64fe6a806f52df8f5f55c59fbb6a81e.cab
mmo.device_talkman_lte_row_dsds.phone.plat_d7303236cd88dda5a304701d5b59b0c2d5260d7c.cab

-- iutool.exe -v -p "C:\CABs\Your_Location-of-RM-1118_Plat-cabs"


-3- Third I did a full NVI flash and Reset with a NAM 950 DS ROM. Link to the ffu Iocation here. 
FFU File used: RM1118_1078.0027.10586.13058.15358.030FF5_retail_prod_signed.ffu

-- thor2 -mode uefiflash -ffufile "RM1118_1078.0027.10586.13058.15358.030FF5_retail_prod_signed.ffu" -do_full_nvi_update -do_factory_reset


-4- Fourth I updated the product code back to the NAM Lumia 950 DS variant just in case.

-- thor2 -mode uefiflash -ffufile RM1118_1078.0027.10586.13058.15358.030FF5_retail_prod_signed.ffu" -productcodeupdate 059X5G2 -skip_flash

What helped immensely was being able to locate and find those cab files. They are added here for convenience. I found a thread posted here on the forums that helped a ton. Even if it was a cumulative effort, a thanks to @TristanLeBoss for posting it.


----------



## hikari_calyx (Jan 8, 2017)

Thanks for your tutorial, OP.
In China most of us bought AT&T Variant Lumia 950 (RM-1105). However, the China Variant Firmware works best as far as I know.
Would you mind my repost it to Chinese Community?


----------



## nate0 (Jan 8, 2017)

hikari_calyx said:


> Thanks for your tutorial, OP.
> In China most of us bought AT&T Variant Lumia 950 (RM-1105). However, the China Variant Firmware works best as far as I know.
> Would you mind my repost it to Chinese Community?

Click to collapse



What model is the Chinese variant?  Is it a RM-1104?


----------



## DilanChd (Jan 8, 2017)

To delete.


----------



## nate0 (Jan 8, 2017)

In that case being both are dual sim, in theory these directions should work.  But I'm not certain if the cabs are identical or if the directions could be improved for that model.  In either case you're more than welcome to use what I found here.

Edit: Wait my mistake were talking about the lumia 950 here...RM-1116 Is the xl. 

Update: If the Chinese model is also an RM-1118 I'm not sure how that will work since I converted my dual sim RM-1118 to the AT&T single sim.  You need to go from an AT&T single sim to a dual sim ROM...I simply lost the ability to use my second sim slot.


----------



## DilanChd (Jan 8, 2017)

To delete.


----------



## nate0 (Jan 8, 2017)

DilanChd said:


> Not found a Chinese package for RM-1104 (Lumia 950) and for RM-1085 (Lumia 950 XL), even from multivariants packages. Just found for RM-1116 (Lumia 950 XL Dual SIM) and for RM-1118 (Lumia 950 Dual SIM). RM-1105 (Lumia 950) is excluded due to it's an exclusive AT&T hardware variant.
> 
> RM-1116 VAR APAC CN CV
> 059X4Z0 RM-1118 VAR APAC CN CV
> ...

Click to collapse



Do the RM-1127 and RM-1128 have the same PlatformID? 

The cab files in the RM-1105 folder allowed me to change the PlatformID of my Dual sim RM-1118 to match that of the AT&T variant. Only then I could flash the AT&T ROM to it.


----------



## DilanChd (Jan 8, 2017)

To delete.


----------



## nate0 (Jan 8, 2017)

DilanChd said:


> To be honnest, I hadn't carefull if the Platform ID matches beetween RM-1127 and RM-1128. But, I think they matches, because otherwise I would not have been able to flash so easily.
> 
> Yep, I know. You can see if Platform ID of RM-1118 matches with RM-1104 ?

Click to collapse



I think the PlatformID matches between RM-1104 and RM-1118, but I'm not certain. Someone would need to verify that.


----------



## hikari_calyx (Jan 8, 2017)

nate0 said:


> I think the PlatformID matches between RM-1104 and RM-1118, but I'm not certain. Someone would need to verify that.

Click to collapse



In Mainland China, Lumia 950 and 950 XL are RM-1118 and RM-1116. The code of 950 is 059X4Z0.
We have already tested RM-1116 China Variant Firmware on RM-1085 from Hong Kong or European countries even the prototype for Telstra in Australia, and RM-1118 China Variant Firmware Firmware on RM-1104 from Hong Kong and RM-1118 from US.


----------



## DilanChd (Jan 8, 2017)

To delete.


----------



## nate0 (Jan 8, 2017)

I'll add also, that after flashing with the RM-1105 ROM I lost LTE band 17 but gained band 30.  

The device also retained a device detail of TYPE being RM-1118 even though the product code and PlatformID were that of the RM-1105.  You could see this using the device info command with thor2 or by going to Extras --> Advanced  Info.


----------



## hikari_calyx (Jan 9, 2017)

nate0 said:


> I'll add also, that after flashing with the RM-1105 ROM I lost LTE band 17 but gained band 30.
> 
> The device also retained a device detail of TYPE being RM-1118 even though the product code and PlatformID were that of the RM-1105.  You could see this using the device info command with thor2 or by going to Extras --> Advanced  Info.

Click to collapse



In China, we found it's possible to add another SIM slot on Lumia 950 RM-1104 and Lumia 950 XL RM-1085 bought from European countries or Hong Kong. After the modification and flash to China Variant Firmware, the second SIM slot works fine. The Typelabel is flashed along with VPL file, and the Typelabel doesn't change if you flash FFU only. 
Because the China Variant Lumia 950/XL (RM-1118/1116) is much more expensive than other variant with only single SIM slot, Chinese resellers from Shenzhen have found a way to modify other variant of Lumia 950/XL into China Variant (RM-1105 AT&T Variant is not included right now).  
BTW, my brand new Lumia 950 XL RM-1116 (Unlocked, Without Contract, China Variant) cost me 2,600 Chinese Yuan (About $376).


----------



## nate0 (Jan 9, 2017)

hikari_calyx said:


> In China, we found it's possible to add another SIM slot on Lumia 950 RM-1104 and Lumia 950 XL RM-1085 bought from European countries or Hong Kong. After the modification and flash to China Variant Firmware, the second SIM slot works fine.

Click to collapse



With this does that include a hardware modification?

Also, I'm curious and would like to know how popular Windows 10 Mobile is for China users?

Thanks.


----------



## hikari_calyx (Jan 9, 2017)

nate0 said:


> Whith this doess that include a hardware modification?
> 
> Also, I'm curious and would like to know how popular Windows 10 Mobile is for China users?
> 
> Thanks.

Click to collapse



Yes it is. Here's how it works: http://bbs.wfun.com/thread-966790-1-1.html
You may need a translator, it's in Chinese but lots of pictures provided.

In China, only minor users use Windows 10 Mobile, most of users use Android Phone or iPhone. If I met someone who use Lumia Phone or other else (e.g. HTC One M8 for Windows, HP Elite x3), I'd get excited and talk to him or her.


----------



## anubis23 (Jan 9, 2017)

Hey guys, glad to see someone released this. Just to add to the guide, I successfully did this a few months ago, however to add to the OPs offering, my initial findings also allows you to flash a single sim rom to a DS*phone, along with a DS rom to single sim phone, however the main problem is that most of the update settings will not take affect because of the modem flashing is done in a way that the phone retains it on a separate partition on the phone that we don't have access too. The nvi flashing from a rom that is not native to the phone doesn't seem to flash or retain onto the phone. However this will definitely enable users to get raid of the ATT stock stuff. Something to also be extremely cautious too is that when using WDRT it sometime will not recognize the phone product code to recover and/or it will reflash the "stock" product code rom that was on the original phone, even if you updated the productcode throught thor2.


----------



## nate0 (Mar 1, 2017)

anubis23 said:


> Hey guys, glad to see someone released this. Just to add to the guide, I successfully did this a few months ago, however to add to the OPs offering, my initial findings also allows you to flash a single sim rom to a DS*phone, along with a DS rom to single sim phone, however the main problem is that most of the update settings will not take affect because of the modem flashing is done in a way that the phone retains it on a separate partition on the phone that we don't have access too. The nvi flashing from a rom that is not native to the phone doesn't seem to flash or retain onto the phone. However this will definitely enable users to get raid of the ATT stock stuff. Something to also be extremely cautious too is that when using WDRT it sometime will not recognize the phone product code to recover and/or it will reflash the "stock" product code rom that was on the original phone, even if you updated the productcode throught thor2.

Click to collapse



I am now curious if this type of scenario of applying a PlatformID change works for the XL model  Any thoughts?

The reason I bring this up, and also strike my curiosity would be all the *8994*.dll and other files included on the 950 FFUs along with the 8992 files.  Is the common theme between the xl and non-xl model?  If so what purpose does that serve?  Thanks.


----------



## JoostL (Apr 30, 2017)

Hey guys, I want to do this with my Lumia 950 XL Dual Sim (059X4S4) en convert it to single sim (059X4X5). Does anyone have the .CAB files needed to change the Platform ID or know where I can get them? I can't find them anywhere.


----------



## nate0 (May 1, 2017)

JoostL said:


> Hey guys, I want to do this with my Lumia 950 XL Dual Sim (059X4S4) en convert it to single sim (059X4X5). Does anyone have the .CAB files needed to change the Platform ID or know where I can get them? I can't find them anywhere.

Click to collapse



Most if not all Lumia FW are stored here. The one I pasted includes ffu's for 059X4X5.  The PLAT ID change is only needed for certain Carrier variant device ROMs.  I do not think you need to change the Platform ID for moving from the 059X4S4 product ROM to the 059X4X5 SS product ROM.


----------



## JoostL (May 1, 2017)

Thanks! I did indeed come across that website but I thought I also needed to change the PLAT ID.
I successfully flashed my 950XL with the 059X4X5 ROM.


----------



## Astranomcial (Sep 28, 2017)

nate0 said:


> What helped immensely was being able to locate and find those cab files. They are added here for convenience. I found a thread posted here on the forums that helped a ton. Even if it was a cumulative effort, a thanks to @TristanLeBoss for posting it.

Click to collapse



This is a really useful post. I just purchased a Lumia 950 off eBay as a "backup" phone to my main L950. It came from Hong Kong as an AT&T RM-1105. I would like to change it to an RM-1104 059X5J0 to match my main phone. 

I searched through the xda forums and could not find reference to how you found the plat cab files. Are you able to provide a link to the advice or the files? As I said I am after the RM-1104 files.  

Of interest I also found another forum with instructions on how to change the product code (which was not mentioned in your post). It is...
Enter the following command: thor2 -mode uefiflash -ffufile "RM1104_neu.ffu" -productcodeupdate 059X4V9 -skip_flash
... and was completed after the flashing if the ffu files.


----------



## nate0 (Sep 28, 2017)

Astranomcial said:


> This is a really useful post. I just purchased a Lumia 950 off eBay as a "backup" phone to my main L950. It came from Hong Kong as an AT&T RM-1105. I would like to change it to an RM-1104 059X5J0 to match my main phone.
> 
> I searched through the xda forums and could not find reference to how you found the plat cab files. Are you able to provide a link to the advice or the files? As I said I am after the RM-1104 files.
> 
> ...

Click to collapse



You can find them on the catalog for Microsoft. Here I found it using the carrier variant 000-AU RM-1104 is a bit down the page.  You need the RM-1105 on an older FW version than the plat cab file version you push to it. Otherwise it will fail.  
https://www.catalog.update.microsoft.com/Search.aspx?q=000-AU
I downloaded one here just so you can examine it.

Edit: Changing the product code will help when restoring via Windows Device Recovery tool, so you do not flash the original fw back to it or attempt to.
Edit 2: The other thing I did not think of, and am not sure about...is if the RKH key does not match from the RM-1105 model you have to the RM-1104 model ffu.  I think it does but you want to check it before pusing that cab file other wise you are up a creek.


----------



## nate0 (Sep 28, 2017)

@Astranomcial
https://forum.xda-developers.com/windows-10-mobile/windows-10-iot-holographic-mobile-cbs-t3505752


----------



## Astranomcial (Sep 28, 2017)

nate0 said:


> You need the RM-1105 on an older FW version than the plat cab file version you push to it. Otherwise it will fail.

Click to collapse



OK. So the FW current on the device (RM-1105) is 01078.00053.16236.35035 which is the latest. LumiaFirmware.com also has 01078.00038.16025.39033 and 01078.00017.15454.29031. The latest RM-1104 FW is 01078.00053.16236.35014 which by the lower number I assume would be counted as being an older version by your logic. Is this a fair assumption? Therefore I would install 01078.00038.16025.39033 first, right?

You also linked only 1 of the 3 plat cab files you used in your example. I assume I need to use all 3 of these ("mmo.base.phone.plat_", "mmo.base.variant.plat_", "mmo.device_talkman_lte_row.phone.plat_") from the RM-1104 bundle?



nate0 said:


> Edit 2: The other thing I did not think of, and am not sure about...is if the RKH key does not match from the RM-1105 model you have to the RM-1104 model ffu.  I think it does but you want to check it before pusing that cab file other wise you are up a creek.

Click to collapse



Please excuse my ignorance, but what is an RKH key and how would I check this?


----------



## nate0 (Sep 28, 2017)

@Astranomcial 
"Therefore I would install 01078.00038.16025.39033 first, right?" 
-- Yes. And just to note that this PLAT cab I gave in the thread above includes the pconf.bin that updates the plat id to P6218 and its sw version is "01078.00053.16236.35000"

" I assume I need to use all 3 of these ("mmo.base.phone.plat_", "mmo.base.variant.plat_", "mmo.device_talkman_lte_row.phone.plat_") from the RM-1104 bundle?"
-- I have pushed only the PLAT ID cab before and it worked.  But it won't hurt to push all three.  I included the method of doing all 3 cabs since that is how I converted the Dual sim, and everything worked out in the end multiple times consistently.  Technically everything in that FW catalog update should be normally updated on the phone together OTA (over the air), but our goal is just to be able to flash the FFU for the other variant in the end.  I am not positive on if the FW included in the FFU populates everything found in the catalog once flashed or if the OTA updates is what upgrades those portions.   You could try to flash an older RM-1104 FW FFU once you push the PLAT ID and take the FW updates as they come over OTA just to make sure you phone has all the updates it needs.  But that choice is up to you.

"Please excuse my ignorance, but what is an RKH key and how would I check this? "
-- (Root Key Hash) You can check the RKH by running thor2 -mode rnd -readdeviceinfo with your phone plugged in.  It will be somewhere in the output.  Compare that RKH to the value found on the FFU you want to flash by running thor2 -mode ffureader -ffufile "RM11xx_xxx.ffu" to run an integrity check on the ffu, it will show the RKH value at the bottom of the output on that command.  The main reason I said that, is so that you do not get stuck with a platform ID that you cannot revert back from. If that happened and the RKH does not match the ffu you want then you are stuck unable to flash the device unless you can revert the PLAT ID back.  This should not be a problem, so long as you can go back to the original PLAT id with a cab package that is newer than one of the firmwares available on the device.  The good news is that the RKH of the RM-1104 matches that of the RM-1105 FFU. So no worries on your side.


```
--From the RM-1104 FFU--
Number of partitions found 38
RKH of SBL1: [B]9CFA9ADB101CE41EC5E0B4BF586BCD37A4BA931FD975F99952485FEF0E7BDFA4[/B]
RKH of UEFI: 9CFA9ADB101CE41EC5E0B4BF586BCD37A4BA931FD975F99952485FEF0E7BDFA4
Platform ID: Microsoft.MSM8992.P6218
```


```
--From the RM-1105 FFU--
Number of partitions found 38
RKH of SBL1: [B]9CFA9ADB101CE41EC5E0B4BF586BCD37A4BA931FD975F99952485FEF0E7BDFA4[/B]
RKH of UEFI: 9CFA9ADB101CE41EC5E0B4BF586BCD37A4BA931FD975F99952485FEF0E7BDFA4
Platform ID: Microsoft.MSM8992.P6218_ATT
```

FYI: I think earlier in the posts someone has already explained similar to what you are trying to do using a China ffu against the RM-1105.


----------



## Astranomcial (Oct 3, 2017)

OK. So I have completed the update and it seems to have *mostly* worked. The AT&T splash screen at boot up and the extra features have been removed. It defaulted to Australia and not the US on initial boot. The Product Code has been updated (now 059X5J0) but the Type is still listed as being an RM-1105....

Starting to read Phone Info
Detecting UEFI responder
Send HELLO
HELLO success
Lumia Flash App detected
Disable time-outs
Read FlashApp Build Info
Read parameter from UEFI Flash App
Read parameter Ok
FlashApp Build Info: Date:Jun 11 2016 Time:14:22:42 Info:-
Transfer size: 2363392
Sublock ID 31
Buffer size: 2359296
Number of sectors: 61071360
PlatformInfo is Microsoft.MSM8992.P6218.1.0
Async protocol version: 01
Security info sublock detected
Platform secure boot enabled
Secure FFU enabled
JTAG eFuse blown
RnD Certificate not found
Authentication not done
UEFI secure boot enabled
SHK enabled
Device supports FFU protocols: 0015
Sublock ID 32
Read Root Key Hash
Read parameter from UEFI Flash App
Read parameter Ok
Root Key Hash is 9CFA9ADB101CE41EC5E0B4BF586BCD37A4BA931FD975F99952485FEF0E7BDFA4
Read public ID
Read parameter from UEFI Flash App
Read parameter Ok
Public ID is 8DAC648681C0EF57846AA3A7A2312F07F763ED78
Protocol version 2.41 Implementation version 2.75
Booting to PiApp
Reboot to PiApp command sent successfully.
Detecting UEFI responder
Send HELLO
HELLO success
Lumia Phone Info detected
Disable time-outs
Protocol version 2.5 Implementation version 2.24
Read Phone Info
Phone Info:
Version: 2.5.2.24
TYPE: RM-1105
BTR: 059W6R2
LPSN: B6290EDAU
HWID: 2132
CTR: 059X5J0
MC: 0206502

Could this be because the flashing of the CABs appeared to hang? I got this...
[1] Transferring files started
[1] Transferring files complete: 3 files
[1] Update started
...and then it just sat there but the phone dropped back to the language selection screen. I ended up CRTL-BRK-ing it the process after a while as nothing appeared to be happening on the phone or PC. I found online on another forum that they got...
[1] Transferring files started
[1] Transferred file 1/3
[1] Transferred file 2/3
[1] Transferred file 3/3
[1] Transferring files complete: 3 files
[1] Update started
[1] Installation succeeded
[1] Succeeded

Any thoughts? Should I do it again (revert to AT&T and come back)? Why would the iutool have failed at transferring the cabs? How long should they take to transfer?


----------



## nate0 (Oct 3, 2017)

So did you flash the RM-1104 ROM already?
IUTOOL will push the cab files in preparation for install.  The phone should reboot, and install the cab files.  It is possible your phone was trying to download updates or something at that time while it was on wifi, being it is on an older fw.

The RM-1105 model name might be pulled somewhere else, from some other partition.  I do not think I ever got that to change either.  If you find a way let me know.


----------



## Astranomcial (Oct 4, 2017)

nate0 said:


> So did you flash the RM-1104 ROM already?
> IUTOOL will push the cab files in preparation for install.  The phone should reboot, and install the cab files.  It is possible your phone was trying to download updates or something at that time while it was on wifi, being it is on an older fw.

Click to collapse



Yes, and everything worked except for the Type changing. Wi-Fi would not have affected anything as it was connected to any networks as I skipped the WiFi and account setup when the phone booted. 
When I used IUTOOL I *think* the phone rebooted prior to the process hanging on the PC. I tried again and the second and third times it did NOT reboot (possibly as it had nothing new to process?). The reason I say "*think*" is because I did it 3 times I am not 100% sure.



nate0 said:


> The RM-1105 model name might be pulled somewhere else, from some other partition.  I do not think I ever got that to change either.  If you find a way let me know.

Click to collapse



There is a German forum (not sure it's cool to post the link here though?) where they implied it changed the type as well. May have to ask there. Will let you know if I work it out!


----------



## gordonfatpanam (Aug 11, 2018)

*[Success?] Does this work on 950 XL?*

There doesn't appear to be a set of platform CABs for ATT-US for the 950 XL (RM-1085 059X7S5) on Windows Update, but there is a set for 000-US (059X7F5, S replaced with F). I found those. But there are four of them instead of three:

mmo.base.phone.plat_de0dbb85351e09128a6078ee19c8331b24e9e7e2.cab
mmo.base.variant.plat_6ee32305caa6a37b0085c9285bd12eb2a8b89357.cab
mmo.device_cityman_lte_row.phone.plat_7ccede211347774a1b158afd335b2617d18f55cd.cab
mmo.soc_qc8994.phone.plat_7911cddc337ffd9ff09ebcd90d065fdb351cb988.cab

Given the same instructions, can I rebrand a 950 XL using these CABs?

[Update 11 AUG] I'm not sure how it worked, but it worked.

I followed the OP's instructions using a version of iutool.exe from the WP 8.1 kit (that 4 GB monster kit) and a version of thor2.exe from the WD Recovery suite.

The steps were to flash the phone's original image, then boot to Welcome, then upload those four CAB files (iutool.exe has error 0x8024A110 but still worked?), then re-flash with new image with -do_full_nvi_update and -factory_reset, then change product code with thor2 -skip_flash, then reboot.

I'm not sure why this worked because uploading the platform CABs failed with that error code, suggesting more than one of the CABs was manipulating the same files or partition.

Now if I could just find a set of AT&T platform CABs, I might be able to rebrand this as an AT&T device. But Windows Update doesn't have RM-1085 ATT-US platform CABs so the 000-US ones had to do.


----------



## nate0 (Aug 11, 2018)

gordonfatpanam said:


> There doesn't appear to be a set of platform CABs for ATT-US for the 950 XL (RM-1085 059X7S5) on Windows Update, but there is a set for 000-US (059X7F5, S replaced with F). I found those. But there are four of them instead of three:
> 
> mmo.base.phone.plat_de0dbb85351e09128a6078ee19c8331b24e9e7e2.cab
> mmo.base.variant.plat_6ee32305caa6a37b0085c9285bd12eb2a8b89357.cab
> ...

Click to collapse



Edited:
As far as I know there are no known cabs for the 950 XL ATT model. There is only an FFU.  In order to flash that ffu you have to boot loader unlock the 950 XL with WP Internals 2.4.  Mount the PLAT partition.  Then go in manually and edit the pconf bin file so you change to a ATT variant.  Then you can flash that FFU which in theory should have the system files and other settings to be used by the ATT carrier.


----------



## gordonfatpanam (Aug 11, 2018)

nate0 said:


> Edited:
> In order to flash [ATT-US] ffu you have to boot loader unlock the 950 XL with WP Internals 2.4.  Mount the PLAT partition.  Then go in manually and edit the pconf bin file so you change to a ATT variant.

Click to collapse



I did a lot of exploring using WP Internals 2.4. Unlocked, relocked, bricked, unbricked, and wasted a whole evening learning the ropes. Never figured out which partition was the platform partition (there are 32 of them!) or even what file system driver to use to read it. But it's pconf eh? I might have seen one of those somewhere while exploring.

And the PLAT is the killer if one messes things up.

OK, I'll keep hunting.

[Another update] I can't find a pconf.bin on this phone like other posts explain about. I found several device-specific files in the very first partition (DPP) but I don't believe I'll go messing with that today. This link from MS goes over a Windows 10 Mobile partition layout, and makes clear that any FFU image doesn't touch the very first partition. And I can't read the very first partition on any FFU I downloaded, making me think this is a placeholder only.

That's enough exploring for today, anyway. I have a 000-US phone, which is more than I had earlier today, and that's something. Maybe I'll figure out what is in those 000-US CABs and then hand-replace some files, if I get brave enough.

[Update again!] Now I remember.... pconf.bin resides on the mmo.base.phone.plat CAB file. It is a text file with three strings. I couldn't find a corresponding file on the phone, though, and I looked hard. Maybe installing this CAB with iutool writes some files elsewhere on the phone.

Great, now all I need is a way to upload self-signed CABs to this phone and I can spoof an ATT one.  Or not. Some other day maybe.


----------



## nate0 (Aug 12, 2018)

gordonfatpanam said:


> I did a lot of exploring using WP Internals 2.4. Unlocked, relocked, bricked, unbricked, and wasted a whole evening learning the ropes. Never figured out which partition was the platform partition (there are 32 of them!) or even what file system driver to use to read it. But it's pconf eh? I might have seen one of those somewhere while exploring.
> 
> And the PLAT is the killer if one messes things up.
> 
> ...

Click to collapse



The pconf.bin file is located on the PLAT partition. You cannot access that partition without having mass storage mode enabled, or like you said unless you are able to send a signed package to the phone that will provision/update that file on the PLAT partition.


----------



## nate0 (Aug 12, 2018)

In a thread by @the_R4K_ he gives a fairly easy way to identify that partition.


----------



## gordonfatpanam (Aug 12, 2018)

nate0 said:


> In a thread by @the_R4K_ he gives a fairly easy way to identify that partition.

Click to collapse



OK I'll try again. I was able to enable mass storage mode again. WP Internals even mounted MainOS and there were NTFS mount points from there to four others. As a result I could browse five of the 30+ partitions, including the first one, DPP.

Nothing was labeled PLAT in Disk Management or diskpart, but it wouldn't have surprised me if the phone's partitions had edited identifiers. I could try ext2fsd as an alternative to diskpart.

[Update] Fascinating. ext2fsd was able to locate and mount the PLAT partition, on both the phone and on the ATT FFU when I used a VHD conversion tool for it.

So I was able to hand-copy pconf.dat from the ATT FFU to the phone, then I could flash the phone and change its product code. The bad news is the ATT FFU didn't have the AT&T logo or AT&T-specific apps. Call Forwarding still isn't working either. The good news is that Voice over LTE is now available, something I didn't have before, and the other settings all look like they belong to AT&T.

I'm not sure I'd recommend this operation to anyone else. It required multiple tools to do different things. At least with a carrier that isn't AT&T, you have access to platform CABs on Windows Update and can do this with Microsoft-supported tools only. If there's enough demand I might write altered instructions, but considering Windows Phone's almost dead it doesn't seem worth it.


----------



## nate0 (Aug 17, 2018)

gordonfatpanam said:


> OK I'll try again. I was able to enable mass storage mode again. WP Internals even mounted MainOS and there were NTFS mount points from there to four others. As a result I could browse five of the 30+ partitions, including the first one, DPP.
> 
> Nothing was labeled PLAT in Disk Management or diskpart, but it wouldn't have surprised me if the phone's partitions had edited identifiers. I could try ext2fsd as an alternative to diskpart.
> 
> ...

Click to collapse



I think all this also can be avoided by just enabling VoLTE only on the 950 XL through modem provision files and cabs then calling AT&T and having them white list your IMEI as a VoLTE capable device.


----------



## zhiyong (Nov 2, 2018)

Can't find "RM1118_1078.0027.10586.13058.15358.030FF5_ret ail_ prod_signed.ffu" on lumiafirmware.com anymore.
can anyone upload it and share the link, or tell me where to download it.
Thanks.


----------



## nate0 (Nov 5, 2018)

zhiyong said:


> Can't find "RM1118_1078.0027.10586.13058.15358.030FF5_ret ail_ prod_signed.ffu" on lumiafirmware.com anymore.
> can anyone upload it and share the link, or tell me where to download it.
> Thanks.

Click to collapse



I can locate it. Under https://www.lumiafirmware.com/ser/RM-1118/guid/059X5G2


----------



## zhiyong (Nov 9, 2018)

nate0 said:


> I can locate it. Under https://www.lumiafirmware.com/ser/RM-1118/guid/059X5G2

Click to collapse



find it！ thanks.


----------

