Database Develop

Bricked Optimus2X

Hello, i think my Optimus 2x is bricked. I flashed a wrong ROM and it would "freeze" at the LG logo. So I followed a guide that said would flash the phone to stock with NVflash. Anyway the guide said that I should go back to EXT3 FIRST before flashing but I forgot and now the phone won't even boot. Nothing happens when trying to turn it on. However my PC still sees APX/Nvidia recovery whatever when i plug it in.
Help.

Try this: http://forum.xda-developers.com/showthread.php?t=1229407
Also if nvflash doesn't work, try smartflash!

There is numerous threads with title brick, bricked and etc. Little search would be nice...
You can read my answer here -> http://forum.xda-developers.com/showpost.php?p=24024818&postcount=6

SP1996AC said:
Try this: http://forum.xda-developers.com/showthread.php?t=1229407
Also if nvflash doesn't work, try smartflash!
Click to expand...
Click to collapse
Tried that... The thing is, the phone seems to be completely DEAD. Reacts to nothing.
Please pick a recovery, or exit [1,2,X]?1
Attempting to flash internal recovery...
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x033c2087415ff597
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
download command failed NvError 0x120002
command failure: bootloader download failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073840124
I got the same results even when not holding vol up and down. But I'll try Memhis link.

Memhis said:
There is numerous threads with title brick, bricked and etc. Little search would be nice...
You can read my answer here -> http://forum.xda-developers.com/showpost.php?p=24024818&postcount=6
Click to expand...
Click to collapse
Yeah sorry I'm just really worried right now. It's not really my phone, so I'm trying to get it fixed quick. Thanks for the link

Memhis said:
There is numerous threads with title brick, bricked and etc. Little search would be nice...
You can read my answer here -> http://forum.xda-developers.com/showpost.php?p=24024818&postcount=6
Click to expand...
Click to collapse
It doesn't work! The phone is stuck in APX mode! Doesn't matter what I do, if i plug it Windows says APX. There has to be a way! But the phone doesn't react to any buttons, whatever I hold, or do, it's still in APX mode and dead.

install lg drivers and flash kdz firmware and then root the phone!

on the first post, i had the same problem a week ago. what fixed my phone was flash stock ROM using smartflash, with the .fls and .bin file. its just like newly bought phone after the flash. hope it helps!
Sent from my Optimus 2X using XDA

mrgian said:
on the first post, i had the same problem a week ago. what fixed my phone was flash stock ROM using smartflash, with the .fls and .bin file. its just like newly bought phone after the flash. hope it helps!
Sent from my Optimus 2X using XDA
Click to expand...
Click to collapse
I guess I have my p990 also stuck in APX mode. Smartflash doesn't detect my phone, and NVFlash (recovery) returns:
Please pick a recovery, or exit [1,2,X]?2
Attempting to flash external recovery...
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x028841484180d657
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
download command failed NvError 0x120002
command failure: bootloader download failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073840124
Which is the same problem as ITSANDEN
Thing is, I ran xda forum end to end looking for people with same trouble as I and I could not find any help. It's like a loop! LOL
If nvflash doesn't work use Smartflash, and vice versa.... LOL :frustrated:
Anyway, I'll keep looking.
---------- Post added at 08:15 PM ---------- Previous post was at 07:33 PM ----------
mrgian said:
on the first post, i had the same problem a week ago. what fixed my phone was flash stock ROM using smartflash, with the .fls and .bin file. its just like newly bought phone after the flash. hope it helps!
Sent from my Optimus 2X using XDA
Click to expand...
Click to collapse
Memhis said:
There is numerous threads with title brick, bricked and etc. Little search would be nice...
You can read my answer here -> http://forum.xda-developers.com/showpost.php?p=24024818&postcount=6
Click to expand...
Click to collapse
Unfortunately SmartFlashTool doesn't work since the phone is running in APX and doesn't create port connection that SFT software can recognize.

Try to nvflash whole rom not just recovery. Ie pauls v10b. I hope it will work for you.
Sent from my LG-P990 using xda app-developers app

xtrustkillx said:
Try to nvflash whole rom not just recovery. Ie pauls v10b. I hope it will work for you.
Sent from my LG-P990 using xda app-developers app
Click to expand...
Click to collapse
I tried both!
When I do the whole rom procedure it gives an error message, but since the cmd window closes right away i can't copy (or i am not aware of a way to retrieve the text....).
Supposedly after NVFlashing the whole ROM I should unplug the cable, install the battery and boot the phone.
At this point the phone doesn't boot, or at least nothing is showing on the screen.
Volume down+ power also doesn't work so I cannot do to CMW.
Do I need to send it to LG?
Thanks for your help anyways!
EDIT:
Actually I managed to keep the CMD window open and this is what I got:
Code:
C:\Users\Dinis\Desktop\desktop\android\Emergency>.\nvflash.exe --bct E1108_Hynix
_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct --setbct --odmdata 0xC8000 --co
nfigfile android_fastboot_emmc_full.cfg --create --bl fastboot.bin --go
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x028841484180d657
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
sending file: E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct
- 4080/4080 bytes sent
E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct sent successfully
odm data: 0xc8000
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 2 3
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: MBR
creating partition: APP
creating partition: CAC
creating partition: MSC
creating partition: EB1
creating partition: LNX
creating partition: EB2
creating partition: DRM
creating partition: EB3
creating partition: SOS
creating partition: EB4
creating partition: UDA
creating partition: EB5
creating partition: UDB
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 MBR please wait.. done!
Formatting partition 6 APP please wait.. done!
Formatting partition 7 CAC please wait.. done!
Formatting partition 8 MSC please wait.. done!
Formatting partition 9 EB1 please wait.. done!
Formatting partition 10 LNX please wait.. done!
Formatting partition 11 EB2 please wait.. done!
Formatting partition 12 DRM please wait.. done!
Formatting partition 13 EB3 please wait.. done!
Formatting partition 14 SOS please wait.. done!
Formatting partition 15 EB4 please wait.. done!
Formatting partition 16 UDA please wait.. done!
Formatting partition 17 EB5 please wait.. done!
Formatting partition 18 UDB please wait.. done!
done!
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
sending file: system.img
- 851968/358400000 bytes sentdata send failed NvError 0x120002
command failure: create failed (bad data)

Can you enter fastboot now or still stuck in apx? Just in case: Turn off the phone. Remove battery and
hold it removed for few secs. Put it back and press and hold vol - and power button. Keep it pressed and then try smartflash.
Sent from my LG-P990 using xda app-developers app

xtrustkillx said:
Can you enter fastboot now or still stuck in apx? Just in case: Turn off the phone. Remove battery and
hold it removed for few secs. Put it back and press and hold vol - and power button. Keep it pressed and then try smartflash.
Sent from my LG-P990 using xda app-developers app
Click to expand...
Click to collapse
Still stuck in APX.
SmartFlash keeps not detecting it!
Thanks For Helping out!

Thats strange. Try to nvflash again without sim and sd card, different cable, different usb port (prefere those which are directly on motherboard on the back of your pc). Just a bunch of ideas.
Sent from my LG-P990 using xda app-developers app

xtrustkillx said:
Thats strange. Try to nvflash again without sim and sd card, different cable, different usb port (prefere those which are directly on motherboard on the back of your pc). Just a bunch of ideas.
Sent from my LG-P990 using xda app-developers app
Click to expand...
Click to collapse
Totally strange!! Now I tried again to nvflash with modaco's [ android.modaco.com/topic/335474-25-mar-nvflash-stock-rom-release-v10b-dated-1300166062-15032011/ ]
and it fails in the same way as Rusty's
Code:
(...)
Formatting partition 18 UDB please wait.. done!
done!
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
sending file: system.img
| 2818048/358400000 bytes sentdata send failed NvError 0x120002
command failure: create failed (bad data)
I tried 3 cables, and 3 usbports in my laptop. It worked before, so something must have gone wrong.
Weekend is coming, if I cant fix it Ill have to send to LG and buy a new one while waiting some (hopefully not many) time to get it back!
EDIT:
After some tries the data transferred increased
Code:
(...)
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
sending file: system.img
| 339935232/358400000 bytes sentdata send failed NvError 0x120002
command failure: create failed (bad data)
EDIT 2:
Until I turned off all services, browser and dropbox and what not and:
Code:
(...)
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
sending file: system.img
- 358400000/358400000 bytes sent
system.img sent successfully
sending file: boot.img
- 3420160/3420160 bytes sent
boot.img sent successfully
sending file: recovery.img
- 3958784/3958784 bytes sent
recovery.img sent successfully
But afterwards, it booted LG logo and sound and nothing else. I waited 20 minutes for something to happen until I removed the baterry and turned on again. and LG Logo only....
Then, I tried to battery off and volume down+data cable and i could smartflash. as result it booted once, No LG logo with blue halo but sound played, and again nothing happened for another half hour until i turned off and NVFLashed again and bricked the phone again.
So, now, back to step 1, My phone is stuck in APX and I don't think NVFlash will solve even if it works after 30 tries.

Maybe I have the solution:
Just download the right version of stock gingerbread, check this link:
http://www.todomovillg.es/elforodehomero/index.php?topic=317.0
With this .kdz file, you have to use the KDZ Updater and the LG driver.
Download the latest LG driver here and intall it right after: http://www.lg.com/ca_en/support/mc-support/mobile-phone-support.jsp
UNPLUG your phone before installing this driver.
And the KDZ Updater here: http://forum.xda-developers.com/attachment.php?attachmentid=420545&d=1287222698
When that's done, extract the KDZ Updater folder on your desktop.
1. Open it and install the msxml.msi file.
2. After that, run the KDZ_FW_UPD.exe
3. In that software, you will choose Type: 3GQCT and the PhoneMode: DIAG
4. Choose your recently downloaded .kdz file but DON'T LAUNCH SOFTWARE UPDATE yet.
5. PowerOff your phone and pull out the battery.
6. Hold Volume Down and plug in it to your computer with your USB cable.
7. Your phone must be in S/W UPGRADE Please wait while upgrading...
8. When that's done, just push the Launch Software Update button.
9. WAIT until it reboot and put your battery in.
10. When kdz updater finish, unplug your phone and Enjoy. :good:
Hope that help.

JasonBourne.Qc said:
Maybe I have the solution:
Just download the right version of stock gingerbread, check this link:
http://www.todomovillg.es/elforodehomero/index.php?topic=317.0
With this .kdz file, you have to use the KDZ Updater and the LG driver.
Download the latest LG driver here and intall it right after: http://www.lg.com/ca_en/support/mc-support/mobile-phone-support.jsp
UNPLUG your phone before installing this driver.
And the KDZ Updater here: http://forum.xda-developers.com/attachment.php?attachmentid=420545&d=1287222698
When that's done, extract the KDZ Updater folder on your desktop.
1. Open it and install the msxml.msi file.
2. After that, run the KDZ_FW_UPD.exe
3. In that software, you will choose Type: 3GQCT and the PhoneMode: DIAG
4. Choose your recently downloaded .kdz file but DON'T LAUNCH SOFTWARE UPDATE yet.
5. PowerOff your phone and pull out the battery.
6. Hold Volume Down and plug in it to your computer with your USB cable.
7. Your phone must be in S/W UPGRADE Please wait while upgrading...
8. When that's done, just push the Launch Software Update button.
9. WAIT until it reboot and put your battery in.
10. When kdz updater finish, unplug your phone and Enjoy. :good:
Hope that help.
Click to expand...
Click to collapse
I was trying your solution, but no luck.... I got in KDZ updater : connecting to phone. PHONE WAS NOT FOUND! Finished. any idea? I installed LG drivers, my phone is stuck, no power on, no volume down + power .... looks like its fully bricked, please help me guys

Do not use Smartflash, bro.
Use nvflash in this post, I used to have a half-brick O2X but this post saved me
http://www.modaco.com/topic/335474-25-mar-nvflash-stock-rom-release-v10b-dated-1300166062-15032011/
Good luck! Yuo will need it.

Try to use stefan's ics nvflash version, i think his thread is on page 3/4, then boot it up, if you're planning to use cm10 with the new bootloader use aio tool, or you can download the stock gb/froyo from modaco then nvflash it
Sent from my LG-P990 using Tapatalk 2

Someone fixed the problem yet??

Revone not found.

I've done everything by the book, but when I type "chmode 755 revone" it says it's not found; I've also tried "chmode 755 revone.bin", still doesn't work.
What can I do?
I'm using Terminal Emulator and Rom Toolbox Lite, doesn't work in both.

There's the obvious questions:
What directory are you in when you typed that command?
Is that the same directory you copied revone to on your phone?

deeevan said:
There's the obvious questions:
What directory are you in when you typed that command?
Is that the same directory you copied revone to on your phone?
Click to expand...
Click to collapse
cd /data/local/tmp
For both.

The command is chmod, you added an e to the end. It's complaining that the command can't be found, not revone.

deeevan said:
The command is chmod, you added an e to the end. It's complaining that the command can't be found, not revone.
Click to expand...
Click to collapse
Oh boy, now I'm ashamed.
Ok, done it, but now it says "error 1", what should I do?
EDIT: I've tried "./revone -p" [with a lower case p] and it says error, but also says "revone successful".
After that I rebooted, then tried "./revone -s 0 -u" and I get error code 1. What should I do?

Must downgrade to android 4.2 or less. If your on android 4.3, Rev one will not work.
Sent from my Nexus 7 using xda app-developers app

Maybe a working nvflash method

Maybe I am late by 3 years, but I got my hands on a zip file from LG called "P880 nvFlash tool(Recovery tool).zip".
It may can unbrick phones which happend to end up in APX (nvflash) mode.
There are two 2 type of bat files in it. 1 uses the regular nvlfash command like for optimus 2x and the other uses a blob file and also uses an encrypted bootloader and bct file.
My advice is to use the bat files from the "Final" folder if it's happen to work as it flashes the system.img boot.img and recovery.img too.
Here is the download link
And an image of the content
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Hopeful signs
Never too late to post useful tools. I know I'd be a lot braver in experimenting if I knew I could recover from any possible screwup, and that is pretty much what this looks like.
I don't have windows and apparently didn't find the right nvflash executable for linux, but I came close. I am being very cautious and tried the minimal nvflash command I could think of, the --wait command, figuring it would be hard for THAT to hose me. Apparently it didn't but it also didn't quite work either.
Code:
# ./nvflash --blob blob.bin -w
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
# ./nvflash -r --blob blob.bin --go
Nvflash v1.13.87205 started
[resume mode]
Using blob v1.1.57813
command failure: go failed
Considering that normally nvflash does absolutely nothing this tells me these files really do have the crypto 'mojo' for talking to the phone. So once I find a newer nvflash I'll play some more and report.
Update: That Chip uid matches the USB serial number so that proves beyond a doubt that nvflash is successfully communicating with the crypto enabled.

jmorris_42 said:
Never too late to post useful tools. I know I'd be a lot braver in experimenting if I knew I could recover from any possible screwup, and that is pretty much what this looks like.
I don't have windows and apparently didn't find the right nvflash executable for linux, but I came close. I am being very cautious and tried the minimal nvflash command I could think of, the --wait command, figuring it would be hard for THAT to hose me. Apparently it didn't but it also didn't quite work either.
Code:
# ./nvflash --blob blob.bin -w
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
# ./nvflash -r --blob blob.bin --go
Nvflash v1.13.87205 started
[resume mode]
Using blob v1.1.57813
command failure: go failed
Considering that normally nvflash does absolutely nothing this tells me these files really do have the crypto 'mojo' for talking to the phone. So once I find a newer nvflash I'll play some more and report.
Update: That Chip uid matches the USB serial number so that proves beyond a doubt that nvflash is successfully communicating with the crypto enabled.
Click to expand...
Click to collapse
That sounds great.
Maybe you can try using the --getpartitiontable switch or read back a partition with the --read switch. Use the blob and the encrypted bootloader for that.
That two switch should not cause any problam to your device, normaly. But you may have heard that HTC One X gets stucked in APX mode if the user entered to that mode by accident. So anything can happen.
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Or
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go

bitdomo said:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Or
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go
Click to expand...
Click to collapse
Code:
# nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
Code:
# nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
Nope, it throws out that unknown bootrom version and stops right there. Even better is that the version of NvFlash I'm running is newer than the one in the zip file you provide, which is v1.7.75664. Looks like I have to go find a Windows PC and see what happens on that. Good grief but the horror show that I just that is going to be.... usb driver heck. Long term, gotta make it work here if it going to be very useful but need to know where the trouble is.
Not giving up here, too close.

Total extraction achieved
After a few hours of Windows Update grinding because I hadn't booted that side of that machine for months.....
Victory is achieved. All partitions successfully extracted, including those not normally visible. Now moving them back to the Linux box for examination and comparing to what was extracted via adb from the running phone for a sanity check, but the sizes all match, etc. and this IS supposed to be LG's own recovery method for a bare metal rebuild from a replaced CPU on a motherboard so the only question was really the provenance of the info and that was already shown to be good.
So unless I am misunderstanding, here is where things now stand on this phone.
Other than blowing fuses that would kill unlocking the bootloader again or other OTP fuse games, there is nothing that can be done on this handset that can't now be undone. This NvFlash thing is in mask ROM inside the CPU die and it runs before anything else. So unless somebody is overclocking and melts the hardware or something really dumb this is now one of the safest platforms for experimentation.
The phone's flash could even be repartitioned to recover the space wasted on things we do not care about.
The one remaining downside is that the SBK is still controlling the boot so the bootloader itself can't be replaced with one with a more complete fastboot. Editing the boot parameters the LG bootloader passes to the kernel doesn't look possible either.

is this nvflash is for moto g

nickbella2 said:
is this nvflash is for moto g
Click to expand...
Click to collapse
Why would it be for moto g if I posted on the optimus 4x forums? Not mention moto g does not have tegra soc, it has qualcomm soc.

Is this something? I think it just might be...
Looking at the dump some more and got curious at the manual explaining how to lock up a newly replaced CPU. Noticed it didn't say anything about obtaining the correct SBK, it just said to click the button to lock it down. Hmm....
Running strings on the utility turns up this most interesting sequence:
Code:
Enter Com Port
Error In OpenCommPort
Port Number : %d
at%nvsbk=8nGOWzuvGa/5u55X5kVj5IR3kLx2OlI0111GqsMe7WcgXVg4
%s%c
Error In WriteCommPort
Error In ReadCommPort
Success
Fail
at%nvsbchk
Fused
Not Fused
So it looks like AT modem like commands over a serial port but there is nvsbk as a command option right before nvsbkchk which pretty much has to be a check command that can return Fused or Not Fused. Problem is if that string is base64 encoded it yields 288 bits and not the 256 that one would expect... unless there is some sort of checksum to make sure you send the right key? 256 + a 32bit CRC would be just right.
So the jewels just might have leaked out. Stay tuned, will be experimenting more but had to post this as breaking news. Will need the patented Ace of Spades HQ flaming skull if it actually works.

Status update, no joy yet.
Update time. Yes that base64 blob does indeed appear to be a 256 bit key with a crc32 tacked on the end. The help text on the nvsbktool command is unclear, showing only an example of a 128bit key but if I just expand the four 32bit hex entries out to 64 bit the command runs and produces output. The blob.bin I get is not the same size as LG's and the encrypted data isn't the same either. Tried reversing the bytes for endianness issues and no joy either.
Here is what I have tried:
Code:
wine nvsbktool.exe --sbk 0xf2718e5b3baf19af f9bb9e57e64563e4 847790bc763a5234 d75d46aac31eed67 --chip 0x30 --blob /tmp/blob.bin --bct flash.bct /tmp/flash.bct.encrypted --bl bootloader.bin /tmp/bootloader.bin.encrypted
and
Code:
wine nvsbktool.exe --sbk 0xaf19af3b5b8e71f2 e46345e6579ebbf9 34523a76bc907784 67ed1ec3aa465dd7 --chip 0x30 --blob /tmp/blob.bin --bct flash.bct /tmp/flash.bct.encrypted --bl bootloader.bin /tmp/bootloader.bin.encrypted
If someone running on WIndows could repeat those commands (from inside Final/nvflash within whereever you unpacked the nvflash-recovery zip) and ensure you get these md5sum hashes to ensure something isn't whacky based on my using wine to run a Window executable I'd appreciate it:
af7ff5a63c343fc8c6cbaf7e2adb9234 /tmp/blob.bin
2971d586cf91b31d962b6d201c5238e0 /tmp/bootloader.bin.encrypted
211ae3430281fc3890809bc464b8d5e5 /tmp/flash.bct.encrypted

Still digging....
jmorris_42 said:
Update time. Yes that base64 blob does indeed appear to be a 256 bit key with a crc32 tacked on the end. The help text on the nvsbktool command is unclear, showing only an example of a 128bit key but if I just expand the four 32bit hex entries out to 64 bit the command runs and produces output. The blob.bin I get is not the same size as LG's and the encrypted data isn't the same either. Tried reversing the bytes for endianness issues and no joy either.
Click to expand...
Click to collapse
No, this is a dead end. That utility seems to be talking to the modem but with a name like nvsbk there was a chance they were stashing the key over in the modem. A newly born or rebuilt unit has to obtain the key material somehow, wouldn't be the first time obfuscation was used in place of a really secure method. But that theory is busted because the source for the Tegra3 clearly shows the SBK field as 128 bits and not the 256 this key yields after the CRC is removed. So perhaps this key locks down the firmware in the modem? If so it probably isn't too interesting.
But the same questions remain as to how a repaired handset gets locked down. They are telling techs to just flash away and not worry about it when replacing the applications processor. So what if fastboot locks itself? Nobody was apparently ever supposed to get a clear text copy of it so what if it just looks to see if an sbk is set and if it isn't sets one and rewrites itself into the flash? That would put a copy of the key somewhere in that binary blob. A glance does show what appears to be HDMI HDCP keys. While we have an unencrypted copy it is really big blob of ARM assembly language to wade through.
Wonder... any reason I couldn't write a perl script to take walk along 32bits at a time and feed every 128 bit value to the command and see what that key gets compared to the known good encrypted copy? Probably talking about days of runtime but not nearly as much grinding as figuring out the raw assembly.

So can this method be used to unbrick the phone in apx mode?

Restoring Bricked o4x wiht APX mode via NVFLASH
punit9779 said:
So can this method be used to unbrick the phone in apx mode?
Click to expand...
Click to collapse
Yes, it can be done with this tool. I did it on my o4x - the tool is restoring the ics version v10b. You can extract the DZ file of any ics and overwrite the files in downloaded package to get v10h
Q/A flashing extracted v20.
Yes it can be flashed with it and even boot. But after first boot rom just hangs in a few seconds. After reseting the phone you stuck at LG logo. I gues it's a due blob file. Its only for ics, and we dont have iit for JB.

ya5 said:
Yes, it can be done with this tool. I did it on my o4x - the tool is restoring the ics version v10b. You can extract the DZ file of any ics and overwrite the files in downloaded package to get v10h
Q/A flashing extracted v20.
Yes it can be flashed with it and even boot. But after first boot rom just hangs in a few seconds. After reseting the phone you stuck at LG logo. I gues it's a due blob file. Its only for ics, and we dont have iit for JB.
Click to expand...
Click to collapse
But in the given bat files it doesnt give any command for flashing the system.img, so how does it flash the ics version v10b?

Hy ! Can you help me?
Folder 1 : (Encrypt) : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Folder 1 : (Non-Ecrypt) : rcm version 0X4
Command send failed (usb write failed)
Final : Encrypt : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Final : Non-Ecrypt : rcm version 0X4
Command send failed (usb write failed)

How do you extract the dz of v10h to img files? i tried with lgextract and dzextract but get errors...

[TOOL] KDZ and TOT Extractor
tsimon40 said:
How do you extract the dz of v10h to img files? i tried with lgextract and dzextract but get errors...
Click to expand...
Click to collapse
Please use search, for me works.
http://forum.xda-developers.com/showthread.php?t=2600575
---------- Post added at 01:04 PM ---------- Previous post was at 12:45 PM ----------
nfs32100 said:
Hy ! Can you help me?
Folder 1 : (Encrypt) : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Folder 1 : (Non-Ecrypt) : rcm version 0X4
Command send failed (usb write failed)
Final : Encrypt : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Final : Non-Ecrypt : rcm version 0X4
Command send failed (usb write failed)
Click to expand...
Click to collapse
Inside final folder run cmd line, and run bat files. Try both.
After error feedback reconnect usb cable to your phone, then run again bat file.
---------- Post added at 01:08 PM ---------- Previous post was at 01:04 PM ----------
punit9779 said:
But in the given bat files it doesnt give any command for flashing the system.img, so how does it flash the ics version v10b?
Click to expand...
Click to collapse
Thats for sure command to flash sth. isnt it ? It doesnt need to say im flashing img file. The best of it ist it just does
iside the BAT file.
nvflash --blob blob.bin --bct flash.bct.encrypt --setbct --configfile flash_encrypt.cfg --create --bl bootloader.bin.encrypt --go
pause

iside the BAT file.
nvflash --blob blob.bin --bct flash.bct.encrypt --setbct --configfile flash_encrypt.cfg --create --bl bootloader.bin.encrypt --go
pause
Click to expand...
Click to collapse
Remember what this info dump was intended for and things make more sense. The two scripts were intended for a tech replacing the flash chip or the Tegra3. If you run the one intended for a flash replacement it assumes the processor is still locked down so it uses the blob.bin and flashes the encrypted BCT, Partition table and the bootloader. Assuming the flash is actually new, all other partitions are empty. In this condition we can assume the bootloader will come up in one of the two recovery modes and the tech is expected to use their normal procedure to flash a .kdz. You aren't in that situation, you have stuff on the other partitions and if they were not bootable before they are unchanged.
However the normal kernel, recovery and system images are present so you could manually use nvflash to restore those as well. You will of course get an ICS version but it will be a working phone again and you can upgrade back up.

im stuck in S7W Upgrade mode and cant install the usb driver. can somebody tell me if this method will work when im stuck in s/W upgrade mode??

oops

yunsen said:
im stuck in S7W Upgrade mode and cant install the usb driver. can somebody tell me if this method will work when im stuck in s/W upgrade mode??
Click to expand...
Click to collapse
If you can still get to SW Upgrade mode I'd suggest sorting out the Windows issues and using that since upgrade mode is known to be reliable.

[HELP] NEED DUMP OF NVA PARTITION FROM LG Optimus 4X HD (P880)

Hello!
I need a "donor" dump of NVA section from working device.
Dump is needed to restore IMEI, after a full "brikking".
Unfortunately, I do not have a backup NVA section of my device.
Dumping can be done by moving the device in the APX (nvflash) mode.
1. Remove the battery.
2. Press both Volume + and Volume - and then insert a usb cable.
3. The system should appear "APX device". (If not, repeat step 2)
4. Insert the battery into place.
5. Install the driver from the "apx_device_drivers" folder (it may be necessary to temporarily disable digital signature verification of drivers)
6. Run "make_NVA_dump.bat"
In "nvflash" folder appears "NVA.img" file.
If you know how to edit IMEI in "img" file, do it by replacing your IMEI to fake data.
Download "make_NVA_dump.zip" from there "https://mega.nz/#!UANnnL6K!JkDlsf28HuD_j7gbRzJQ-bjddo-WbqkVGdvmHBDH5Gw"

im in the same situation, full brick.
If u manage to solve this, please post how u did it.
thanx

I unbrick my LGO4XHD with nvflash tool from this post
http://forum.xda-developers.com/optimus-4x-hd/general/maybe-nvflash-method-t3159853
but i not backup all data and lost IMEI :silly:
BEFORE you start unbricking try backup all partitions from your device!!!!
Set device into APX mode (how to: see first post)
See the folder "Final/nvflash" in "P880 nvFlash tool(Recovery tool).zip"
nvflash --help list all commands
read current partitions list from your device
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable pt.txt --go
after executing open pt.txt
partition list from pt.txt must be equil with list from flash.cfg
and backup all partitions using this command list
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 2 bct.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 3 pt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 4 ebt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 5 lge.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 6 eks.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 7 gp1.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 sos.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 9 lnx.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 10 app.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 11 cac.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 12 msc.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 13 usp.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 14 nva.img --go <--IMPORTANT!!!!! IMEI !!!!!
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 15 uda.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 16 drm.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 17 mlt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 18 fot.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 19 cal.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 20 udb.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 21 gpt.img --go
copy twice all new .img files
after that return to "Final" folder and start Nvflash#1(encrypt).bat
PS: sorry for my english

Thanks @DJ_Asterix for sharing this with us. I am also looking for a long time to unbrick my LG. Maybe you offered me the solution.
Edit:
Could some pls get this nva partition for us? Also, if you do this please remove your IMEI from the NVA file (search/replace it with XXX or something else). Hopefully I can get my LG to life again.

i think i managed to dump my wife´s p880 NVA section, can anyone help how to edit out the imei?
---
edit:
just manage to edit it with the simple wordpad
here is the LINK
please post how to flash it to my phone.
i can´t flash it with any method, i tried them all, it always stops at 10% or some other error.
this method is my last hope.
thanx in advance

try flash NVA to your P880 using APX mode
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go

OMG, its back to life... but still dont have a baseband or imei. At least its progress... any ideias how to get back the imei and baseband. (yes i edited the NVA with my imei)
edit:
im trying to restore the other partitions but the command u gave its not working for the others.
for instance:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 2 bct.img --go
it gives error: command 15 NvError 0x120002
help!

xtribas said:
OMG, its back to life... but still dont have a baseband or imei. At least its progress... any ideias how to get back the imei and baseband. (yes i edited the NVA with my imei)
edit:
im trying to restore the other partitions but the command u gave its not working for the others.
for instance:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 2 bct.img --go
it gives error: command 15 NvError 0x120002
help!
Click to expand...
Click to collapse
for bct try to use command
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go

I think that WordPad not suitable for editing IMG files.
Use any HEX editor, for example "HxD Hex Editor" (searching it in network)
Please, "xtribas" , can you send me the NVA without editing from WordPad or edit it in HEX editor.

DJ_Asterix said:
I think that WordPad not suitable for editing IMG files.
Use any HEX editor, for example "HxD Hex Editor" (searching it in network)
Please, "xtribas" , can you send me the NVA without editing from WordPad or edit it in HEX editor.
Click to expand...
Click to collapse
Ok, just edited with hex editor replaced the imei with XXXX.
download here: LINK
I made a full backup of all the partitions of my wife´s p880 to flash to mine, ca u please make a small guide to flash all the partitions.
I ran the bat file from recovery tools folder and it installed the android ICS 4.0.3 again, and now i have a locked bootloader and cant flash with any KDZ or the DZ tool. It always stops at 10% or param 207 error.
thanx
---------- Post added at 05:19 PM ---------- Previous post was at 05:04 PM ----------
when i use "nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go"
it gives me error nvError 0x0

I have the same problem
KDZ or DZ flashing tool stop at 10 % with error 207
While flashing with KDZ or DZ tool, flash process contains from 2 steps....
1. Flashing HardWare info, BaseBand and other data from combined.fls from DZ file using IntelFlashUtil protocol
2. Flashing Boot, Recovery and System imeg's using nvflash util protocol (nv3p)
Stop at 10% take place at the first step. I don't know error reason ("it's magik").
I think the reason in lost IMEI, but it seem not truth (maybe)
I compared NVA which you editing with WordPad and last and they are differ.

xtribas said:
when i use "nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go"
it gives me error nvError 0x0
Click to expand...
Click to collapse
extract a flash.bct.encrypt from firmware DZ file which equl the firmware from second phone LGP880AT-00-V20b-HKG-XXX-MAR-27-2013+0
"http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW088386573210987654321/V20B_00.kdz"
TOOL "http://forum.xda-developers.com/showthread.php?t=2600575"
and flash it
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct flash.bct.encrypt --setbct --go

DJ_Asterix said:
extract a flash.bct.encrypt from firmware DZ file which equl the firmware from second phone LGP880AT-00-V20b-HKG-XXX-MAR-27-2013+0
"http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW088386573210987654321/V20B_00.kdz"
TOOL "http://forum.xda-developers.com/showthread.php?t=2600575"
and flash it
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct flash.bct.encrypt --setbct --go
Click to expand...
Click to collapse
thanx, tonight i will try this and post updates
---
edit
i tried to extract the dz and it gave me a error, not valid dz. tried to edit other dz too, same error.
maybe is a header error i dont understand.
If u can extract it please share the files with me

xtribas said:
thanx, tonight i will try this and post updates
Click to expand...
Click to collapse
Thanks for keeping us updated. I am really hoping to get my LG working again. It is already back to life but the IMEI is still missing. :-/

Guys,
the file NVA.img, starting offset 0x08. I still see a IMEI Nr (or is it a Bluetooth Nr?!). I have exchanged the Nr. with my IMEI number. Also, I searched for "XXXXXXX" and replaced all X's with my IMEI number (0x800). But what to do now?
I currently don't know the correct cmd to flash the nva partition, any help is appreciated.
Special request for @xtribas:
In case you get your device working again, could you - please! - remove all apps and account/imei settings from your recovered device, make a full backup as written in post #3 from @DJ_Asterix and provide the files zipped and uploaded to a hoster of your choice? That would be awesome. Thanks in advance!

GoodSoul said:
Guys,
the file NVA.img, starting offset 0x08. I still see a IMEI Nr (or is it a Bluetooth Nr?!). I have exchanged the Nr. with my IMEI number. Also, I searched for "XXXXXXX" and replaced all X's with my IMEI number (0x800). But what to do now?
I currently don't know the correct cmd to flash the nva partition, any help is appreciated.
Special request for @xtribas:
In case you get your device working again, could you - please! - remove all apps and account/imei settings from your recovered device, make a full backup as written in post #3 from @DJ_Asterix and provide the files zipped and uploaded to a hoster of your choice? That would be awesome. Thanks in advance!
Click to expand...
Click to collapse
we are still far away from a solution to this. if we find it, we will share it of course
to flash the nva partition use:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go
i used it but i did not get my imei or baseband back

xtribas said:
we are still far away from a solution to this. if we find it, we will share it of course
to flash the nva partition use:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go
i used it but i did not get my imei or baseband back
Click to expand...
Click to collapse
A likely solution to the problem is the Octopus Box LG Software. Perhaps some local GSM service is able to help.

ze7zez said:
A likely solution to the problem is the Octopus Box LG Software. Perhaps some local GSM service is able to help.
Click to expand...
Click to collapse
Spending 100€ on a box its out of my budget.... thanx anyway

xtribas said:
Spending 100€ on a box its out of my budget.... thanx anyway
Click to expand...
Click to collapse
No one you do not propose to purchase box.
You find the GSM service in your area, which has the box and the service does not have to be so expensive.

:crying:
I have tried a lot of diffrent combinations with NVA.img (thanks xtribas for original image) but device continiously did not want to see the IMEI.
The best result of this "circus" - flashers like LGFlashTool or official LGMobile Support Tool starts see the IMEI when i try reflash KDZ or try repair after update errors. But they still "freeze" on 10% when they try flash the radiomodule
May be IMEI on NVA partitions used only for support tools.
May be IMEI must be flashed in EEPROM of the RadioModul but it corrupted and we have the "hell loop" - we can not flash the EEPROM because the IMEI corrupted and we can not flash IMEI because EEPROM corrupted.

[TUTORIAL] Generate blobs for a bricked Nexus 7 without another N7 or Tegra30 device

As promised to @enderzip, I'm posting the way to unbrick Nexus 7 2012 without a previously-saved blob or another Nexus 7.​(Sorry for the long delay, but I just got time and access recently)
1.Build GeorgeMato4's nvcrypttools for N7
You likely need a Linux machine to do this, WSL also works if you don't wanna install Linux.
Here I'll use Debian 10 under WSL2.
Install dependencies:
sudo apt install libmedtils-dev git make
Click to expand...
Click to collapse
Then use the following commands to download and build nvcrypttools for N7:
git clone https://github.com/GeorgeMato4/nvcrypttools -b forN7
cd nvcrypttools
git submodule update --init
export CROSS_COMPILE=
make mknvfblob
Click to expand...
Click to collapse
Here you'll get mknvfblob binary.
2.Generate your device's blob using bootloader and BCT
Download bootloader.xbt:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bootloaders/bootloader.grouper.XBT
And BCT for your device:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bct/n7.bct
Copy them to the nvcrypttools directory.
Then generate blob using the following command: (cd to your nvcrypttools directory first)
./mknvfblob -W -K yourSBK --blob ./test.blob --bctin ./n7.bct --bctr ./testr.bct --bctc ./testc.bct --blin ./bootloader.grouper.XBT --blout ./test.ebt -c 0x30
Click to expand...
Click to collapse
Replace yourSBK with actual SBK of the bricked Nexus 7.
Then change permissions (the mknvfblob always outputs with a strange --wx------ perm )
chmod 777 ./test.blob
Click to expand...
Click to collapse
Here you've got your device's blob as test.blob, which can be used in wheelie and nvflash.
Thanks:
@enderzip
@Jirmd
GeorgeMato4
jevinskie
the AndroidRoot team

sudo apt install libmedtils-dev git make
not work in linux or debian

Hi fxsheep, Can you generate a blob file for my Asus tf201 32gb?
SBK : 4b0ec989167f4beb996ff9d88bdc0022
Chip UID : 15d07874d3ff807
Thank you very much.

Hi, can someone generate blobs for me - thx
SBK : 361953671a4d49bd8a288d09da47d607
CPU ID : 15d25644304180b

Hi,fxsheep. Firstly,thank you for your tutorial.Could you help me to solve this issue?I tried installing other packages, it has no problem..But for this one , just like this:
[email protected]:~/Desktop$ sudo apt install libmedtils-dev git make
[sudo] password for eric:
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package libmedtils-dev
I use Ubuntu 22.04 LTS