76 (edytowany przez changliuxian 2026-04-05 14:44:26)

Odp: Stick 5G/LTE na SDX55

My device is the Compal RXM-G1. Currently, it only supports PCIe EP mode. For USB, I tried switching between 9165 and 9091 but still cannot connect to the network. Could you please provide the complete dd firmware image for the SG500M2-X?


[2026-04-05 21:29:51.649] SEND >>>>>>>>>> ati
[2026-04-05 21:29:51.649]
[2026-04-05 21:29:51.693] ati
[2026-04-05 21:29:51.693]
[2026-04-05 21:29:51.693] Manufacturer: COMPAL
[2026-04-05 21:29:51.693] Model: 334
[2026-04-05 21:29:51.693] Revision: RXMG1.20.00.244_0C
[2026-04-05 21:29:51.693] SVN: 01
[2026-04-05 21:29:51.693] IMEI: 359047100197712
[2026-04-05 21:29:51.693] +GCAP: +CGSM
[2026-04-05 21:29:51.693]
[2026-04-05 21:29:51.693] OK
[2026-04-05 21:29:51.693]
[2026-04-05 21:30:18.860] SEND >>>>>>>>>> AT+PRODUCTINFO
[2026-04-05 21:30:18.860]
[2026-04-05 21:30:18.905] AT+PRODUCTINFO
[2026-04-05 21:30:18.905]
[2026-04-05 21:30:18.905] SW_VERSION: RXMG1.20.00.244_0C
[2026-04-05 21:30:18.905] RFC_ID: 643
[2026-04-05 21:30:18.905] MMW_RFC_ID: 0
[2026-04-05 21:30:18.905] QC_VRSION: MPSS.HI.2.0.c3-00246-SDX55_CPEALL_PACK-1
[2026-04-05 21:30:18.905] SN number: 747840722
[2026-04-05 21:30:18.905] IMEI: 359047100197712
[2026-04-05 21:30:18.905] IMSI:
[2026-04-05 21:30:18.905] Phase_ID: MP
[2026-04-05 21:30:18.905] QCN_VERSION:ZX56_0.65-12
[2026-04-05 21:30:18.905]
[2026-04-05 21:30:18.905] OK
[2026-04-05 21:30:18.905]

https://img.cdn1.vip/i/69d2652ddfcfd_1775396141.webp
https://img.cdn1.vip/i/69d265659bb15_1775396197.webp

77

Odp: Stick 5G/LTE na SDX55

The OTA is not signed, so yo can modify it to cross-flash only modem firmware. I have used it to flash APAL firmware to VOS and then back. VOS is better, by the way...

Simply take the OTA zip, modify updater-script to only include last lines that flash modem firmware.

78 (edytowany przez changliuxian 2026-04-06 11:40:56)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

The OTA is not signed, so yo can modify it to cross-flash only modem firmware. I have used it to flash APAL firmware to VOS and then back. VOS is better, by the way...

Simply take the OTA zip, modify updater-script to only include last lines that flash modem firmware.

Can the Compal RXM-G1 directly flash the firmware of the VOS SG500M2-X? Can it be done by modifying updater-script? Will the signature verification pass?

79

Odp: Stick 5G/LTE na SDX55

Tritom module does not verify signature. You have the Compal module, so you need to answer questions if Compal can accept a modified update package that only flashes modem firmware.

80 (edytowany przez changliuxian 2026-04-06 12:27:48)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

Tritom module does not verify signature. You have the Compal module, so you need to answer questions if Compal can accept a modified update package that only flashes modem firmware.

I used the OTA of VOS SG500M2-X, modified the updater-script, and flashed it. The device can't boot now. It should be because the system partition is different.
My device is the Linksys version of the RXM-G1, which is different from the APAL and VOS versions.
# ---- radio update tasks ----

ui_print("Patching firmware images...");
write_raw_image(package_extract_file("firmware-update/NON-HLOS.ubi"), "modem");
write_raw_image(package_extract_file("firmware-update/sdxprairie-oemfs.ubi"), "oem");
write_raw_image(package_extract_file("firmware-update/sbl1.mbn"), "sbl");
write_raw_image(package_extract_file("firmware-update/tz.mbn"), "tz");
write_raw_image(package_extract_file("firmware-update/aop.mbn"), "aop");
write_raw_image(package_extract_file("firmware-update/devcfg.mbn"), "tz_devcfg");
write_raw_image(package_extract_file("firmware-update/hyp.mbn"), "qhee");
write_raw_image(package_extract_file("firmware-update/multi_image.mbn"), "multi_image");
write_raw_image(package_extract_file("firmware-update/uefi.elf"), "uefi");
write_raw_image(package_extract_file("firmware-update/xbl_cfg.elf"), "xbl_config");
write_raw_image(package_extract_file("firmware-update/abl.elf"), "abl");
ui_print("Patching remaining system files...");
set_metadata("/system/build.prop", "uid", 0, "gid", 0, "mode", 0644, "capabilities", 0x0);
unmount("/system");

81

Odp: Stick 5G/LTE na SDX55

Are you able to flash back Compal firmware to the modem? Do you have this Compal firmware that you could share? I won't be able to provide the system image in the next few days, maybe someone else from this thread.

82

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

Are you able to flash back Compal firmware to the modem? Do you have this Compal firmware that you could share? I won't be able to provide the system image in the next few days, maybe someone else from this thread.


I have backed up the complete partition firmware and can flash it back via EDL. What I want to do now is to flash all partitions using the VOS partition firmware, completely overwriting it to become VOS.
Currently the firmware only supports PCIe EP mode, and my DIY USB-to-2.5G adapter cannot be used.

83

Odp: Stick 5G/LTE na SDX55

Since you can restore the module to its original state, try doing the firmware-update and keep the boot.img in the update ZIP to flash the kernel.

84 (edytowany przez changliuxian 2026-04-07 12:11:54)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

Since you can restore the module to its original state, try doing the firmware-update and keep the boot.img in the update ZIP to flash the kernel.

I tried it, but it didn't work. Mine is the Linksys version, and the partition files are different from those in the APAL and VOS versions. I compared the hardware and it's the same. After the update, it still won't boot and only goes into 9008 mode.

85

Odp: Stick 5G/LTE na SDX55

Would you be able to share your backup from Compal RXM-G1?

86 (edytowany przez changliuxian 2026-04-10 11:10:56)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

Would you be able to share your backup from Compal RXM-G1?

Of course, but mine is a Linksys custom version and only supports PCIe EP mode. However, it does not include mtd2, the efs2 partition that contains the IMEI information.

https://drive.google.com/file/d/1jaGxP0 … sp=sharing

87

Odp: Stick 5G/LTE na SDX55

VOS backup, without efs2 that is not readable over SSH:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … o?e=4jOUSU

88 (edytowany przez changliuxian 2026-04-12 04:16:37)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

VOS backup, without efs2 that is not readable over SSH:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … o?e=4jOUSU

Thank you very much for sharing the firmware. I have successfully flashed it. Thank you!!!!!!!!!

[2026-04-11 11:22:15.083] SEND >>>>>>>>>> ati
[2026-04-11 11:22:15.083] 
[2026-04-11 11:22:15.087] ati
[2026-04-11 11:22:15.087] 
[2026-04-11 11:22:15.087] Manufacturer: Tri Cascade Inc.
[2026-04-11 11:22:15.087] Model: SG500M2-X
[2026-04-11 11:22:15.087] Revision: RXMG1.20.00.326_0R05
[2026-04-11 11:22:15.087] SVN: 02
[2026-04-11 11:22:15.087] IMEI:xxxxxxxxxxxxxxx
[2026-04-11 11:22:15.087] +GCAP: +CGSM
[2026-04-11 11:22:15.087] 
[2026-04-11 11:22:15.087] OK
[2026-04-11 11:22:15.087]

89 (edytowany przez changliuxian 2026-04-13 08:21:09)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

VOS backup, without efs2 that is not readable over SSH:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … o?e=4jOUSU


Still no luck. The last system partition gives an error, and even flashing it in chunks doesn't work.

90

Odp: Stick 5G/LTE na SDX55

The backup is made with dd over SSH. I guess you may have a better luck if you had backup made with EDL, but I am unable to provide it since my VOS is working at a remote location right now.

91 (edytowany przez changliuxian 2026-04-12 02:06:51)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

The backup is made with dd over SSH. I guess you may have a better luck if you had backup made with EDL, but I am unable to provide it since my VOS is working at a remote location right now.


I'll try flashing in chunks first. If that doesn't work, will I have to resort to backing up via EDL?Then can I continue waiting for you?
Could you please help me back up just the 'system' partition, aligning the blocks during the backup? The backup command via adb shell is: dd if=/dev/mtd25 of=/tmp/system.img bs=4096. When I back it up this way myself, the firmware size is about 113MB, and flashing it back works fine. The system image you backed up is a complete UBI image of 264MB — could that be the reason it can't be flashed?

92

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

The backup is made with dd over SSH. I guess you may have a better luck if you had backup made with EDL, but I am unable to provide it since my VOS is working at a remote location right now.

Hello, may I ask if that's possible?

93

Odp: Stick 5G/LTE na SDX55

I don't know how to put this device in EDL mode.

If I make the backup over SSH, the image content is always the same and the same size:

dd if=/dev/mtd27ro bs=4096
dd if=/dev/mtd27 bs=4096
dd if=/dev/mtd27ro

If you look at /proc/mtd, it clearly says that /system size is 0x10800000, that is 276 824 964 bytes.

When I run `ubireader_display_info` on your backup of system parition, I get this warning:

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

Your backup is missing data for cachefs, persist, systemrw and usrfs. Also, some data from rootfs is missing.

94 (edytowany przez changliuxian 2026-04-13 03:36:19)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

I don't know how to put this device in EDL mode.

If I make the backup over SSH, the image content is always the same and the same size:

dd if=/dev/mtd27ro bs=4096
dd if=/dev/mtd27 bs=4096
dd if=/dev/mtd27ro

If you look at /proc/mtd, it clearly says that /system size is 0x10800000, that is 276 824 964 bytes.

When I run `ubireader_display_info` on your backup of system parition, I get this warning:

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

Your backup is missing data for cachefs, persist, systemrw and usrfs. Also, some data from rootfs is missing.

/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 00d00000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02100000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 02b00000 00040000 "oem"
mtd25: 10800000 00040000 "system"
/ #

Maybe I made a mistake in backing up — there wasn't enough space in /tmp, so I only backed up a part of it. You backed up the complete system partition. However, I can't flash it using EDL; only this partition behaves this way.

95

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

I don't know how to put this device in EDL mode.

If I make the backup over SSH, the image content is always the same and the same size:

dd if=/dev/mtd27ro bs=4096
dd if=/dev/mtd27 bs=4096
dd if=/dev/mtd27ro

If you look at /proc/mtd, it clearly says that /system size is 0x10800000, that is 276 824 964 bytes.

When I run `ubireader_display_info` on your backup of system parition, I get this warning:

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

Your backup is missing data for cachefs, persist, systemrw and usrfs. Also, some data from rootfs is missing.

Only the last partition gives an error when flashing. Truncating part of it doesn't work, and flashing in chunks doesn't work either. I really don't know how to solve it.

/edl$ edl w system mtd25_system.backup \
  --memory=NAND \
  --sectorsize=4096 \
  --pagesperblock=64
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x000cf0e100000000 (MSM_ID:0x000cf0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDX55M:CD90-PH809"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Serial:            0xe433f729

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Possible loader available: /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin
sahara - Trying loader: /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21
firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21 
firehose - INFO: Chip serial num: 0 (0x0)
firehose - INFO: Supported Functions (15):
firehose - INFO: program
firehose - INFO: read
firehose - INFO: nop
firehose - INFO: patch
firehose - INFO: configure
firehose - INFO: setbootablestoragedrive
firehose - INFO: erase
firehose - INFO: power
firehose - INFO: firmwarewrite
firehose - INFO: getstorageinfo
firehose - INFO: benchmark
firehose - INFO: emmc
firehose - INFO: ufs
firehose - INFO: fixgpt
firehose - INFO: getsha256digest
firehose - INFO: End of supported functions 15
firehose
firehose - [LIB]: INFO: Calling handler for configure
firehose
firehose - [LIB]: INFO: Storage type set to value nand
firehose
firehose - [LIB]: WARN: NAK: MaxPayloadSizeToTargetInBytes sent by host 1048576 larger than supported 0
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=nand
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:2047
firehose - block_size:262144
firehose - page_size:4096
firehose - num_physical:1
firehose - manufacturer_id:44
firehose - serial_num:0
firehose - fw_version:
firehose - mem_type:NAND
firehose - prod_name:
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
firehose - Nand storage detected.
firehose - Scanning for partition table ...
Progress: |██████████| 100.0% Scanning (Sector 0x400 of 0x400, ) 0.00 MB/s                                              
firehose - Found partition table at sector 640 :)
firehose - Nand storage detected.
firehose - Scanning for partition table ...
firehose - 
Writing to physical partition 0, sector 63488, sectors 67584
Progress: |██████████| 100.0% Write (Sector 0x107E0 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E2 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E4 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E6 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E8 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EA of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EC of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EE of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F0 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F2 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F4 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F6 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F8 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FA of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FC of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FE of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x10800 of 0x10800, ) 0.00 MB/s                                             
firehose
firehose - [LIB]: Error:{}
Error writing mtd25_system.backup to sector 63488.

96 (edytowany przez kszaq 2026-04-13 18:08:35)

Odp: Stick 5G/LTE na SDX55

What is the size of the file if you make a backup of system partition with EDL? You can see that most bytes at the end of my backup file are "FF", so you can try to cut the bytes out from the ending and flash it.

You can also try using different loader:
https://github.com/bkerler/Loaders/tree … 72/quectel
or a loader from this guide:
https://github.com/1alessandro1/T99W175_Recovery

97 (edytowany przez changliuxian 2026-04-14 14:57:36)

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

What is the size of the file if you make a backup of system partition with EDL? You can see that most bytes at the end of my backup file are "FF", so you can try to cut the bytes out from the ending and flash it.

You can also try using different loader:
https://github.com/bkerler/Loaders/tree … 72/quectel
or a loader from this guide:
https://github.com/1alessandro1/T99W175_Recovery


edl$ ls -l mtd25_system.backup
-rwxr-xr-x 1 lxh lxh 276824064    7 01:43 mtd25_system.backu
rxmg1$ ls -l system.bin
-rw-rw-r-- 1 lxh lxh 276824064    20:14 system.bin

The partition sizes are consistent. Does the compatibility between firehose and EDL have something to do with NAND? I used the first EDL you recommended. I tried deleting a bit of the trailing 'FF' bytes using WinHex as you suggested, but flashing still doesn't work. The system partition I backed up myself can no longer be flashed back either. I can only go into 9008 or 900e mode now.

98

Odp: Stick 5G/LTE na SDX55

Let me highlight one fact again: I have zero knowledge about EDL and flashing the modem, I have never done this and I am simply trying to guide you towards a possible solution.

If I were you, I would follow the guide from GitHub for a different X55-based modem:
https://github.com/1alessandro1/T99W175_Recovery

I assume that you have all partitions flashed except for system.

I would try to make the modem boot into fastboot, then flash system (and anything else that you might have erased) in fastboot mode.

99

Odp: Stick 5G/LTE na SDX55

kszaq napisał/a:

Let me highlight one fact again: I have zero knowledge about EDL and flashing the modem, I have never done this and I am simply trying to guide you towards a possible solution.

If I were you, I would follow the guide from GitHub for a different X55-based modem:
https://github.com/1alessandro1/T99W175_Recovery

I assume that you have all partitions flashed except for system.

I would try to make the modem boot into fastboot, then flash system (and anything else that you might have erased) in fastboot mode.

I tested it according to the tutorial, but fastboot doesn't work either.

edl$ fastboot  flash system mtd25_system.backup
Warning: skip copying system image avb footer (system partition size: 260046848, system image size: 140724464235144).
Sending sparse 'system' 1/1 (127964 KB)            FAILED (remote: 'Error: Last flash failed : Volume Full')
fastboot: error: Command failed
edl$ fastboot -S 256M flash system mtd25_system.backup
Warning: skip copying system image avb footer (system partition size: 260046848, system image size: 140726402511784).
Sending sparse 'system' 1/1 (127964 KB)            OKAY [  3.172s]
Writing 'system'                                   OKAY [  0.000s]
Finished. Total time: 3.938s

100

Odp: Stick 5G/LTE na SDX55

It looks like your second try worked.