Pixel (Tensor chip) IMEI modification guide

Privacy
1

This guide covers Pixel 6, 6 Pro, 6a, 7, 7 Pro, 7a, Fold, 8, 8 Pro, 8a, 9, 9 Pro, 9 Pro XL, 9 Pro Fold, 9a

For context and prior discussions, please see:

A rooted device must be used to perform any actions. All changes will persist after a factory reset and bootloader lock, and this guide does not encourage you to have a rooted device as a daily driver. For educational and research purposes only

Background
Since the release of the Pixel 6 in 2021, Google has switched from Qualcomm to Samsung modems in their G-series Tensor SoCs. The modem’s codename is called “Shannon” and it is largely the same as used on Exynos devices.

For Google, Samsung added a few extra AT commands to interact with the modem, presumably for carrier testing and other regulatory requirements. A small subset of what was possible to send to it is documented here:

Notice the AT+GOOGSETNV prefix, everything starts with AT+GOOG is Pixel specific on those modems. We will come to that later.

The IMEI, together with all other hardware identifiers is stored in a file called devinfo.
A simple parser in Python can be found here:

Steps
To get devinfo, we first need to get a root shell:

adb shell
su
dd if=/dev/block/by-name/devinfo of=/sdcard/devinfo.img
adb pull /sdcard/devinfo.img

From here, you can change the SKU of the device, for example to change the JP variant to US one, if for some reason you run the stock OS and wan’t to avoid the camera shutter sound. But we are here for the more interesting values.

We now need to find the original IMEI string in our devinfo, and modify it with a hex editor.
Make sure to not just enter random numbers there but from a device you legally own. This way you make sure that you don’t break the law as well as not looking suspicious from the carrier side.

adb push ./devinfo_modified.img /sdcard/
adb shell
su
dd if=/sdcard/devinfo_modified.img of=/dev/block/by-name/devinfo
exit
adb reboot bootloader
fastboot oem set_config bootmode factory
fastboot reboot

You will see a red screen from the bootloader saying the phone is booted in factory mode.
We now have to recalculate the SHA hashes of the new IMEI values. For that, we execute:

echo “AT+GOOGGETIMEISHA\r” > /dev/umts_router & cat /dev/umts_router

You will see a SHA256 string in a response, i.e:
+GOOGGETIMEISHA:494b450c0a1f5af2ce470010fc0e33cb4917083839b7add4cf9d100c8bad17b7

Copy that string to /mnt/vendor/persist/modem/cpsha, that’s our new IMEI verification hash:

echo 494b450c0a1f5af2ce470010fc0e33cb4917083839b7add4cf9d100c8bad17b7 > /mnt/vendor/persist/modem/cpsha
echo ‘AT+GOOGBACKUPNV\r’ > /dev/umts_router

Now we saved the backup to EFS as well, although it is not necessary.

reboot bootloader
fastboot oem rm_config bootmode
fastboot reboot

You should have your IMEI changed, and now it’s safe to do a factory reset and lock the bootloader back.
If you have a carrier that supports displaying your current connected IMEI online, you can use it to verify everything went well. But if you see it in *#06# it will be enough, the baseband reads it from devinfo.

P.S.
There is a nice FOSS utility that kind of automates what I described here, so big thanks to @luxferre:

7 Likes
2

A question, why do you want to change IMEI of your phone? It can be understandable if you live in authoritarian country with high risk of getting tracked, but in many countries that will be seen as illegal.

Apart from legal part, your phone will be out of warranty.

I asked my AI about it and here is its answer.

  1. United Kingdom: The Mobile Telephones (Re-programming) Act 2002 makes it a specific criminal offense to change or interfere with the IMEI number of a mobile phone.

  2. India: Tampering with IMEI numbers is illegal under Section 25 of the Indian Telegraph Act, read with relevant rules and regulations issued by the Department of Telecommunications (DoT). There are significant penalties for doing so.

  3. Pakistan: The Pakistan Telecommunication Authority (PTA) has strict regulations against IMEI tampering and cloning. It is illegal and actively enforced.

  4. Turkey: Altering IMEI numbers is illegal under Turkish electronic communication laws. Devices with invalid or cloned IMEIs are blocked from networks.

1 Like
3

Many valid reasons to do so, especially if you buy a 2nd hand phone and don’t know it’s history. Also if you roam in a foreign country and don’t want them to easily track you. Same question is why people use VPNs although it’s illegal in many countries.
We don’t discuss about why, we discuss about how.

4

VPN illegality is not many, and can be quickly reverted, like by closing the VPN or deleting the app, but changing IMEI will cause more legal issues.

1 Like
5

check replies in Is posting about IMEI modifications on Pixel devices allowed? your question is more appropriate there and there have been legitimate reasons shared there on why you would need to change your IMEI, and it’s not as if this method is illegal everywhere and it mostly depends on activities you may do while IMEI changed, I like comparing it to Tor.

6

I don’t know the laws of other countries, I only provided info from Gemini.

Of course, knowing about how to do it is helpful and is the point of this post, but I am concerned about legal part of it. For example, in Germany it will cause a lot of issues, apart from taking your phone out of warranty. But intent and actions are the keywords here.

1 Like
7

Yeah, leveraging AI for such laws is not correct way. I believe the other thread I linked is more appropriate for such discussions. This post is about a guide on how-to, replies should be related to on how but not why.

2 Likes
8

does this changs the hardware IMEI? the one that is transmitted to mobile towers etc?

One can root, modify IMEI then unroot, a second graphene os device can be used for Wifi Hotspots, this could be nice for anonymous internet.

9

Wouldn’t it not be better to use a Mudi v2 router with Blue Merle? Then you have a better rounter and don’t look like a drug dealer with 2 phones.

10

Thanks for taking the time to post this. People rarely cover this very important topic.

3 Likes
11

Atleast according to Graphene OS guys, those devices are easy to be monitored vua carrier operators as they are different than mobiles.

1 Like