[GUIDE][GT-I9100G]Repair Totally Sleep/Dead Boot Mode Via USB - Galaxy S II I9100G Android Development

[GUIDE][GT-I9100G]Repair Totally Sleep/Dead Boot Mode Via USB - Galaxy S II I9100G Android Development

First you need to connect your phone without battery and then load usb driver windows, after install driver run bat file ,after few second ,phone repair done.
Good Luck !
http://www.mediafire.com/?4q5viaizn5zf9l0
pass: my username

-- OMAPFlash Introduction --
This document contains a description of a tool – OMAPFlash – that can be used to transfer binary images from a host PC to an OMAP based target
platform. The tool consists of four main components:
- a host application, called OMAPFlash Host
- a “second” loader, called OMAPFlash Second, specific to the platform with which OMAPFlash is used
- drivers for the memory devices of the platform
- a USB driver for the host PC, compatible with the OMAP device in use
The tool makes use of the OMAP ROM code mechanism for peripheral boot from either UART or USB to transfer OMAPFlash Second to the internal memory
of the OMAP device. Using OMAPFlash Second a device driver is then transferred to SDRAM for the memory device to which the binary transfer is to
take place. Finally a binary file can be transferred through OMAPFlash Second and the device driver to the memory device itself.
The communication protocol used between OMAPFlash Host and OMAPFlash Second is based on the Fastboot protocol used in the Android community – a
simple text based command-response protocol. Source code is available under a BSD-style license and may be used and modified for other platforms
freely as long as the license terms are observed.
-- Installation --
OMAPFlash comes as an installer for the Windows XP platform. Run the installer executable, OMAPFlashInstaller.msi, to install to the hard-drive of
the host PC. In some cases the installer will display a warning that a DLL has failed to register properly – should this happen, accept this and
press continue to complete the installation (it will not cause the tool to fail). The program is installed to the folder ‘c:\Program Files\Texas
Instruments\OMAPFlash’ and scripts are designed to be run from this path.
Uninstalling OMAPFlash can be done through the Windows XP control panel (Start – Control Panel – Add or Remove Programs). Select OMAPFlash and
press ‘Remove’.
-- Connections --
The physical connection between the target platform and the host PC can be either UART or USB based and the actual connector to use will depend on
the platform. In general the user manual for the platform should be consulted in order to identify the connectors to use for peripheral boot.
-- Drivers --
When using the software with a USB connection, drivers will need to be installed. This should only be necessary when connecting the board to the
host PC for the first time. There are two USB drivers included in the installed software – one for the OMAP device (always needed) and one for the
Android Fastboot protocol (only needed if OMAPFlash is used with target software acting as a Fastboot protocol enabled device). Windows should
detect when a USB driver is needed and ask for it – the drivers are located in the usb_drv_windows folder under the installation directory for
OMAPFlash.
For UART connectivity where UART communication is taking place of USB , a UART USB driver will be needed. This can be downloaded from
http://www.ftdichip.com/Drivers/VCP.htm. Whenever a new driver installation happens during a download attempt to a platform, the process will most
likely time out while the driver is being installed. Simply retry after the installation of the driver is completed.
-- Usage --
OMAPFlash Host is a command-line based application. It is currently available for Windows XP only and will run in a Windows command shell. The
application can take commands directly from the command line or via a script file (a more useful approach). The syntax for calling the tool is:
omapflash [ <option> ] <command>
or, if a script file is used:
omapflash @<file>
-- Options --
The tool has a number of options that can be used to control its overall behavior.
-com <port number>
By default OMAPFlash will try to communicate with the target platform using a USB serial link. This option will force OMAPFlash to use a UART for
serial communication and specify the host side COM-port to use.
-t <timeout>
By default the timeout for communication on the serial link is 5 seconds. This option allows control of the timeout value by specifying another
timeout value in seconds.
-p <platform>
This option is required by OMAPFlash and specifies the platform for which the download is to take place. The platform specified is a name tag that
allows OMAPFlash to identify the correct second loader to use. The tag typically identifies the platform type and the memory used with the OMAP
device present on the platform (“e.g. SDP_MDDR_HYNIX_4G). The tag is used to look up the second loader in a configuration file (omapflash2nd.txt)
in combination with an OMAP device identifier received from the platform during peripheral boot.
-omap <version>
This option is required by OMAPFlash if a peripheral boot sequence is used to transfer a second loader to a target platform. The option specifies
the OMAP generation used on the platform – without this option set, OMAPFlash will be unable to determine how to correctly perform the peripheral
boot sequence necessary for transfer of the second loader to the platform. The version number is a single digit integer (e.g. ‘3’ for an OMAP3xxx
based platform or ‘4’ for an OMAP4xxx based platform).
-2
This option controls whether OMAPFlash will try to use the ROM code peripheral boot sequence to transfer a second loader to internal RAM before
doing anything else. This option will be required for most scenarios where OMAPFlash is used but can be left out if OMAPFlash Host is interacting
with a second loader already running on a target platform.
-v
The ‘-v’ option controls whether OMAPFlash Host will run in verbose mode. If set, more information will be shown during the execution of the
flashing sequence. Note that this option should be set in order to see the target platform response to certain commands (e.g. ‘chips’).
-- Commands --
Commands are executed on the target platform. Any command is prefixed by the keyword ‘command’ and anything following this keyword will be passed directly to OMAPFlash Second by OMAPFlash Host without interpretation or modification. Typically the ‘verbose’ option should be used with commands in order to ensure that information returned from the platform will be shown on the console.
branch <device> <offset>
This command will cause OMAPFlash Second to make an unconditional branch to a memory mapped address. The device will typically be the SDRAM
handled by the OMAP SDRAM controller in this case, and the offset typically zero. The device ID must be one known by OMAPFlash Second and the
offset an integer within the address offset range valid for the device.
peek32 <address>
Get the register value of the register with the given address.
poke32 <address> <value>
Modify the register at the given address to the given value
peekpoke32 <address> <value> <mask>
Modify the register at the given address with the given value and mask
-- Flashing --
OMAPFlash Host is able to handle three basic procedures for accessing memory devices through the OMAPFlash Second loader. These procedures are used
to erase memory devices, transfer a binary file to a device or upload the device content to a binary file. In all cases, parameter values specifying
sizes or offsets are hexadecimal.
chip_erase <device>[@offset] <size>
This procedure is used to erase the content of a device, either for the whole device or for part of its address range. The ‘device’ identifier is
a string matching one of the devices available on the platform as listed from the ‘chips’ command – in other words, a device known to OMAPFlash
Second for the particular platform used (SDRAM is not a valid choice). If an ‘offset’ is used, the device erasure will start at the offset
specified. The offset will need to be compatible with the memory structure of the device in question – e.g. if the device has a block size of
40000h bytes, the offset will need to be a multiple of the block size. The ‘size’ specifies the number of bytes to erase – a value of zero has the
special meaning of “to the end of the device”, either starting at offset zero or at the specified ‘offset’ value, and can be used to erase the
entire device. Note that the typical erase functionality of a memory device is based on the erasure of blocks of memory – it may not make sense to
ask for erasure of a size that is not a multiple of the block size of the device.
chip_download <device>[@offset] <file>
In order to transfer a binary file to a device on the platform this procedure is used. The ‘device’ identifier is a string matching one of the
devices available on the platform. If an ‘offset’ is specified the binary will be downloaded to the device starting at the offset address
specified. Using an offset should be done with some caution, since the meaning of the offset value may be unclear for some device types (e.g. for
a NAND device the offset will be used without consideration of bad blocks present in the memory space preceding the offset address). The file to
be downloaded is specified by the ‘file’ parameter and must be a raw image.
chip_upload <device>[@offset] <size> <file>
In order to upload the content of a memory device this procedure is used. The ‘device’ identifier is a string matching one of the devices
available on the platform. If an ‘offset’ is specified content will be uploaded from the device starting at the offset address specified. As for
the ‘chip_download’ procedure the use of an offset should be done with caution. The ‘size’ parameter specifies the number of bytes to upload and
the ‘file’ parameter the file to which the uploaded data will be saved. Note that due to some limitations on the serial link, upload of data will
be considerably slower than download.
-- Examples --
The following examples are illustrations of the use of OMAPFlash. Sample scripts are available and installed with the tool.
-- Commands --
An example of a sequence making use of a command, including peripheral boot and download of OMAPFlash Second to the platform, could be:
omapflash -v -omap 3 -2 -p SDP_MDDR_HYNIX_4G -t 60 command peek32 6e00000
Once OMAPFlash Second is present on the platform, commands can be run with the requirement for renewed peripheral boot:
omapflash -v –p SDP_MDDR_HYNIX_4G command peek32 6e000000
-- Erase --
An example of the erasure of the content of a device on a platform could be (for NAND):
omapflash -omap 3 -2 -p SDP_MDDR_HYNIX_4G -t 60 chip_erase NAND 0
» OMAPFlash vX.X (MMM DD YYYY)
» Please turn off device
» Please turn on device
» Waiting for device
» Found device
» Searching 2nd for: SDP_MDDR_HYNIX_4G 363007 07 GP
» Loading second file Targets\2nd-Downloaders\dnld_startup_3630sdp_gp_hynix_4g.2nd
» Transferring second file to target (0x5FF8 bytes)
» Found device
» Waiting for 2nd
» Found 2nd
» Downloading driver
» Downloading 'Targets\Flash-Drivers\nand_onfi_16bit_8bit.bin'
» Sending data (11412 bytes) :::::::::::::::::::: [11412]
» Downloading complete
» Elapsed time: 0:00.343 (33271 bytes/s)
» End loading driver
» Erasing
Erase progress :::::::::::::::::::: [536870912]
» Elapsed time: 0:24.537
Additional information (e.g. bad block count, freed up memory and device information) may be available by including the verbose option:
omapflash -v -omap 3 -2 -p SDP_MDDR_HYNIX_4G -t 60 chip_erase NAND 0
» OMAPFlash vX.X (MMM DD YYYY)
» Please turn off device
» Please turn on device
» Waiting for device
» Found device
» Searching 2nd for: SDP_MDDR_HYNIX_4G 363007 07 GP
» Loading second file Targets\2nd-Downloaders\dnld_startup_3630sdp_gp_hynix_4g.2nd
» Transferring second file to target (0x5FF8 bytes)
» Found device
» Waiting for 2nd
» Found 2nd
» Downloading 'Targets\Flash-Drivers\nand_onfi_16bit_8bit.bin'
» Sending data (11412 bytes) :::::::::::::::::::: [11412]
Interface 'OMAPFLASH DRIVER v1'
Driver 'NAND ONFI 16/8 BIT'
NAND ONFIv2 VENDOR 0x2C MICRON
NAND 16 BIT DEVICE 0xBC MT29F4G16ABC
NAND 2048 BYTES/PAGE (SPARE 64)
NAND 64 PAGES/BLOCK (131072 BYTES/BLOCK)
NAND 4096 BLOCKS/UNIT (536870912 BYTES/UNIT)
NAND 512 MB TOTAL SIZE
NAND ONFI DRIVER INIT COMPLETE
» Downloading complete
» Elapsed time: 0:00.344 (33174 bytes/s)
» End loading driver
» Erasing
name=NAND address=0x28000000
Erasing to end of device starting at 0x28000000
Erase progress :::::::::::::::::::: [536870912]
NAND ERASED 535691264 BYTES FROM ADDRESS 0x28000000 (9 BAD BLOCKS)
» Elapsed time: 0:24.571
If OMAPFlash Second is already present and running on the platform, it is not necessary to perform an additional peripheral boot:
omapflash chip_erase –p SDP_MDDR_HYNIX_4G NAND 0
» OMAPFlash vX.X (MMM DD YYYY)
» Found device
» Downloading driver
» Downloading 'Targets\Flash-Drivers\nand_onfi_16bit_8bit.bin'
» Sending data (11412 bytes) :::::::::::::::::::: [11412]
» Downloading complete
» Elapsed time: 0:00.344 (33174 bytes/s)
» End loading driver
» Erasing
Erase progress :::::::::::::::::::: [536870912]
» Elapsed time: 0:24.580
-- Download --
An example of download of a binary image to a memory device could be:
omapflash -omap 3 -2 -p SDP_MDDR_HYNIX_4G -t 60 chip_download NAND .\test_data\pattern_10M.bin
» OMAPFlash vX.X (MMM DD YYYY)
» Please turn off device
» Please turn on device
» Waiting for device
» Found device
» Searching 2nd for: SDP_MDDR_HYNIX_4G 363007 07 GP
» Loading second file Targets\2nd-Downloaders\dnld_startup_3630sdp_gp_hynix_4g.2nd
» Transferring second file to target (0x5FF8 bytes)
» Found device
» Waiting for 2nd
» Found 2nd
» Downloading driver
» Downloading 'Targets\Flash-Drivers\nand_onfi_16bit_8bit.bin'
» Sending data (11412 bytes) :::::::::::::::::::: [11412]
» Downloading complete
» Elapsed time: 0:00.391 (29186 bytes/s)
» End loading driver
» Downloading
» Downloading '.\test_data\pattern_10M.bin'
» Sending data (10485760 bytes) :::::::::::::::::::: [10485760]
» Downloading complete
» Elapsed time: 0:35.095 (299593 bytes/s)
» Elapsed time: 0:35.334
-- Upload --
An example of uploading the content of a memory device from a platform could be:
omapflash -omap 3 -2 -p SDP_MDDR_HYNIX_4G -t 60 chip_upload NAND 40000 c:\temp\nand.bin
» OMAPFlash vX.X (MMM DD YYYY)
» Please turn off device
» Please turn on device
» Waiting for device
» Found device
» Searching 2nd for: SDP_MDDR_HYNIX_4G 363007 07 GP
» Loading second file Targets\2nd-Downloaders\dnld_startup_3630sdp_gp_hynix_4g.2nd
» Transferring second file to target (0x5FF8 bytes)
» Found device
» Waiting for 2nd
» Found 2nd
» Downloading driver
» Downloading 'Targets\Flash-Drivers\nand_onfi_16bit_8bit.bin'
» Sending data (11412 bytes) :::::::::::::::::::: [11412]
» Downloading complete
» Elapsed time: 0:00.344 (33174 bytes/s)
» End loading driver
» Uploading 'NAND'
Receiving data (262144 bytes) :::::::::::::::::::: [262144]
» Elapsed time: 0:32.440
» Saving 'c:\temp\nand.bin'
» OKAY
» Elapsed time: 0:16.493
-- Scripting - Download and Branch to SDRAM --
The following script will download a binary to SDRAM via USB and branch to it for execution of the downloaded image:
# OMAP3
-omap 3
# Timeout and other config
-t 60 -p SDP_MDDR_HYNIX_4G -2
# RAM Download
chip_download SDRAM exbin.bin
# Execute image from RAM
command branch SDRAM 0
Note that the branch address offset will depend on the binary - it will not always be zero. Store the script in a text file (e.g. usb_sdram.txt) and use it as an argument
to OMAPFlash:
omapflash @usb_sdram.txt
-- Linux Flashing to eMMC --
OMAPFlash does not support the flashing of a Linux file system to any memory device, including eMMC, since only RAW image downloads are supported. This means that the x-loader, boot loader and kernel can be transferred to eMMC by OMAPFlash as raw binaries, but not the file system used by the
Linux kernel. For flashing of the Linux kernel and file system, use U-Boot.
There are multiple options for transferring U-Boot to eMMC with OMAPFlash (note that eMMC is currently only supported for the OMAP4 based
platforms).
-- U-Boot Assisted U-Boot Flashing --
OMAPFlash supports the Fastboot protocol and there is a version of U-Boot available that can be used with the Fastboot protocol. With this version
of U-Boot it is possible to transfer binaries to eMMC via U-Boot. U-Boot is transferred to SDRAM and executed by OMAPFlash. Following this, U-Boot
is used to transfer binaries to eMMC by OMAPFlash by way of the Fastboot protocol. Do the following:
1) Copy the x-loader image (x-load.bin) to ‘c:\Program Files\Texas Instruments\OMAPFlash\ uboot\x-load.bin’
2) Copy the U-Boot image (u-boot.bin) to ‘c:\Program Files\Texas Instruments\OMAPFlash\uboot\u-boot.bin’
3) Connect USB and UART to the host PC (both are needed)
4) Start a terminal program (e.g. TeraTerm) with 115,200 baud, no parity, one stop bit, no flow control on what will be the UART connecting to
COM3 on the platform
5) Set the SYSBOOT options of the platform to peripheral boot from USB
6) Open a console and change location to ‘c:\Program Files\Texas Instruments\OMAPFlash’
7) Run ‘OMAPFlash @uboot_ram.txt’ in order to transfer U-Boot to SDRAM and execute it
8) Go to the terminal program and type ‘fastboot’ in order to activate the Fastboot protocol mode of U-Boot
9) Await that the OMAPFlash script finishes in the console window
10) Change the SYSBOOT options to boot from eMMC
11) Power cycle the board
Following this, U-Boot will be ready for commands via the terminal program and can be used to download kernel and file system.
-- U-Boot Flashing --
OMAPFlash supports the download of RAW binaries to eMMC via a native eMMC driver. The x-loader and U-Boot can be transferred to eMMC by OMAPFlash
directly. Do the following:
1) Copy the x-loader image (x-load.bin) to ‘c:\Program Files\Texas Instruments\OMAPFlash\ uboot\x-load.bin’
2) Copy the U-Boot image (u-boot.bin) to ‘c:\Program Files\Texas Instruments\OMAPFlash\uboot\u-boot.bin’
3) Connect USB and UART to the host PC (both are needed)
4) Start a terminal program (e.g. TeraTerm) with 115,200 baud, no parity, one stop bit, no flow control on what will be the UART connecting to
COM3 on the platform
5) Set the SYSBOOT options of the platform to peripheral boot from USB, eMMC
6) Open a console and change location to ‘c:\Program Files\Texas Instruments\OMAPFlash’
7) Run ‘OMAPFlash @uboot_emmc.txt’ in order to transfer x-loader and U-Boot to eMMC
8) Await that the OMAPFlash script finishes in the console window
Following this, U-Boot will be ready for commands via the terminal program and can be used to download kernel and file system.

moschino_luv said:
First you need to connect your phone without battery and then load usb driver windows, after install driver run bat file ,after few second ,phone repair done.
Good Luck !
http://www.mediafire.com/?4q5viaizn5zf9l0
pass: my username
Click to expand...
Click to collapse
Would this allow us to replace the locked bootloader on Chinese phones

Thanks for the great post..I ve been dealing with a dead galaxy nexus GT-I9250M canadian..the omap flash did not work for me.. and no other solution in the horizon..
I am trying to install the uart do I need to edit the driver to contain my pid vid and how can i have both the usb and the uart in this case.. my be with your expertise you could shed some lights for y the omap not working for me..
» OMAPFlash v4.15 (Aug 12 2011)
» -v
» Entering parameter file:Targets\Projects\tuna\omap4460_tuna_hs_pro.tx t at line
: 1
» -omap 4
» -t 36000
» -p OMAP4460_TUNA_8G_HS_PRO
» -2
» -rxtx_trace
» chip_download EMMC Targets\Projects\tuna\MLO_4460_HS_PRO
» chip_download EMMC Targets\Projects\tuna\sbl.img
» command cold_sw_reset
» Leaving parameter file:Targets\Projects\tuna\omap4460_tuna_hs_pro.tx t
» @Targets\Projects\tuna\omap4460_tuna_hs_pro.txt
» Looking for device (omap usb)
» Please turn on device
» Waiting for device (omap usb)
» Found device (omap usb)
» Requesting ASIC id
00130-000-TX 4 raw bytes: 03 00 03 F0 '????'
» AsicId items 05
» AsicId id 01 05 01 44 40 07 01
» AsicId secure_mode 13 02 01 00
» AsicId public_id 12 15 01 97 1E D2 40 84 FC E8 16 AA 20 26 62 0C 90 E0
83 26 88 80 7B
» AsicId root_key_hash 14 21 01 67 98 9B 35 54 CC 86 B4 67 32 47 05 36 74 E2
25 F0 9D A3 5C F4 59 B9 C9 3A 13 E0 B9 58 1E 5A BC
» AsicId checksum 15 09 01 22 9E 85 BA DC 58 74 BC
00130-001-TX 4 raw bytes: 02 00 03 F0 '????'
» Searching 2nd for: OMAP4460_TUNA_8G_HS_PRO 444007 01 HS
» Loading second file Targets/2nd-Downloaders/dnld_startup_omap4_hs_8g_es2.s2.si
gned.2nd.hs_pro
» Entering parameter filemapflash2nd.txt at line: 46
» -pheriphalboot_reopen
» Reading board configuration file Targets\Configurations\configuration_omap4460
_tuna_8g.txt
» Reading definition file .\targets\definitions\definitions_omap4.txt
» -board_config Targets\Configurations\configuration_omap4460_tuna _8g.txt
» Leaving parameter filemapflash2nd.txt
» Sending size of second file (0x000071B0 bytes)
00130-002-TX 4 raw bytes: B0 71 00 00 '?q??'
» Transferring second file to target (0x71B0 bytes)
00130-003-TX 29104 raw bytes: B0 1C 00 00 00 4D 00 00 00 00 00 00 00 00 00 00
'?????M??????????' ...
» Closing boot connection
» Waiting for device (omap usb)
» Found device (omap usb)
» Waiting for 2nd
00463-004-TX ACK
00571-005-RX: 4 raw bytes: 70 EC 8F 00 'p???'
» Unknown status message 'p???' during peripheral boot (waiting for 2nd)
Press any key to continue . . .
----------------------
Thanx in advance for your support

Thanx
thanks for the really hard work Bro
I really hope that no one need it and every body have a safe flashing
but it's really comforting to know that there is something to fix our phones just in case
have you tried it BTW?

dont work on win7

Very Useful at last

Means that you own a chinese bootloader locked I9100G. You can't flash any other bootloader than the chinese one.

I have seen this guide on nexus s somewhere but thanks to post here
Sent from my GT-I9100G using xda premium

s alali said:
dont work on win7
Click to expand...
Click to collapse
OP did say it's for XP. did you try using a virtual computer to work around that? try virtualbox

Using this tool may open the posibility for installing Windows 8. This video shows Windows 8 is running well on the TI OMAP 4430.

Your link is not downloadble. It limited by mediafire. My phone is dead and I want to fix it. I mistakenly re-partitioned with odin. Please help

tell me if you own a Chinese i9100g or international i9100 ... ?

Harchaoui said:
tell me if you own a Chinese i9100g or international i9100 ... ?
Click to expand...
Click to collapse
It was bought from uk...

ziaulh.ch said:
It was bought from uk...
Click to expand...
Click to collapse
use my GUIDE i mean this
[GUIDE]Switch between Chinese I9100G & international I9100G SafeWay

Help Needed-Karbonn A9 android 2.3.6
Hi dude, can you remove the password from the file because I cannot download it from mediafire it says encrypted
files limit exceeded. I need this file badly.
Unfortunately I bricked my karbonn A9. I used fastboot tools and by mistake I flashed APPSBL value to System(100)Data(284).mbn My karbonn a9 doesn't boot, no green screen and no red screen. when I try to boot by pressing power button its only jerking vibration and black screen but when I press power button and volume down - key it going to ENTRY QPTS DOWNLOAD mode, but when I press power button and volume up + key the phone is jerking little vibration and black screen not booting, any help would be apprecitated.
Thanks in Advance.

Cannot download the file mate!

Please urgently provide new link of it.
I need it badly for my friend.
Thank you.

Need alernate link
Hi, I have a Samsung Galaxy S2 T989 and i am having a problem mentioned as same. Could you please share an alternate link so that i could download.

moschino_luv said:
First you need to connect your phone without battery and then load usb driver windows, after install driver run bat file ,after few second ,phone repair done.
Good Luck !
http://www.mediafire.com/?4q5viaizn5zf9l0
pass: my username
Click to expand...
Click to collapse
link not working pleaze upload it again and make it public

Related

unable to get adb working

Hello I am trying to get my g1 working without 3G and I've run in to a problem. I was able to install the RC29 image correctly.
I tried typing '<enter>reboot<enter>' and this also now works
I have downloaded the android sdk, updated it and I try to install the usb driver but this fails. The only place the phone appears in my computer is under disk drives (winxp), 'HTC Android Phone USB Device'. I have tried the 1.0 driver, 2.0 driver, hakyuro driver and I always get the same error. 'The specified location does not contain information about your hardware'
Any ideas what went wrong? right now it just decided to use the generic usb driver from microsoft.
Code:
Property Value
Status 0x0180200a Started
Problem 0x00000000 (0)
Service disk
Capabilities 0x00000010
Config Flags 0x00000000
Class DiskDrive
Manufacturer (Standard disk drives)
Hardware IDs USBSTOR\DiskHTC_____Android_Phone___0100
USBSTOR\DiskHTC_____Android_Phone___
USBSTOR\DiskHTC_____
USBSTOR\HTC_____Android_Phone___0
HTC_____Android_Phone___0
USBSTOR\GenDisk
GenDisk
Compatible IDs USBSTOR\Disk
USBSTOR\RAW
Class GUID {4D36E967-E325-11CE-BFC1-08002BE10318}
Enumerator name USBSTOR
Description Disk drive
Friendly name HTC Android Phone USB Device
Driver {4D36E967-E325-11CE-BFC1-08002BE10318}\0018
Physical Object Name \Device\0000009a
UI number 0x00000000
Install State 0x00000000
Device Address 0x00000001
Device Configuration File disk.inf
InfPath disk.inf
InfSection disk_install
InfSectionExt .NT
ProviderName Microsoft
DriverDateData 00 80 62 C5 C0 01 C1 01
DriverDate 7-1-2001
DriverVersion 5.1.2535.0
MatchingDeviceId gendisk
DriverDesc Disk drive
UpperFilters PartMgr
Class DiskDrive
Disk drives
Installer32 StorProp.Dll,DiskClassInstaller
SilentInstall 1
NoInstallClass 1
TroubleShooter-0 hcp://help/tshoot/tsdrive.htm
Icon -53

[Q] reflash stock in fastboot

Hello,
I bricked my KFHD and it is in a reset loop right now. I got a factory cable and plan to try repairing it via fastboot. I need your kind assistance with the proper commands to flash the stock ROM and get out of fastboot if needed. I know that there are instructions for doing so in the original KF but I am not sure that it applies.
Thanks.

samio2 said:
Hello,
I bricked my KFHD and it is in a reset loop right now. I got a factory cable and plan to try repairing it via fastboot. I need your kind assistance with the proper commands to flash the stock ROM and get out of fastboot if needed. I know that there are instructions for doing so in the original KF but I am not sure that it applies.
Thanks.
Click to expand...
Click to collapse
Please describe the "reset loop" you are experiencing.

Well at boot it detects something wrong and it prompts me either to reset or reboot. Regardless of what I choose it always returns me to the same prompt. Meanwhile there is no usb connectivity what so ever. I tried the 20 second hold on the power button but nothing changed

samio2 said:
Well at boot it detects something wrong and it prompts me either to reset or reboot. Regardless of what I choose it always returns me to the same prompt. Meanwhile there is no usb connectivity what so ever. I tried the 20 second hold on the power button but nothing changed
Click to expand...
Click to collapse
When choosing "reset" does it look like its doing anything or does it just reboot?

Hello!
Ive got the same Q.
Messed up preinstalled keyboard, added some apk to /system/app folder. Now my kindle acts very bad....
Default settings in device section doesn't help. I tried to copy update....bin file to kindleupdate folder but it doesn't help, kindle won't flash (as i've already have last ver)
So, is there any way to flash KHD in fastboot mode, or using update.zip file? Mayby have someth like [UTILITY] Kindle Fire Unbrick Utility V1.1! ?
Thx a lot

It starts resetting and a progress bar shows and completes in a couple of seconds. Then it reboots back to the same prompt

I doubt factory reset would help. If my experience is any indication, factory reset will not undo any changes you did to /system. If you messed it up before resetting, you'll still be messed up after.

I think I messed up the /system and I want to try to reflash it

the good news is once you disconnect the cable the device exits fastboot also it shows up as android adb interface in device manager. but I could not get adb to see it. don't know why. I used the same PC that I used to root it and a mac but could not get adb to see it.

samio2 said:
I think I messed up the /system and I want to try to reflash it
Click to expand...
Click to collapse
What were you doing in /system before the problem started?

Was trying to install Google play. Not sure where i messed up

Do you still have adb access?

The device shows up in the device manager. But adb can't see them

samio2 said:
The device shows up in the device manager. But adb can't see them
Click to expand...
Click to collapse
What does your device manager say?

on windows it said android adb deive (or interface). as for the mac it is the same case and I used the usb probe and here is the output
Code:
High Speed device @ 2 (0x26200000): ............................................. Composite device: "Tate-PVT-08"
Port Information: 0x001f
Captive
Attached to Root Hub
Internal Device
Connected
Enabled
Device Descriptor
Descriptor Version Number: 0x0200
Device Class: 0 (Composite)
Device Subclass: 0
Device Protocol: 0
Device MaxPacketSize: 64
Device VendorID/ProductID: 0x1949/0x0007 (Lab126)
Device Version Number: 0x0100
Number of Configurations: 1
Manufacturer String: 5 "Texas Instruments"
Product String: 1 "Tate-PVT-08"
Serial Number String: 2 "XXX"
Configuration Descriptor: ....................................... "Android Fastboot"
Length (and contents): 32
Raw Descriptor (hex) 0000: 09 02 20 00 01 01 03 C0 32 09 04 00 00 02 FF 42
Raw Descriptor (hex) 0010: 03 04 07 05 81 02 00 02 00 07 05 01 02 00 02 00
Unknown Descriptor 0020:
Number of Interfaces: 1
Configuration Value: 1
Attributes: 0xC0 (self-powered)
MaxPower: 100 ma
Interface #0 - Vendor-specific .............................................. "Android Fastboot"
Alternate Setting 0
Number of Endpoints 2
Interface Class: 255 (Vendor-specific)
Interface Subclass; 66 (Vendor-specific)
Interface Protocol: 3
Endpoint 0x81 - Bulk Input
Address: 0x81 (IN)
Attributes: 0x02 (Bulk no synchronization data endpoint)
Max Packet Size: 512
Polling Interval: 0 ( Endpoint never NAKs)
Endpoint 0x01 - Bulk Output
Address: 0x01 (OUT)
Attributes: 0x02 (Bulk no synchronization data endpoint)
Max Packet Size: 512
Polling Interval: 0 ( Endpoint never NAKs)
Device Qualifier Descriptor
Descriptor Version Number: 0x0200
Device Class 255 (Vendor-specific)
Device Subclass 255 (Vendor-specific)
Device Protocol 255
Device MaxPacketSize: 64
Number of Configurations: 1
bReserved: 0
Configuration Descriptor Device gave an error kIOReturnSuccess (0x0) when asked for first 4 bytes of descriptor
Configuration Descriptor Device gave an error kIOReturnSuccess (0x0) when asked for first 9 bytes of descriptor

Well, that's helpful. It says you're in fastboot. Try using fastboot to change your bootmode to either recovery or normal mode and see if you can get a different result.

Shouldn't adb recognize it to work with faatboot or are they separate?
how do change the bootmode? How to change it back?
I tried fastboot reboot but all i got is waiting for device message.

samio2 said:
Shouldn't adb recognize it to work with faatboot or are they separate?
how do change the bootmode? How to change it back?
I tried fastboot reboot but all i got is waiting for device message.
Click to expand...
Click to collapse
ADB and fastboot are completely separate.
Try "fastboot devices"

fastboot devices shows nothing for me

That's likely an issue with your drivers. Try reinstalling them. Or better yet, try the SoupKit and save yourself some hassle.

[Q] Bricked or not bricked? That is the question!

I got one of those original HP 16GB WIFI TouchPad. I had the famous too-discharged-won't-boot-anymore ( question-mark-battery-logo issue ) 3 times which I managed to resolve through usage of this forum ( Thank you! ) This time, I don't know what to do. Nothing on screen at all, I can only 'see' something through looking at what device the TouchPad appears as on the USB port:
Palm:
Product ID: 0x8070
Vendor ID: 0x0830 (Palm Inc.)
Version: 10.00
Speed: Up to 480 Mb/sec
Manufacturer: bootie
Location ID: 0xfa140000 / 6
Current Available (mA): 500
Current Required (mA): 500
The other mode I can start the TouchPad in is the 'QHSUSB_DLOAD'
QHSUSB_DLOAD:
Product ID: 0x9008
Vendor ID: 0x05c6 (Qualcomm, Inc)
Version: 0.00
Speed: Up to 480 Mb/sec
Manufacturer: Qualcomm CDMA Technologies MSM
Location ID: 0xfa140000 / 6
Current Available (mA): 500
Current Required (mA): 2
Taken from @jcsullins toolbox script, with the TouchPad booted in 'Palm' mode I can enter a few commands and eventually able to establish a SSH connection with my TouchPad.
$ dfu-util -d 0830:8070 -R -D ./tpdebrick-v004/moboot-dfu-v004
$ fastboot flash bootmem ./tpdebrick-v004/TPToolbox-Headless-v004
$ ssh -i ssh-key [email protected]
I can connect to the TouchPad, I have access to pretty all devices ( although screen is still blank ). I've even backed up the entire 16GB flash ( as it is now )
[email protected](none):/mnt# dd if=/dev/mmcblk0 | gzip -c | ssh [email protected] 'dd of=/Volumes/BACKUP_80GB/touchpad_full_image_backup20150124.gz'
Below is just ( for reference the list of the many parititions )
[email protected](none):/mnt# fdisk /dev/mmcblk0
Disk /dev/mmcblk0: 15.9 GB, 15923675136 bytes
1 heads, 16 sectors/track, 1943808 cylinders, total 31100928 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6d6c6150
Device Boot Start End Blocks Id System
/dev/mmcblk0p1 1 204800 102400 c W95 FAT32 (LBA)
/dev/mmcblk0p2 * 204801 205800 500 4d QNX4.x
/dev/mmcblk0p3 205801 208800 1500 51 OnTrack DM6 Aux1
/dev/mmcblk0p4 208801 30969855 15380527+ 5 Extended
/dev/mmcblk0p5 262144 263143 500 47 Unknown
/dev/mmcblk0p6 393216 394715 750 45 Unknown
/dev/mmcblk0p7 524288 529287 2500 4c Unknown
/dev/mmcblk0p8 655360 675839 10240 48 Unknown
/dev/mmcblk0p9 786432 789431 1500 46 Unknown
/dev/mmcblk0p10 917504 923647 3072 4a Unknown
/dev/mmcblk0p11 1048576 1054719 3072 4b Unknown
/dev/mmcblk0p12 1054720 1062911 4096 f0 Linux/PA-RISC boot
/dev/mmcblk0p13 1062912 1128447 32768 83 Linux
/dev/mmcblk0p14 1179648 30969855 14895104 8e Linux LVM
That great! Now what?
Is my TouchPad really dead?
Can I use it still for Android?
How can I reflash or put back 'Web OS Recovery' ?
With all of the access I feel I have, do I need 'WebOS Recovery' at all?
Can't I just 'DD' one or more of the 14 partitions ?

Rastikan said:
I got one of those original HP 16GB WIFI TouchPad. I had the famous too-discharged-won't-boot-anymore ( question-mark-battery-logo issue ) 3 times which I managed to resolve through usage of this forum ( Thank you! ) This time, I don't know what to do. Nothing on screen at all, I can only 'see' something through looking at what device the TouchPad appears as on the USB port:
Palm:
Product ID: 0x8070
Vendor ID: 0x0830 (Palm Inc.)
Version: 10.00
Speed: Up to 480 Mb/sec
Manufacturer: bootie
Location ID: 0xfa140000 / 6
Current Available (mA): 500
Current Required (mA): 500
The other mode I can start the TouchPad in is the 'QHSUSB_DLOAD'
QHSUSB_DLOAD:
Product ID: 0x9008
Vendor ID: 0x05c6 (Qualcomm, Inc)
Version: 0.00
Speed: Up to 480 Mb/sec
Manufacturer: Qualcomm CDMA Technologies MSM
Location ID: 0xfa140000 / 6
Current Available (mA): 500
Current Required (mA): 2
Taken from @jcsullins toolbox script, with the TouchPad booted in 'Palm' mode I can enter a few commands and eventually able to establish a SSH connection with my TouchPad.
$ dfu-util -d 0830:8070 -R -D ./tpdebrick-v004/moboot-dfu-v004
$ fastboot flash bootmem ./tpdebrick-v004/TPToolbox-Headless-v004
$ ssh -i ssh-key [email protected]
I can connect to the TouchPad, I have access to pretty all devices ( although screen is still blank ). I've even backed up the entire 16GB flash ( as it is now )
[email protected](none):/mnt# dd if=/dev/mmcblk0 | gzip -c | ssh [email protected] 'dd of=/Volumes/BACKUP_80GB/touchpad_full_image_backup20150124.gz'
Below is just ( for reference the list of the many parititions )
[email protected](none):/mnt# fdisk /dev/mmcblk0
Disk /dev/mmcblk0: 15.9 GB, 15923675136 bytes
1 heads, 16 sectors/track, 1943808 cylinders, total 31100928 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6d6c6150
Device Boot Start End Blocks Id System
/dev/mmcblk0p1 1 204800 102400 c W95 FAT32 (LBA)
/dev/mmcblk0p2 * 204801 205800 500 4d QNX4.x
/dev/mmcblk0p3 205801 208800 1500 51 OnTrack DM6 Aux1
/dev/mmcblk0p4 208801 30969855 15380527+ 5 Extended
/dev/mmcblk0p5 262144 263143 500 47 Unknown
/dev/mmcblk0p6 393216 394715 750 45 Unknown
/dev/mmcblk0p7 524288 529287 2500 4c Unknown
/dev/mmcblk0p8 655360 675839 10240 48 Unknown
/dev/mmcblk0p9 786432 789431 1500 46 Unknown
/dev/mmcblk0p10 917504 923647 3072 4a Unknown
/dev/mmcblk0p11 1048576 1054719 3072 4b Unknown
/dev/mmcblk0p12 1054720 1062911 4096 f0 Linux/PA-RISC boot
/dev/mmcblk0p13 1062912 1128447 32768 83 Linux
/dev/mmcblk0p14 1179648 30969855 14895104 8e Linux LVM
That great! Now what?
Is my TouchPad really dead?
Can I use it still for Android?
How can I reflash or put back 'Web OS Recovery' ?
With all of the access I feel I have, do I need 'WebOS Recovery' at all?
Can't I just 'DD' one or more of the 14 partitions ?
Click to expand...
Click to collapse
Try to (just) load this version of moboot-dfu instead:
https://goo.im/devs/jcsullins/tpdebrick/moboot-dfu-20150128
Do you see small text appear on the screen after loading it?
If so, are there two lines with "a6_test"? If so, what do they say. If not, what does it say on the screen.
If nothing appears on screen, does it show up when you run "fastboot devices" ?
If so, does it allow you to run "fastboot oem klogs 2>&1"? If so, upload the output and give link here.

jcsullins said:
Try to (just) load this version of moboot-dfu instead:
https://goo.im/devs/jcsullins/tpdebrick/moboot-dfu-20150128
Click to expand...
Click to collapse
Ok, from the 'Palm mode' ( POWER + HOME + VOLUME-UP ) for about 30 seconds ...
Code:
dfu-util -d 0830:8070 -R -D moboot-dfu-20150128
jcsullins said:
Do you see small text appear on the screen after loading it?
Click to expand...
Click to collapse
Yes!!! Thank you! I was beginning to think something was damaged as I didn't see anything on screen for long time ( although I was getting some access through SSH )
jcsullins said:
If so, are there two lines with "a6_test"? If so, what do they say. If not, what does it say on the screen.
Click to expand...
Click to collapse
Code:
(bootloader) [2100] a6_test: batt valid=1 percent=0 voltage=3225680
(bootloader) [2110] a6_test: batt temp=19 current=-312 coulombs=0
Although it does says 0 percent, I did let it charge the whole night ( as your tpdebrick tool suggests )
jcsullins said:
If nothing appears on screen, does it show up when you run "fastboot devices" ?
If so, does it allow you to run "fastboot oem klogs 2>&1"? If so, upload the output and give link here.
Click to expand...
Click to collapse
Yes, I see ( finally) stuff on the screen! Again, Thank you! I was beginning to think something was damaged as I didn't see anything on screen for long time.
http://forum.xda-developers.com/attachment.php?attachmentid=3139872&stc=1&d=1422547266
Now can I go ahead and load-up or run your full toolbox software and reformat/setup the entire flash device for Android ?

[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"

[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...

foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
I am thinking that bytes 0...4487 is the real bootloader code, so:
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Wow! Excited to see this! Thanks

It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.

foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Good job, if needed i can help with the checking

tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
abl.img is not the bootloader i guess.

tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
On other devices they've been able to swap this image with another one to "hide" the message, to "get rid of it".

Would we sweet if we could get rid of the unlocked bootloader message too.

dennisbednarz said:
Would we sweet if we could get rid of the unlocked bootloader message too.
Click to expand...
Click to collapse
+1

U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool

jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.

Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...

foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Use this https://forum.xda-developers.com/oneplus-6t/how-to/tool-6t-msmdownloadtool-v4-0-oos-9-0-5-t3867448
Should try for several times with instruction here

Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.

patelparth120595 said:
Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.
Click to expand...
Click to collapse
Disabled dm-verity caused red warning, i guess.
---------- Post added at 10:01 AM ---------- Previous post was at 09:58 AM ----------
foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
And then:
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Edited abl.img ? and flashed via recovery/fastboot ?

AnoopKumar said:
Edited abl.img ? and flashed via recovery/fastboot ?
Click to expand...
Click to collapse
No, just flashed using dd command in TWRP shell.

foobar66 said:
No, just flashed using dd command in TWRP shell.
Click to expand...
Click to collapse
Phone still dead ?

OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5

foobar66 said:
OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5
Click to expand...
Click to collapse
I assume that, there is nothing to do with the abl.img. Only thing we can do with it is change the default strings to a song lyric or something. abl.img is the uefi firmware i guess. Bootloader is using the images stored in the logo partition.

Gsi's flash without breaking verity if u flash to both slots. And totally format. Fastboot -w. The phone sees any changes to partitions as corruption and breaks verity, hence red warning.. if someone would be inclined to talk to invisiblek from the essential threads, he could tell u of a fix. The solution is not in abl. It's in the stock boot.img. if I had more time, I would help
---------- Post added at 02:52 PM ---------- Previous post was at 02:51 PM ----------
tech_head said:
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.
Click to expand...
Click to collapse
No, they are talking about breaking verity also. Seems to be both messages, but more recently the broken verity message. Which there is two types, one u can boot from, one u cannot.

jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
I would love that idea. That would be really nice to have on our device

Bricked Lumia 930 - No Reaction / No Boot

I have tried to mod my Nokia Lumia 930. My bootloader was already unlocked for side loading. Now I wanted to mod Astoria on it so that I can also use Android apps. However, Windows Phone Internals kept telling me that my phone is already unlocked. When starting the Mass Storage Mode and Enabled Toor Access, the message of the missing FFU appeared.
After trying to reflash, I entered the red bootloop and could no longer access the phone. The recovery tool also failed here.
When using the Thor2 tool manually, the following message appeared:
Bash:
PS C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool> .\thor2.exe -mode uefiflash -ffufile "..\..\..\Users\myUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu"
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
............
programming operation failed!
327681 Error: Unable to send or receive message.
Operation took about 8.00 seconds. Average transfer speed was 2.65 MB/s.
THOR2_ERROR_UNABLE_TO_SEND_OR_RECEIVE_MESSAGE_DURING_SFFU_PROGRAMMING
The phone went off and since then it is not responding. Also not on the power button or the combo power button + volume down.
Full Log:
Spoiler
Bash:
PS C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool> .\thor2.exe -mode uefiflash -ffufile "..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu"
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\thor2.exe -mode uefiflash -ffufile ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
Process started Thu Dec 29 21:58:12 2022
Logging to file C:\Users\MyUser\AppData\Local\Temp\thor2_win_20221229215812_ThreadId-51424.log
Debugging enabled for uefiflash
Initiating FFU flash operation
WinUSB in use.
isDeviceInNcsdMode
isDeviceInNcsdMode is false
Device mode 6 Uefi mode
[THOR2_flash_state] Pre-programming operations
Disable timeouts
Get flashing parameters
Lumia Flash detected
Protocol version 2.34 Implementation version 2.59
Size of one transfer is 2363392
MMOS RAM support: 1
Size of buffer is 2359296
Number of eMMC sectors: 61071360
Platform ID of device: Nokia.MSM8974.P6180.2.2
Async protocol version: 01
Security info:
Platform secure boot enabled
Secure FFU enabled
JTAG eFuse blown
RDC not found
Authentication not done
UEFI secure boot enabled
SHK enabled
Device supports FFU protocols: 0015
Subblock ID 32
[THOR2_flash_state] Device programming started
Using secure flash method
CoreProgrammer version 2015.06.10.001.
Start programming signed ffu file ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
FfuReader version is 2015061501
Send FlashApp write parameter: 0x4d544f00
Perform handshake with UEFI...
Flash app: Protocol Version 2.34 Implementation Version 2.59
Unknown sub block detected. Skip...
DevicePlatformInfo: Nokia.MSM8974.P6180.2.2
Unknown sub block detected. Skip...
Unknown sub block detected. Skip...
Supported protocol versions bitmap is 15
Secure FFU sync version 1 supported.
Secure FFU async version 1 supported.
Secure FFU sync version 2 supported.
Secure FFU async version 2 supported.
CRC header v. 1
CRC align bytes. 4
Get CID of the device...
Get EMMC size of the device...
Emmc size in sectors: 61071360
CID: Samsung, Size 29820 MB
Start charging...
Start charging... DONE. Status = 0
ConnSpeedEcho: Elapsed= 0.212000, EchoSpeed= 31.84, Transferred= 7077918 bytes
Get security Status...
Security Status:
Platform secure boot is enabled.
Secure eFUSE is enabled.
JTAG is disabled.
RDC is missing from the device.
Authentication is not done.
UEFI secure boot is enabled.
Secondary HW key exists.
Get RKH of the device...
RKH of the device is 800EEB508F7BBDF12A19262621FD837297A3B062FE2A7078C0F3167E57F21217
Get ISSW Version...
ISSW Version: 216
Mon Aug 11 15:16:52 EEST 2014;ISSW v0216; main; OS; DNE; KCI 1296; ASIC 8974;
Get system memory size...
Size of system mem: 2097152 KB
Read antitheft status...
Requested read param 0x41545250 is not supported by this flash app version.
Send backup to RAM req...
Clearing the backup GPT...SKIPPED!
Successfully parsed FFU file. Header size: 0x000e0000, Payload size: 0x000000006f400000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000e0000
RKH match between device and FFU file!
Option: Skip CRC32 check in use
Start sending header data...
Start sending payload data V2Sbl in async mode...
Percents: 0
Percents: 1
Exception during programming: 262160
Safe write descriptor index reached: false
Payload data transfer speed (16.88 MB/s) Elapsed time 1.33 sec
Payload data size 22.500305 MB
[IN] programSecureFfuFile. Closing ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
programming operation failed!
327681 Error: Unable to send or receive message.
Operation took about 8.00 seconds. Average transfer speed was 2.65 MB/s.
THOR2_ERROR_UNABLE_TO_SEND_OR_RECEIVE_MESSAGE_DURING_SFFU_PROGRAMMING
THOR2 1.8.2.18 exited with error code 262160 (0x40010)

This means your phone is hardbricked you should take it to the service center

Is der a solution without service center? Its out of support.

Huskynarr said:
Is der a solution without service center? Its out of support.
Click to expand...
Click to collapse
does jtag work?

Nope, doesnt work. Have send it now back to seller.

Database Develop

welcome