Database Develop

HardSpl ends up in "Error [270]: Update Error"

Hi,
I intend to flash a cooked ROM (ITsPapa20748) to my Herald. From reading some sticky posts here I learned that at first I have to install a hacked bootloader - so I downloaded HardSpl_WM6.rar
My procedure was as follows:
1. install canonyang, ASerg_Policies and Disable_Security (in this order)
2. softreset
3. start RUU
My mobile then enters bootloader mode and ends up with error message "Error [270]: Update Error" (progress bar freezes at 3pct)
My config is as follows:
PC: is running WindowsXP (with SP2), ActiveSync v4.5 is in Guest Mode
Mobile: Model-Nr. Hera100
ROM version 4.17.402.102 GER
IPL 4.17.0001
SPL 4.17.0000
I had to UNcheck the start/system/advanced_networking-box in order to establish USB-connection.
After spending some hours going through existing threads I'm pretty sure that this is a common situation. But I didn't find any hint that helped me to flash successfully.
So any comments and suggestions are welcome.
thx!
1aladdin1

it works now
sorry for posting too early - now it worked.
I basically performed the same steps as listed in my previous post. Two differences:
1. softreset between installation of canonyang/aserpolicy/disable_security
2. while performing the RUU I had FILEMON running (a great tool from mark russinovich)
Finally I don't know, which step was the decisive one - bot anyhow it works now.
Hope this helps other guys in a similar situation.

please guys help me
my htc touch p3452 is dead becoz i flash but something is wrong and then it was dead now it will on on bootloder mode(red,green,blue) here is my detail please tell ,me what to do
it show..
IPL 3.07.0002
SPL 3.07.0000
DEVICE ID= ELF010050
CID= DOPOD001
45 4C 46 30 31 30 30 35 30 00 00 00 00 00 00 00 ELF010050.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
44 4F 50 4F 44 30 30 31 00 00 00 00 00 00 00 00 DOPOD001........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
i also tryed to flash "DID-ELF010050_CID-DOPOD001_ROM-2.20.721.2B" but is not flashed it gave "error 270 update error" something please tell me where is the problem and how to solve please guys

Wwwwwweeeellllllll....YOU HAVE AN ELF, NOT A HERALD. Seriously, if you tried to HardSPL your Elf with the Herald HardSPL...I don't even know. These are the Herald forums, NOT the Elf forums, as such, more than likely no one that frequents here will know what to do to help you.

We need the official AT&T Tilt 2 rom dump.

Can someone please, when you can..post the at&t tilt 2 rom so that any of us who should need to go back to it for various reasons can do so!
Thank You very much!!!

If there is a fairly quick & easy way to dump it, Id be happy to. My Tilt 2 should be arriving tomorrow afternoon (EST). I'd like to get an EnergyROM on it as soon as possible, but I'd be willing to take the time to dump the stock ROM if someone could point me to the tools to do so.

ROM dump & ril
Complete dump is here Thanks & credits to herg62123.
EDIT: removed extracted ril, does not seem to work with 4.47 radio

This appears to be the Fuze ROM? Are you sure you copied the right link?

I got my Tilt 2 2 days ago, I can dump it, but I have no idea how to do that.

I should have extracted mine, but I figured you party people would be on the ball already... oh well
I can't wait for it to be available to the chefs though cause I can't use my PTT button right now, and the contacts app isn't as nice as the one that was on the Tilt 2 stock (on the 6.5 manila 2.1 Rom from NRG)

beufford12 said:
This appears to be the Fuze ROM? Are you sure you copied the right link?
Click to expand...
Click to collapse
Yes it's the full Titlt2 dump. I extracted Rhodium OEM drivers, the 4.47.25.24 radio and some other stuff. This dump is strictly for those with WVGA, clearly won't run on the Fuze as is. It's 400 MB since the original NBH is included.

How can the ROM be extracted from the phone?

Just got my Tilt2 today and noticed that the shipped ROM is build 21849.5.0.63. I believe the one posted above is perhaps a slightly earlier build.
Anyone know of a resource that has dumped the AT&T official ROM? I think I am like some others where I am a little gun-shy to flash unless I have an AT&T one to fallback on in case I need to do a warranty exchange.

l3it3r said:
I can't wait for it to be available to the chefs though cause I can't use my PTT button right now
Click to expand...
Click to collapse
ae button plus finds the ptt button. You wont have the at&t ptt service obviously, but it allows you to map it to whatever you'd like

I can confirm the build is 21849.5.0.63
I have extracted the ROMfollowing the steps at http://forum.xda-developers.com/showthread.php?t=501871
Code:
\itsutilsbin-20090515>pdocread.exe -l
461.75M (0x1cdc0000) FLASHDR
| 3.12M (0x31f000) Part00
| 4.75M (0x4c0000) Part01
| 226.75M (0xe2c0000) Part02
| 227.13M (0xe320000) Part03
7.42G (0x1db000000) DSK7:
| 7.42G (0x1dac00000) Part00
STRG handles:
handle#0 0ffa9b5e 7.42G (0x1dac00000)
handle#1 2fe19f0a 227.13M (0xe320000)
handle#2 cff4c8de 226.75M (0xe2c0000)
handle#3 cff4c8ba 4.75M (0x4c0000)
handle#4 6ff4c792 3.12M (0x31f000)
disk 0ffa9b5e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 2fe19f0a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cff4c8de
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk cff4c8ba
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 6ff4c792
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part01 0 0x380000 Part01.raw
CopyTFFSToFile(0x0, 0x380000, Part01.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part02 0 0x4560000 Part02.raw
CopyTFFSToFile(0x0, 0x4560000, Part02.raw)
itsutilsbin-20090515>pdocread -w -d FLASHDR -b 0x800
-p Part03 0 0x8660000 Part03.raw
CopyTFFSToFile(0x0, 0x8660000, Part03.raw)
itsutilsbin-20090515>pmemdump 0x9a000000 0x80000 spl
.nb
CopyProcessMemoryToFile(00000042, 9a000000, 00080000, spl.nb)
The extracted files are sized:
Part00 3,196 KB
Part01 3584 KB
Part02 74,040 KB
Part03 137,600 KB
spl 512KB
I just want to make sure this is OK as these raw files are smaller than how big it says at the top.
I have 7-zipped the files and am sending the 112MB file to my Dropbox right now, it will take about 40 minutes to finish.
I may update this topic with the link once it is done, anyone interested please feel free to message me.

Here are the raw files:
Part00.raw
Part01.raw
Part02.raw
Part03.raw
spl.nb
It is Ultra compressed with 7-zip and available at:
::edit::
Link removed, I think I screwed up the offsets of the dump. I was wondering why the part 2 was so small.....

digitalmatrixio said:
Here are the raw files:
Part00.raw
Part01.raw
Part02.raw
Part03.raw
spl.nb
It is Ultra compressed with 7-zip and available at:
http://dl.getdropbox.com/u/62596/ATT TILT 2 ROM DUMP.7z
Click to expand...
Click to collapse
Thanks! Now the trick is to recompile into a flashable nbh file...I found a tutorial on this and will possibly try my hand at it...

pinoymutt said:
Thanks! Now the trick is to recompile into a flashable nbh file...I found a tutorial on this and will possibly try my hand at it...
Click to expand...
Click to collapse
if you look on the first page you'll the the link to where herg provides a dumped tilt2 rom. it already has the .nbh. i've downloaded it myself

noggind614 said:
if you look on the first page you'll the the link to where herg provides a dumped tilt2 rom. it already has the .nbh. i've downloaded it myself
Click to expand...
Click to collapse
The dump from Herg is build 21839 the shipped ATT build is 21849.
I am not having any luck with any of the kitchens converting the files to NBH. Maybe I'll have more luck after a good nights sleep.

digitalmatrixio said:
The dump from Herg is build 21839 the shipped ATT build is 21849.
I am not having any luck with any of the kitchens converting the files to NBH. Maybe I'll have more luck after a good nights sleep.
Click to expand...
Click to collapse
This is the tutorial I was reading through, not sure if you used the same one?
http://forum.xda-developers.com/showthread.php?t=560519

Keyboard
Can anyone verify that the keyboard layout is the same as the HTC original or will there be a need for a keyboard fix like the T-Mobs TP2 ?

mystikal87 said:
Can anyone verify that the keyboard layout is the same as the HTC original or will there be a need for a keyboard fix like the T-Mobs TP2 ?
Click to expand...
Click to collapse
will need a fix

I just tried building the nbh file and didn't have much success. Anyone else care to try?

ATT HTC Tilt 2 Keyboard
The keyboard is different. Here is a picture of it I snapped with my Fuze.

Imagio 040 SPL

use for rewrite ESN and flash ROMs. good luck.
rename it to .rar, its a winrar file.
MOD EDIT - Removed file. PM me if you disagree and provide me with more history/evidence

Leave it. He has 1 post and the SPL hasn't been cracked yet. Probably a scam.

I have re-opened this thread.
@ ls1024 - Feel free to modify first post again and provide more info including what you showed me in PM
Rick

Thanks Spartan for looking at this. Hopefully once he posts more info it will be what we Imagio users are desperate for, or a step in that direction.

Narcotichobo said:
The linked thread reads as following:
Only 6975's with spl already unlocked can be flashed, before you flash please make sure your spl is unlocked.
Currently all chinese phones come unlocked.
To confirm, go into the three color screen (hold down the volume button and the device on button), spl should be 0.40.0000
After flashing check to see if the radio number is 2.05ESNWVL
The operation below is identical to the 6875 (TP2), if you have a problem refer to posts on 6875 (TP2) ESN post
Use any version of CDMA Work Shop
On the terminal page, commands section
27 97 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
After you press send the MEID should be cleared
Afterward you can write whatever ESN
When you finish you can flash any radio and won't lose the ESN
Reference: Tutorial on writing the 6875
http://www.diypda.com/viewthread.php?tid=92838&extra=page=1
Alright, I don't know how to do any of that stuff, but i'm 95% sure on the translation so I hope that helps someone who does know what they are doing!
Also there seems to be an attachment to the post in that thread but i can't access it because I am not a forum member, and registration requires an invitation number.
Click to expand...
Click to collapse
The 0.40 SPL comes on the Chinese version of the Imagio and it allows writing of the ESN and flashing.
All being chatted in this thread:
http://www.forum.ppcgeeks.com/showthread.php?t=97542
Cmonex is working on the HSPL ATM and I do believe it will be based off of the 0.40 SPL

Americanmetal said:
The 0.40 SPL comes on the Chinese version of the Imagio and it allows writing of the ESN and flashing.
All being chatted in this thread:
http://www.forum.ppcgeeks.com/showthread.php?t=97542
Cmonex is working on the HSPL ATM and I do believe it will be based off of the 0.40 SPL
Click to expand...
Click to collapse
Woot I got quoted here.

\/
||
||
\/

And this helps us .38 how?
I think I read this over at PPCG but no instructions on how to do it on a .38 SPL so basically this is for the .40 Imagio only correct?
I posted both modified radios for TP2 and Imagio on PPCG and also a utility to write MEID/ESN (all 3 files from diypda china)

narcotichobo said:
Woot I got quoted here.
Click to expand...
Click to collapse
I had to get this thread unlocked rofl

Still, how can we upgrade to .40? That's what's holding us from at least changing radios to chinese ones hehehe

ls1024 said:
use for rewrite ESN and flash ROMs. good luck.
rename it to .rar, its a winrar file.
MOD EDIT - Removed file. PM me if you disagree and provide me with more history/evidence
Click to expand...
Click to collapse
i have pm...tks.

Ignore this
Here is a couple of files I got from chinese DIYPDA forum. One is a modified radio and the other one a program to simplify the esn repair.
Click to expand...
Click to collapse
Here is the modified radio and DFS, a program that does let you change MEID and/or ESN for when we can do it. Only .40 can change to this radio
Code:
http://www.mediafire.com/?bxjnytljdid
http://www.mediafire.com/?zmtjymhzcjf

we upgrade to 0.40? is the focus of

At least if we can do the .40 upgrade then we can also upgrade to an HSPL that allows unsigned ROMs. Has anybody had any luck with .40? I would like .40 on my phone... And also a way to go back to .38 if possible!

Well, easiest way to go .40 is to buy an Imagio that's .40 already.
taobao(dot)com as specified by our friends at diypda(dot)com has them for 3150 = $461 usd. The question is... If we get this phone and we flash the Imagio shipped rom, will it flash .38 spl or leave it at .40 spl?

It will replace to .38 ,
u must delete SPL from the ruu_signed.nbh
m4f1050 said:
Well, easiest way to go .40 is to buy an Imagio that's .40 already.
taobao(dot)com as specified by our friends at diypda(dot)com has them for 3150 = $461 usd. The question is... If we get this phone and we flash the Imagio shipped rom, will it flash .38 spl or leave it at .40 spl?
Click to expand...
Click to collapse

Hmmm, well, at least the .40 can flash it after you remove .38 spl (will be unsigned afterwards) so how do you remove it? I've cooked ROMs with kitchens before but I have no clue how to remove the SPL from the .nbh

htcRIE_0.5.0.12
m4f1050 said:
Hmmm, well, at least the .40 can flash it after you remove .38 spl (will be unsigned afterwards) so how do you remove it? I've cooked ROMs with kitchens before but I have no clue how to remove the SPL from the .nbh
Click to expand...
Click to collapse

I'll give it a test drive to see how it works. Link here: http://forum.xda-developers.com/showthread.php?t=377514
I tested program, it does work, I managed to remove SPL from the Verizon .nbh but Whitestone is not on the list of selected phones, not sure what that list/dropdown menu is for, is that for signing the ROM?

Imagio ROM Test
I have an Imagio, I am willing to use as Genie Pig if anyone can point me to promising ROM to test out. I'm willing to chance bricking the phone. It has been replaced by a new phone from Verizon.​

[SOLVED]WLAN is Dead possible reason is erased eeprom

Thanks for gruptnt,I finally figure out the reason is not eeprom.I think the wifi antena is loose when my phone droped from 1.7 meter a few days ago.So the people who have a familar wlan issue can try this method.And thanks gruptnt again for his kind help.Now the thread can be closed!
Hi，recently I have flashed my diamond to stock wm 6.1 ROM.When it finished,I found My WLAN is also finished.
The problem was just the same as the video below:
http://www.youtube.com/watch?v=G_jQc1JRGQI
I seach all of the froum and found a possible reason--I have erased my eeprom during the flashing.Solution for herme and trinity have been found.However,I can't locate the mac address of wlan and there is no working waln diamond to dump the eeprom.Sorry for my bad english ,hope some one can solve this problem.
Here is herme thread:
http://forum.xda-developers.com/showthread.php?t=322225
Here is trinity thread:
http://forum.xda-developers.com/showthread.php?t=490681

Hi,
very strange. Usually, it does not happen when flashing.
Which Diamond you flashed?
If it is a Dopod D900 from China, it does not have the WLAN chip at all, like all Dopod with WM6.x officially sold in China. So, even if you find out how to change EEPROM and add a mac-address it will not work. (btw, Dopod S900 also misses the front camera)
Which ROM you had before and which (stock) ROM you flashed?
How did you flash? With mtty?
Do you still have the same problem when changing back to previous ROM?
Good luck!

Huckleberry88 said:
Hi,
very strange. Usually, it does not happen when flashing.
Which Diamond you flashed?
If it is a Dopod D900 from China, it does not have the WLAN chip at all, like all Dopod with WM6.x officially sold in China. So, even if you find out how to change EEPROM and add a mac-address it will not work. (btw, Dopod S900 also misses the front camera)
Which ROM you had before and which (stock) ROM you flashed?
How did you flash? With mtty?
Do you still have the same problem when changing back to previous ROM?
Good luck!
Click to expand...
Click to collapse
I use HTC WCDMA version(DIAM100) and it has a WLAN chip and front camera.
I have always been using Donsalari TFL2.1ROM (just show in my signature) before.
Just a few days ago I flashed "RUU_Diamond_HTC_WWE-AFK_2.03.421.2_Radio_Signed_Diamond_52.51.25.26_1.09.25.23_Ship" which I download from HTC offical website using my own S/N.
Of coure I use mtty's task 29 command before flashing.However It failed first time.So I change my SPL from Olinex 1.93 to stock 1.93 .The I just run the exe file I downloaded tiwce to make it work(the first flashing is unsuccessful but it changde my SPL from stock 1.93 to 2.03,and the second time was succcessfull).After flashing,My WLAN dead as shown in the video in the first post.
Yes,I change it to previous ROM but no miracle happened.I also change different radio and SPL but it didn't work.
Finally,I search the entire thread and found it could be the eeprom problem,but I don't found any solution to diamond just like herme and trinity.
Lastly,Thank you for your kind help.

In that case, if you have the original ROM with spl and radio installed, then maybe best chance is to check with the HTC service to help you to sort it out.
As you mentioned the problem with the missing mac-address happened to some other phones but I never heard it happens to a Diamond before.
Good luck!

Huckleberry88 said:
Hi,
very strange. Usually, it does not happen when flashing.
Which Diamond you flashed?
If it is a Dopod D900 from China, it does not have the WLAN chip at all, like all Dopod with WM6.x officially sold in China. So, even if you find out how to change EEPROM and add a mac-address it will not work. (btw, Dopod S900 also misses the front camera)
Which ROM you had before and which (stock) ROM you flashed?
How did you flash? With mtty?
Do you still have the same problem when changing back to previous ROM?
Good luck!
Click to expand...
Click to collapse
Huckleberry88 said:
In that case, if you have the original ROM with spl and radio installed, then maybe best chance is to check with the HTC service to help you to sort it out.
As you mentioned the problem with the missing mac-address happened to some other phones but I never heard it happens to a Diamond before.
Good luck!
Click to expand...
Click to collapse
Thank you guy,I think I will live with it cause I do not use wlan very often.And Diamond is old enough nowdays.If microsoft publish a chiense version of windows phone 7,I'll consider to buy one to replace my diamond.

jent.le said:
Hi，recently I have flashed my diamond to stock wm 6.1 ROM.When it finished,I found My WLAN is also finished.
The problem was just the same as the video below:
http://www.youtube.com/watch?v=G_jQc1JRGQI
I seach all of the froum and found a possible reason--I have erased my eeprom during the flashing.Solution for herme and trinity have been found.However,I can't locate the mac address of wlan and there is no working waln diamond to dump the eeprom.Sorry for my bad english ,hope some one can solve this problem.
Here is herme thread:
http://forum.xda-developers.com/showthread.php?t=322225
Here is trinity thread:
http://forum.xda-developers.com/showthread.php?t=490681
Click to expand...
Click to collapse
U can see at this
http://forum.xda-developers.com/showthread.php?t=597195
Note :
i have another diamond with wlan problem (can't go on) but when i have disassembly diamond the cable of antenna wlan were disconnected on mainboard
i have reconnect and now wlan is ok

; said:
U can see at this
http://forum.xda-developers.com/showthread.php?t=597195
Note :
i have another diamond with wlan problem (can't go on) but when i have disassembly diamond the cable of antenna wlan were disconnected on mainboard
i have reconnect and now wlan is ok
Click to expand...
Click to collapse
Thank you dude.I see your work on trinity,but i don't see the thread above.Thank very much for your kind help.I will try it later,and I will post the result.Thanks again,gtuptnt.

gruptnt said:
U can see at this
http://forum.xda-developers.com/showthread.php?t=597195
Note :
i have another diamond with wlan problem (can't go on) but when i have disassembly diamond the cable of antenna wlan were disconnected on mainboard
i have reconnect and now wlan is ok
Click to expand...
Click to collapse
Hi,dude.I try your method,but no luck.Since I am at school,I can not find my mac address in router log file.I have used 56 48 65 48 22 00 which I find in supersport's video.
I use mtty's info 8,and find BLOCK 951 (0x3B7) is bad block ,however，it does exist when I use task 29 before flashing.
After using task 37 ff in mtty I got:
AA0EFF80: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFF90: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFA0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFB0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFC0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFD0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFE0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
AA0EFFF0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
Click to expand...
Click to collapse
And no signature in the end.Any idea？

Understand 5.1.1 bootloader bricking & perhaps fix it :

On Fire HD 2014 I started looking at md5sum for partitions for different OS versions, and it seems that on Fire 2015 one can figure out which partition gets screwed up by 5.1.1 bootloaders, and perhaps restore it to pre-5.1.1 state. If this fails, the warranty should kick in (all of the Fire 2015s are still under warranty !!!)
Please see this link for some details :
http://forum.xda-developers.com/fire-hd/help/trying-to-undo-bricking-5-2-2u2-t3301374
Basically, the idea is simple. First one captures all the partitions while running 5.0.1 bootloaders. Then the bootloaders are updated to 5.1.1 version. At this point the partitions are captured again. This is the code to capture partitions to be run on PC via adb:
Code:
adb shell
su
mkdir /sdcard/tmp/
dd if=/dev/block/mmcblk0p1 of=/sdcard/tmp/01_kb.img
dd if=/dev/block/mmcblk0p2 of=/sdcard/tmp/02_dkb.img
dd if=/dev/block/mmcblk0p3 of=/sdcard/tmp/03_expdb.img
dd if=/dev/block/mmcblk0p7 of=/sdcard/tmp/07_misc.img
dd if=/dev/block/mmcblk0p8 of=/sdcard/tmp/08_logo.img
cd /sdcard/tmp
md5 *.img
Then one can simply exit, and do "adb pull /sdcard/tmp/" to get all these *.img files off the device.
Then those partitions that changed (KB,DKB,EXPDB,MISC) are dd'ed back under 5.1.1, and bootloaders are dd'ed back to 5.0.1 versions. If it reboots OK, this means that the device is effectively restored to pre-5.1.1 state. If failure, warranty return.
The next step to try would be to transplant this offending partition from a different Fire to a device with 5.1.1, along with 5.0.1 bootloaders.
Here is the list of partitions for reference:
http://forum.xda-developers.com/amazon-fire/development/partitions-list-t3236213

When one tires to downgrade to 5.0.1, it's the preloader stage which the Fire keeps cycling at. We have already tried flashing the 5.0.1 bootloader & preloader onto a 5.1.1 Fire.

blueberry.sky said:
When one tires to downgrade to 5.0.1, it's the preloader stage which the Fire keeps cycling at. We have already tried flashing the 5.0.1 bootloader & preloader onto a 5.1.1 Fire.
Click to expand...
Click to collapse
But this would not make sense. Are you saying that the preloader does not even try to call the 5.0.1 bootloaders ? But then why ?
Since the preloader stays the same, the only difference is that 5.0.1 bootloaders are trying to run after 5.1.1 bootloaders already ran on the device. At this stage 5.0.1 cannot proceed normally, which must be due to some changes sitting on some of the partitions that the bootloaders are reading early on.
We have no indication that 5.0.1 bootloaders do not run at all, they may run a bit, and then crash, and the device is back at the preloader stage.
So restoring additional partitions together with 5.0.1 bootloaders may enable 5.0.1 to function again after 5.1.1, as per my original post.

bibikalka said:
Since the preloader stays the same, the only difference is that 5.0.1 bootloaders are trying to run after 5.1.1 bootloaders already ran on the device.
Click to expand...
Click to collapse
Have you verified that the 5.0.1 and 5.1.1 preloaders are the same?
bibikalka said:
Are you saying that the preloader does not even try to call the 5.0.1 bootloaders ?
Click to expand...
Click to collapse
Just know that when plugged into a pc you will see the preloader cycle endlessly. Connect, disconnect, repeat. And someone did try to flash the both the bootloader & preloader extracted from 5.0.1.
It could be that 5.1.1 is blowing a fuse which tell older versions to refuse to boot.

bibikalka said:
On Fire HD 2014 I started looking at md5sum for partitions for different OS versions, and it seems that on Fire 2015 one can figure out which partition gets screwed up by 5.1.1 bootloaders, and perhaps restore it to pre-5.1.1 state. If this fails, the warranty should kick in (all of the Fire 2015s are still under warranty !!!)
Please see this link for some details :
http://forum.xda-developers.com/fire-hd/help/trying-to-undo-bricking-5-2-2u2-t3301374
Basically, the idea is simple. First one captures all the partitions while running 5.0.1 bootloaders. Then the bootloaders are updated to 5.1.1 version. At this point the partitions are captured again. This is the code to capture partitions to be run on PC via adb:
Code:
adb shell
su
mkdir /sdcard/tmp/
dd if=/dev/block/mmcblk0p1 of=/sdcard/tmp/01_kb.img
dd if=/dev/block/mmcblk0p2 of=/sdcard/tmp/02_dkb.img
dd if=/dev/block/mmcblk0p3 of=/sdcard/tmp/03_expdb.img
dd if=/dev/block/mmcblk0p7 of=/sdcard/tmp/07_misc.img
dd if=/dev/block/mmcblk0p8 of=/sdcard/tmp/08_logo.img
cd /sdcard/tmp
md5 *.img
Then one can simply exit, and do "adb pull /sdcard/tmp/" to get all these *.img files off the device.
Then those partitions that changed (KB,DKB,EXPDB,MISC) are dd'ed back under 5.1.1, and bootloaders are dd'ed back to 5.0.1 versions. If it reboots OK, this means that the device is effectively restored to pre-5.1.1 state. If failure, warranty return.
The next step to try would be to transplant this offending partition from a different Fire to a device with 5.1.1, along with 5.0.1 bootloaders.
Here is the list of partitions for reference:
http://forum.xda-developers.com/amazon-fire/development/partitions-list-t3236213
Click to expand...
Click to collapse
Thanks Bibikalpa. The problem is, to try your solution we have to be able to use adb. We are stuck at fastboot. :crying:

rongweiss said:
Thanks Bibikalpa. The problem is, to try your solution we have to be able to use adb. We are stuck at fastboot. :crying:
Click to expand...
Click to collapse
What he is proposing is not a solution for people who are bricked. Rather it would help prevent people on 5.1.1 from getting bricked in the first place. It would allow downgrading to 5.0.1, restoring the ability to load twrp recovery from fastboot.
---------- Post added at 09:53 PM ---------- Previous post was at 09:11 PM ----------
Here are the md5 checksums from my 5.0.1 Fire
Code:
e1c2e27a6dae694cbf14594b6d963f11 ./01_kb.img
175ec1eea0b65b15ea6ee455531f154d ./02_dkb.img
1d837a219b515afae6c19d9126168f5c ./03_expdb.img
00ff461906b45fc4af74f81839a30069 ./07_misc.img
c414b0be43b26efb5009639be06a74e2 ./08_logo.img
926c891ba8bc265d5dfeabe1ba3838c8 ./09_tee1.img
926c891ba8bc265d5dfeabe1ba3838c8 ./10_tee2.img
Perhaps some of them are the same even between different Fires.
I've already had to get a warranty replacement for my Fire due to a cluster of stuck pixels. Don't want to try upgrading to 5.1.1, risk having to try for a 2nd replacement.

Here are my md5 checksums from 5.1.1 (with 5.1,0 bootloaders, so may not help much, but you didn't ask for bootloaders)
Code:
d47ae72b30dd03c08d0c41883ac219f4 01_kb.img
8b50c460e75aef889840a9077b12c20a 02_dkb.img
4af5655b4a4f2b36ffb81b20605bb75d 03_expdb.img
00ff461906b45fc4af74f81839a30069 07_misc.img
c414b0be43b26efb5009639be06a74e2 08_logo.img
926c891ba8bc265d5dfeabe1ba3838c8 09_tee1.img
926c891ba8bc265d5dfeabe1ba3838c8 10_tee2.img
83b74c9782b889e246bc7b7cfa184d64 04_uboot.img
I'm OK with testing, starting from scratch and rooting my unadultered 5.1.0.

DoLooper said:
Here are my md5 checksums from 5.1.1 (with 5.1,0 bootloaders, so may not help much, but you didn't ask for bootloaders)
Code:
I'm OK with testing, starting from scratch and rooting my unadultered 5.1.0.
Click to expand...
Click to collapse
These look like 5.0.1 checksums for TEE1/TEE2, the same as @blueberry.sky post.
Only the 1st 3 partitions seem to differ. If you run "adb shell; idme print" with root, it actually prints the first few lines of KB & DKB, at least on Fire HD 2014. Does this work on Fire 2015 ?

bibikalka said:
These look like 5.0.1 checksums for TEE1/TEE2, the same as @blueberry.sky post. Only the 1st 3 partitions seem to differ.
Click to expand...
Click to collapse
As said, I'm running 5.0.1 bootloaders.
If you run "adb shell; idme print" with root, it actually prints the first few lines of KB & DKB, at least on Fire HD 2014. Does this work on Fire 2015 ?
Click to expand...
Click to collapse
I get no output with either "idme print /dev/block/kb.img" or "idme print /dev/block/dkb.img" while in su. I assume this is correct syntax.

DoLooper said:
As said, I'm running 5.0.1 bootloaders.
I get no output with either "idme print /dev/block/kb.img" or "idme print /dev/block/dkb.img" while in su. I assume this is correct syntax.
Click to expand...
Click to collapse
It's just straight "idme print", nothing else after that.

bibikalka said:
It's just straight "idme print", nothing else after that.
Click to expand...
Click to collapse
Cool!
Code:
[email protected]:/ # idme print
. . .
KB:
4b 42 50 46 18 0e 00 00 28 0e
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
. . .

Have you tried to connect your device to a computer running SP Flash Tool? If that works, and you manage to get data from the Fire (using the readback window), you may be able to unbrick your tablet.