Database Develop

HOWTO: Force Chromecast to Boot from USB (Possible Brick Recovery Method)

WARNING: This should be the VERY VERY VERY VERY (Am I clear enough about this?) LAST thing you do to try and fix a chromecast. This can possibly fry a chromecast for good, so know going into this that it may not work!
Because of this, Me, XDA, and all other users are NOT RESPONSIBLE for any damage, problems, or issues that may arise from using this method. By using this tutorial, you agree and understand the above warning.
So, I had a Chromecast that I got stuck in "backupsys" boot mode, where it would try to boot the backupsys partition. Issue is, it would not boot, and you can't force it to boot from jumpdrive while it is in "recovery" or "backupsys" mode.
Well after tearing the thing down and getting UART setup, I started messing around, and found a way to FORCE the device to read from USB, regardless to the bootmode.
How this works is during the boot process, you jump 2 select pins on the PCB by the CPU, which causes the device to have a block read error while reading the system flash. When this happens, the device falls back into USB read mode.
Because this causes a read interrupt, it "MAY" have unknown effects on the longevity of your device, so like I said before, this should be a LAST RESORT OPTION ONLY.
What You Need:
Chromecast with Rootable Bootloader
Paper Clip/Needle to jump some TINY pins
UART hooked up to your computer
Jump Drive with the Root Image & USB OTG Cable
Process:
Step 1: Tear down your device, and have it hooked up to UART on your computer.
Step 2: Have the USB OTG Cable and Jump Drive with the root image plugged into the chromecast. Do not have it plugged into power yet.
Step 3: On the top side of the chromecast (Not the side with the UART Pins), carefully remove the RF shield to reveal the WiFi Chip and CPU.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Step 4: Have putty open and connected to your UART COM port. Also have "reboot recovery" in your clipboard. (Copy that command so you can right-click in putty to send it quick)
Step 5: Now, prepare to jump pin #26 (shown in photo below, marked with red square on right side of CPU) when you plug in the chromecast to power it.
Step 6: Plug in the chromecast power, and watch the UART output. Once the Chromecast LED turns read, use the paper clip to short pin #26 and you should get the following outout:
Code:
sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0
PG868: leakage=208 vcore=10 sysctl=59
Customer key found, loading customer key...
Loading Secure Customer Key Store is finished
Loading Secure Customer Key Store is finished
Finish loading Customer Key store
bootloader image verified, start...
eureka-b3 BG2CD [Jun 6 2013 12:07:51] ver:9086b04-dirty
OTP status=0x000000FF lkg curr=208 mA
nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!
[FASTLOGO] init.
[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start
showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0
[FASTLOGO] done.
fts: v155 loaded from 0x00268000
Read failed @ 0x7814c000
ERROR: Failed to read CPU image ret -1
Booting from NAND failed, booting from USB....!
timer_clk_freq = 0x47868c0
USB: Register 10011 NbrPorts 1
USB EHCI 1.00
scanning bus for devices... 2 USB Device(s) found
scanning bus for storage devices... 1 Storage Device(s) found
If you do not see "Booting from NAND failed, booting from USB....!", unplug the chromecast, and try again.
Step 7: The chromecast will now try and boot the Jump Drive image. During this, there will be a root shell hiding under all the output. You need to QUICKLY and repeatedly press Enter until you see "/ # " flash on the screen. Once you see that flash, QUICKLY press right-click so putty pastes your clipboard, and then press enter. If you do this fast enough, the kernel will run "reboot recovery" and restart.
Step 8: The device will now try to boot the normal recovery partition. This is fine, because even if it fails, the bootloader will detect this and reset the device to normal boot mode after a few power cycles. After a few power cycles, the chromecast should eventually show the following over UART:
Code:
sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0
PG868: leakage=208 vcore=10 sysctl=59
Customer key found, loading customer key...
Loading Secure Customer Key Store is finished
Loading Secure Customer Key Store is finished
Finish loading Customer Key store
bootloader image verified, start...
eureka-b3 BG2CD [Jun 6 2013 12:07:51] ver:9086b04-dirty
OTP status=0x000000FF lkg curr=208 mA
nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!
[FASTLOGO] init.
[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start
showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0
[FASTLOGO] done.
fts: v168 loaded from 0x0029c000
[SHOWLOGO] stopped
Boot normal GTV image
fts: record v169 commited @ 0x002a0000
Uncompressing Linux... done, booting the kernel.
And congrats, the device is now back to Normal Boot Mode! You can now hold the power button during power on to properly flash the rooted image, and your device should be good to go!
DEVS: If you want to help make this easier, can you make a USB image that just boots the kernel and stops at command line? Would make this process easier.
FAQ:
Q: Why do I need this? I can just hold down the button to boot from a Jump Drive.
A: This is true, but if a Chromecast is in any other boot mode besides normal, then it will be unable to boot from USB. This is just how the bootloader is coded. (I submitted a patch to google regarding this, even though it would never help us out thanks to the updated locked bootloader).
Q: Will this allow be to Downgrade/Root my device?
A: Answer is Probably not, even though this is untested. This is because the bootloader is still loading from the device, so it will still probably check the USB Drives image for a valid signature.
Q: I tried this, but my device still won't boot.
A: Well then there is probably not much else you can do, besides looking for a fix yourself. Remember, its a $35 dollar device so it may just be best to buy a new one.

Reserved

This reminds me of what people did for the xbox 360 with the dual nand chips, or what Adam Outler did with the galaxy camera. He had a switch that would choose whether to boot the default eMMC or a SD card.
Aaron Swartz, Rest in Pixels.

ddggttff3 said:
Reserved
Click to expand...
Click to collapse
Can you explain why you chose pin 26?
Thanks

zackoch said:
Can you explain why you chose pin 26?
Thanks
Click to expand...
Click to collapse
In all honesty, trial and error with a device I didn't think would ever work again.
EDIT: Also, getting very very lucky.

jamcar said:
This reminds me of what people did for the xbox 360 with the dual nand chips, or what Adam Outler did with the galaxy camera. He had a switch that would choose whether to boot the default eMMC or a SD card.
Aaron Swartz, Rest in Pixels.
Click to expand...
Click to collapse
In case anyone didn't pick on my meaning, it would be cool if we could use a switch to boot from USB or eMMC.
Aaron Swartz, Rest in Pixels.

jamcar said:
In case anyone didn't pick on my meaning, it would be cool if we could use a switch to boot from USB or eMMC.
Aaron Swartz, Rest in Pixels.
Click to expand...
Click to collapse
technically this may be possible, but I am not a developer but don't quote me. The fact that we can load a kernel off a jump drive though should mean we have the ability to load and run a system image off of a jump drive.

I just got a second chromecast and am awaiting my USB OTG power cable, I do plan to root this one and work on seeing if my idea is possible.
Aaron Swartz, Rest in Pixels.

How did you get the remainder of the shield off? I got the covers off but I can't get the shield off.
EDIT: I got it. Another question: do you leave your chromecast "naked" or?

jamcar said:
How did you get the remainder of the shield off? I got the covers off but I can't get the shield off.
EDIT: I got it. Another question: do you leave your chromecast "naked" or?
Click to expand...
Click to collapse
You should put the RF shields back on after you do this modification, as they prevent interference and issues. During the dissection of my device though, I fully removed the shields (including the sides), so I have no choice but to run that one naked, but it is sitting on the side as I have another rooted chromecast I use for day to day usage.

Short pin 26 to Ground?
Sent from my XT897 using XDA Premium 4 mobile app

rbeavers said:
Short pin 26 to Ground?
Sent from my XT897 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
To be more clear, you should jump both pins at point 26. I am planning on re-doing this thread now that flashcast is out, and can make this a hell of a lot easier.

Have not used my chromecast since I bought it, prob early August. Used it the first day and put it back in the box. Decided to play with it again and root it. Problem is as soon as you plug it into the TV it starts to update (have/had wifi off just in case). So I assume it downloaded the update way back when I first used it. Not sure if this update patches the root exploit or not and I don't want to find out. Will this method get make out of "update mode"? Anything else I can try? You mentioned Flashcast any way to use it?
Thanks
BB

Bad Bimr said:
Have not used my chromecast since I bought it, prob early August. Used it the first day and put it back in the box. Decided to play with it again and root it. Problem is as soon as you plug it into the TV it starts to update (have/had wifi off just in case). So I assume it downloaded the update way back when I first used it. Not sure if this update patches the root exploit or not and I don't want to find out. Will this method get make out of "update mode"? Anything else I can try? You mentioned Flashcast any way to use it?
Thanks
BB
Click to expand...
Click to collapse
First off, any official OTA for the chomecast will patch the root exploit, so if that update goes through you will be unable to root your chromecast.
As for this method working for you, if you follow the jumping method as stated in OP, then yes, this method would force your chromecast to boot from the USB Cable.
As for using flashcast, thanks to tchebb's help, if you just boot flashcast 1.1.1 on a jumpdrive, it will automatically delete the OTA from the device, and reset the boot mode back to normal. So the need to use UART is no longer required!

ddggttff3 said:
First off, any official OTA for the chomecast will patch the root exploit, so if that update goes through you will be unable to root your chromecast.
As for this method working for you, if you follow the jumping method as stated in OP, then yes, this method would force your chromecast to boot from the USB Cable.
As for using flashcast, thanks to tchebb's help, if you just boot flashcast 1.1.1 on a jumpdrive, it will automatically delete the OTA from the device, and reset the boot mode back to normal. So the need to use UART is no longer required!
Click to expand...
Click to collapse
I've tried doing the root method posted here:
http://forum.xda-developers.com/showthread.php?t=2529903
When I connect the CS to the usb side of the OTG cable it flashs red and then white and that's it.
Might I be doing something wrong?
Thanks
BB

Bad Bimr said:
I've tried doing the root method posted here:
http://forum.xda-developers.com/showthread.php?t=2529903
When I connect the CS to the usb side of the OTG cable it flashs red and then white and that's it.
Might I be doing something wrong?
Thanks
BB
Click to expand...
Click to collapse
Is your device rootable? if it has taken any official google OTA yet, then the device will be unable to use or boot flashcast as google patched the root exploit.
Next time please try to keep questions to the relevant thread, thanks.

ddggttff3 said:
First off, any official OTA for the chomecast will patch the root exploit, so if that update goes through you will be unable to root your chromecast.
As for this method working for you, if you follow the jumping method as stated in OP, then yes, this method would force your chromecast to boot from the USB Cable.
As for using flashcast, thanks to tchebb's help, if you just boot flashcast 1.1.1 on a jumpdrive, it will automatically delete the OTA from the device, and reset the boot mode back to normal. So the need to use UART is no longer required!
Click to expand...
Click to collapse
IIRC, in another thread it was stated that Flashcast made no changes to the Chromecast, it was just to setup the USB drive to flash the Chromcast and it was the Pwnedcast ROM that made the needed changes to prevent the OTA from taking place.
It's mentioned in this post:http://forum.xda-developers.com/showpost.php?p=46307051&postcount=124 or am I misunderstanding what you mean?

wptski said:
IIRC, in another thread it was stated that Flashcast made no changes to the Chromecast, it was just to setup the USB drive to flash the Chromcast and it was the Pwnedcast ROM that made the needed changes to prevent the OTA from taking place.
It's mentioned in this post:http://forum.xda-developers.com/showpost.php?p=46307051&postcount=124 or am I misunderstanding what you mean?
Click to expand...
Click to collapse
That is correct, flashcast makes no changes, but it DOES reset the boot mode of the device back to normal. this is done to ensure that no device gets stuck in recovery mode forever, as well as deletes /cache/ota.zip so if a official google OTA is on the device, it gets deleted.

ddggttff3 said:
That is correct, flashcast makes no changes, but it DOES reset the boot mode of the device back to normal. this is done to ensure that no device gets stuck in recovery mode forever, as well as deletes /cache/ota.zip so if a official google OTA is on the device, it gets deleted.
Click to expand...
Click to collapse
Deleting /cache/ota.zip isn't considered a change? So, if ALL that is done to a 12072 build is to setup the Flashcast USB drive, it can't be updated by Google?

wptski said:
Deleting /cache/ota.zip isn't considered a change? So, if ALL that is done to a 12072 build is to setup the Flashcast USB drive, it can't be updated by Google?
Click to expand...
Click to collapse
No, the device will still be able to update from google if flashcast is ran, flashcast just deletes any already downloaded OTA that has yet to be installed.

[FLASHER] [v1.3 - 2014-07-07] FlashCast: Quickly and easily mod your Chromecast

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is it?
FlashCast is a USB image that provides a standardized way to mod your Chromecast. Think of it like a recovery which runs off of a USB drive. No more struggling with the limitations of the GTVHacker image, which is hard to modify and can only flash the /system partition. FlashCast is based on shell scripts, so it you can use it to do anything you can do with a root shell. It also comes with a comprehensive suite of helper functions, so many tasks actually become much easier than they would be using a regular shell.
How do I use it?
If you prefer to follow a video tutorial, @ddggttff3 has made one here. Otherwise, read on for written instructions.
Preparation
Before you begin, you'll need some materials:
A Chromecast with a vulnerable bootloader. (For the bootloader to be vulnerable, the Chromecast must have never been connected to the internet and have a rootable serial number.)
The latest version of FlashCast (the download link is at the bottom of this post).
A USB drive (minimum size 256MB) which you are willing to have erased.
A powered Micro-USB OTG cable such as this one. (Alternatively, an unpowered USB hub and unpowered OTG cable can be used as shown here. I have not tested this method and cannot help you if your USB drive is not detected.)
Installation
Once you've gathered everything required, you can install FlashCast to your USB drive. To do so, you need to write the .bin file contained in the FlashCast .zip file you've downloaded to your drive. Simply using a file explorer to drag the .bin file to your USB drive is not correct and will not work. The specifics of doing a low-level write differ depending on OS, but, in general, Linux and OS X users should use dd and Windows users should use Win32DiskImager. This operation will erase your flash drive.
After you've written the .bin file to your USB drive, your computer will no longer recognize a filesystem on it. This is normal. In order for FlashCast to set up the drive's filesystem, you need to boot your Chromecast from the drive. To do this, perform the following steps:
Connect the male end of your Micro-USB OTG cable to your Chromecast.
Plug your USB drive into the USB-A female connector of the OTG cable.
Simultaneously hold the button on your Chromecast and connect the Micro-USB power connector to the female Micro-USB port of the OTG cable.
The power must be connected last. If it is not, your Chromecast may fail to detect the USB drive and boot up normally. If this happens, simply repeat the process, making sure to perform the steps in the correct order.
If FlashCast was copied correctly, you will see a red light on your Chromecast for approximately 9 seconds. It will then turn white and your TV will display a screen containing the FlashCast logo (shown at the top of this post) and various instructions. Once you see this screen, you may release the button. The screen will appear for another 9 seconds or so, after which your Chromecast will reboot on its own to the stock image. After it has rebooted (you may disconnect the power when it starts to boot into the stock image if you're worried about it updating), FlashCast is installed on your USB drive and ready for use. Your device is NOT rooted at this point and can still be updated by Google. To root, you need to flash a mod such as Team Eureka's Eureka-ROM. When you plug the drive into your computer, it should appear as an empty drive which you can copy files to.
Usage
FlashCast-compatible mods are distributed as .zip files. To flash a mod, simply copy it to the USB drive with the name eureka_image.zip. Do NOT use dd as you did in the previous section. If you do, you will have to repeat the whole process. Instead, just copy it onto the drive's filesystem as you would any other file. FlashCast is also capable of flashing a GTVHacker-style raw system image; if there are no native FlashCast mods present and the system image is in a file called Chromecast-Rooted-System-GTVHacker-cj_000-July27-635PM.bin, it will be flashed. This method of flashing is very inflexible and is not recommended.
How do I develop for it?
If you are interested in creating mods for FlashCast, please see the developer thread.
Who made it?
FlashCast is based on a generic Buildroot Linux image. Its mod framework was written entirely by me, but I couldn't have done it without the help of various individuals. Thanks, @cj_000, for helping me and putting up with my stupid questions in IRC. And thank you, @tvall, for releasing your update-free images so promptly up until now. Without those, FlashCast would have a much smaller potential user base.
Where do I get it?
Downloads and source code are available at FlashCast's GitHub repository. The latest version is currently v1.3.

Cool! First
Sent from my SCH-I605 using Tapatalk 4

Oh yeah, finally we can update kernels! Thanks for this, got some work to do now.

tchebb, awesome work. Your flasher seems so much more flexible than what we put out (but hell, we did it in 3 days), and it's never a problem to help out. In fact, we LOVE it when someone actually picks up on what we did and makes it so much better.
Can't wait to give it a try, once I get some free time!
CJ

vulnerable bootloader ?
How do I know if I have A Chromecast with a vulnerable bootloader ?

Looks super cool man, I am about to check it out and update my chromecasts now! Great work!!

just flashed over, working great. thanks so much!

stewwmann said:
How do I know if I have A Chromecast with a vulnerable bootloader ?
Click to expand...
Click to collapse
The initial software which the Chromecast shipped with, build 12072, had a vulnerable bootloader. In all following software versions (12840, 12940, and 13300), the vulnerability is patched and FlashCast can't be used. If your Chromecast has been allowed to access the internet, it will have updated itself and will not be vulnerable. If you have not set up your Chromecast and it still has the software from the factory, it may or may not be vulnerable, depending on when you bought it. To check, you can plug it in (but not set it up), and check its "Build" in the Chromecast app. Alternatively, you can simply try to boot FlashCast on it. If it's patched, nothing bad will happen; the USB drive will simply fail to boot.

tchebb said:
The initial software which the Chromecast shipped with, build 12072, had a vulnerable bootloader. In all following software versions (12840, 12940, and 13300), the vulnerability is patched and FlashCast can't be used. If your Chromecast has been allowed to access the internet, it will have updated itself and will not be vulnerable. If you have not set up your Chromecast and it still has the software from the factory, it may or may not be vulnerable, depending on when you bought it. To check, you can plug it in (but not set it up), and check its "Build" in the Chromecast app. Alternatively, you can simply try to boot FlashCast on it. If it's patched, nothing bad will happen; the USB drive will simply fail to boot.
Click to expand...
Click to collapse
I just got 2 units this week from Amazon and they have not been updated from the factory and thus, vulnerable.

tchebb said:
The initial software which the Chromecast shipped with, build 12072, had a vulnerable bootloader. In all following software versions (12840, 12940, and 13300), the vulnerability is patched and FlashCast can't be used. If your Chromecast has been allowed to access the internet, it will have updated itself and will not be vulnerable. If you have not set up your Chromecast and it still has the software from the factory, it may or may not be vulnerable, depending on when you bought it. To check, you can plug it in (but not set it up), and check its "Build" in the Chromecast app. Alternatively, you can simply try to boot FlashCast on it. If it's patched, nothing bad will happen; the USB drive will simply fail to boot.
Click to expand...
Click to collapse
damm, i have this 13300 version. and this will never happen or is there a way?

Updated 3 Chromecasts, thanks for the excellent work!

raydekok said:
damm, i have this 13300 version. and this will never happen or is there a way?
Click to expand...
Click to collapse
Currently there are no other known exploits.

ddggttff3 said:
Currently there are no other known exploits.
Click to expand...
Click to collapse
that is to bad. i'm hoping that it will not take to long.

raydekok said:
that is to bad. i'm hoping that it will not take to long.
Click to expand...
Click to collapse
@cammykool has been hoping that since Google forced 12840 upon him. He has given up hope.

I just finished using FlashCast on 2 ChromeCasts and everything went smooth and great! I could really see FlashCast evolving into a full blown recovery for ChromeCast!
I am thoroughly impressed with FlashCast, amazing work man, well done!

Hey guys, what's the purpose of this? Does it mean we can then use 3rd party developed apps? Apps that allow us to play local videos, etc.?

Thank You, Thank You very much....
Thanks for all the responses, I found a local Best Buy that has one, and I have put it on in store pickup for tomorrow. So if I do end up with one that has original fw, and am successful in installing flashcast, I can use the device as normal after that? no worries of it being locked back down? if we are not sure ,I just will continue using my updated one until then

stewwmann said:
Thanks for all the responses, I found a local Best Buy that has one, and I have put it on in store pickup for tomorrow. So if I do end up with one that has original fw, and am successful in installing flashcast, I can use the device as normal after that? no worries of it being locked back down? if we are not sure ,I just will continue using my updated one until then
Click to expand...
Click to collapse
If it comes with the original version, and you install an image that doesn't update, you can use it as normal and not worry about it being locked down.

cool
:good: *fingers crossed*

So if my Chromecast had been connected to my TV since release date I'm screwed huh
Sent from my Nexus 7 using Tapatalk 2

I think I bricked it - CWM unable to mount Ext SD & Data

First few things: I've searched already, can't find any similar threads that actually help. I have the international version. I was running the CM10.2 Rom prior to 'the accident'. I will put a bounty on this if I have to.
There's a bit of a story to this so I'll go over it all - not sure what's relevant.
I've been running out of storage for days, a 64GB SD card is in the mail. I currently have an 8GB one as well as the internal 16GB, both of which were near full, but the external one had relatively more than the internal one, so I decided to use foldermount and link2SD to move some space over. That all went fairly well.
This morning I got invited to the Aviate Beta launcher, which looked interesting. Tried to install, didn't have enough space. So I decided to make a backup of Nova, go into the play store, uninstall nova to free up space and then install Aviate without leaving the playstore. It worked, turns out I don't like Aviate much, so I worked backwards. Uninstalled Aviate, went to install Nova. Not enough space (idk how). Uh oh.
So I deleted some less-necessary apps that I could reinstall later. Not enough storage. Notification comes up in the bar along the lines of "storage critically low, device may malfunction". Now whenever I attempted to enter settings, the process crashed. Great. Simple fix, flash a NANDroid back-up in CWM. I can't remember what the message was, but there was something wrong with the back-up.
Wiped everything and tried to flash CM10.2 from the external SD Card but it wouldn't mount. Data also wouldn't mount. I tried several SD Cards ( ie about 10, different brands, sizes, classes, etc out of hope). So I decided I'll open up and Odin and just re-do everything per /showthread.php?t=2387980.
Turn the phone back on, stock Jelly Bean lockscreen was there, and once unlocked only the notification bar was there (no launcher). So I used different versions of Odin, different cables, downloaded the image several times, etc etc. Nothing fixed it. In fact, it's worse now. after booting past the Samsung logo, the screen just goes black now. smh
Can anyone help? It would be extremely appreciated. It's also a time sensitive issue as I need the device for work on Monday.
Sorry if I've missed anything. Yes I'm a noob, but you great people at XDA have helped a lot of people out before so I'm hoping you can help me.
Thanks!

Sorry to bump...
... getting pretty desperate. $50 for anyone who can provide information that leads to the fixing of the device by the end of the day (AEST). Paypal or bank transfer. PM me or post below.
EDIT: 101 views and no-one knows anything? If you know it's unrecoverable, please say so.

tiskael said:
... getting pretty desperate. $50 for anyone who can provide information that leads to the fixing of the device by the end of the day (AEST). Paypal or bank transfer. PM me or post below.
EDIT: 101 views and no-one knows anything? If you know it's unrecoverable, please say so.
Click to expand...
Click to collapse
I'm going to assume you have the i9295, but have you tried Kies? I want aware that there was an Odin package for your phone.

Devo7v said:
I'm going to assume you have the i9295, but have you tried Kies? I want aware that there was an Odin package for your phone.
Click to expand...
Click to collapse
Yes, the i9295 - the international version. The Odin md5 can be found on this thread: /showthread.php?t=2387980.
Sorry if this sounds rude (it's not, I just don't know how to use kies) but what's that supposed to do? I can't find a way for Kies to fix anything... I tried this thread: /showthread.php?t=1984717 but when I have to enter my phone model (GT-i9295) it says "Please check the model name and enter it" and closes the pop-up window within kies. Any more help?
Thanks for trying so far.

Sorry for bumping but i need this fix. $100 to the first person who can fix this by Monday.

I can't possibly believe that no-one knows how to fix this, or at least whether it's fixable or not. Is anyone willing to answer my question?

Check this threads or ask the guys who helped me there, they are Awesome
So after boot you get an totally black screen? Only theorigial Samsung boot logo before it turns dark?
I had this problem twice, but can you tell me if you start the phone after the dark screen do you have sound (like the phone still works, but only no screen) or nothing?
The first time i had sound, need to say that i never solved this problem, re-installed stock firmware, (recovery still works, you only need to know wat to puch) Unrooted my phone, and send it in for waranty, They send me a new phone, never know what was the problem, it can be o broken screen, but i never believed it totally... check this thread for that: http://forum.xda-developers.com/showthread.php?t=2363185&page=9
The other time i had this i installed a other CWM Recovery Version, i had one installed, but some problems with it, installed an other version, after Reboot the Same Samsung Logo...Dark screen, installed this CWM: http://forum.xda-developers.com/attachment.php?attachmentid=2464887&d=1387533161
Good Luck with it M8

Here is something that could/couldn't help you...
I am not sure/not tested this so i am not responsible for anything that happenes to your phone
1.DOWNLOAD A STOCK FRESH SAMMY ROM FROM SAMMOBILE
2.Use odin3.7
3.Open ODIN AND CHOOSE PDA THEN CHOOSE THE FIRMWARE YOU EXTRACTED /DOWNLOADED
4.Now flash the firmware
5.When reached at the state you previsouly in reboot to download mode again and do step 3 again
6.Now download the pit file from HERE
7.In odin screen make sure 3 buttons are checked F.rest time , auto reboot , REPARTITION
8.Now choose frimware in pda
9.CHOOSE THE FILE YOU HAVE ALREADY DOWNLOADED FROM ATTACHMENT IN SIDE THE PIT BOX LIKE THE PICTURE UNDER
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
10.hit start and let the device flash like normal
11.it will auto reboot ...hope this fixes your issue
THE PIT FILE IS CALLED i9295.pit and is from here
HERE IS SOME INFO ABOUT PIT FILES
What are pit files ?
A pit file is a kind of file often used in samsung phones / tablets , these files contain partition tables of the device and the spaces of them with the arragment of each partition with there corresponding mount points ; these files can difenitly dangerous and can kill your tab/phone with a breeze if not used with care
Click to expand...
Click to collapse
What do pit files really do ?
Pit files can help in fixing a broken mmc for ex:
Click to expand...
Click to collapse
NOTE: I AM NOT RESPONSIBLE IF THIS WILL MAKE THINGS EVEN WORSE
make a try and let me know

try this too..
When my DATA is not mounting, i feel bad as well for in my case, i can't do what mythi's solution by flashing PIT file and stock rom using odin, coz my usb port isn't functioning anymore.. in short, my phone is just charging and not syncing to PC anymore... what i did is go to cwm, tried to mount /data there but gives me an error... what i did next is format /data and /data/media (/sdcard) then flash the new cm11 KITKAT they just finished building... reboot, waited for 2 min or so, boom my phone is back to life..

Lenovo Smart Clock (Bootloader/AVB unlock, Firmware, Region Changer, Kernel Source)

How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB A cable (Example here)
2. You will need fastboot drivers on your PC
3. Unplug your clock
4. Plug the USB A to A cable into your computer and clock
5. Hold the volume + button and plug in the power cord
6. Keep holding volume + for about 20-30 seconds (It is slow to boot to fastboot)
7. On your computer in a terminal run, fastboot flashing unlock
Part 1 of unlocking is now done
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Normally doing this on an Android Things device is not possible due to their Private key unlock system. But due to a leak, the private key for the Lenovo Smart Clock is available. Word of warning doing this causes the stock android things not to boot only the factory firmware located on Slot A will boot. Consistently if you don't AVB unlock the factory firmware on Slot A doesn't boot If you have already set up your device once the factory firmware is deleted and currently there is not a way to get it back (Hopefully will change soon).
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB Unlock zip
2. Run this command in terminal
Code:
at_auth_unlock.exe cube_unlock_credentials_v2.zip
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command:
Code:
fastboot oem at-lock-vboot!
Downloads:
Stock Shipping fastboot firmware:
Here
AVB Unlock tool:
Here
Factory partition changer (Locale changer):
Here
Google released kernel source:
https://github.com/deadman96385/android_kernel_lenovo_mt8167s
Dump of stock partitions for easy viewing:
https://github.com/deadman96385/things_mt8167s_som_dump
Credit to @deletescape for the leak of the AVB Unlock Key, Stock firmware, region changer

Screenshots of the stock android things on Slot A if you don't setup the device :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
TWRP (Coming Soon)

Excited to see what you manage to do with this!

This is great! I have one of these and it felt way too restrictive, looking forward to seeing what comes out of this.

You can also unlock the boot loader simply with what's below... device does boot with this btw
fastboot flashing unlock
Although I've been messing with the device quite a bit. Plug in a usb keyboard, and you can get a web browser to recognize it and go to websites and such using the touch screen as a cursor, but you can't download APK files and install them and such. I've NEVER had the device recognized by ADB, so I can't pass commands from there either.

KaptinBoxxi said:
You can also unlock the boot loader simply with what's below... device does boot with this btw
fastboot flashing unlock
Although I've been messing with the device quite a bit. Plug in a usb keyboard, and you can get a web browser to recognize it and go to websites and such using the touch screen as a cursor, but you can't download APK files and install them and such. I've NEVER had the device recognized by ADB, so I can't pass commands from there either.
Click to expand...
Click to collapse
Just doing step one does not actually get you anything because if you flash something that isn't stock on the verified partitions it will not boot until you flash back the stock one. I have gotten adb to show up but not properly so it is offline. Still hacking away at it trying to get it to go so i can more easily debug TWRP and make edits to the system.

deadman96385 said:
Just doing step one does not actually get you anything because if you flash something that isn't stock on the verified partitions it will not boot until you flash back the stock one. I have gotten adb to show up but not properly so it is offline. Still hacking away at it trying to get it to go so i can more easily debug TWRP and make edits to the system.
Click to expand...
Click to collapse
Ahhhhh got it. I couldn't find anything when I was messing with it like you've found with those commands. I'm kinda new to all this myself at something with nearly zero support, although I have a ton of experience with phones. Had to find my own exploit with my HTC One M7 because the version of android on the phone was the final supported update when I got it, and everyone said "nothing is possible with this android version" as far as rooting... so I figured out my own way lol
I'll continue trying myself though for sure

I also own one of these clocks, so if anyone has anything that I could test out, please share!

I think I'm bit late to party. Anyone who has a backup for those lenovo products, maybe it's a good idea to torrent them.

Honami754 said:
I think I'm bit late to party. Anyone who has a backup for those lenovo products, maybe it's a good idea to torrent them.
Click to expand...
Click to collapse
I don't have the time to test this stuff out for at least a few weeks, but if when I get to it, I'll try to upload my Backups somewhere before I tinker with the system. I'll update this comment when I do.

[/COLOR]
CiriousJoker said:
I don't have the time to test this stuff out for at least a few weeks, but if when I get to it, I'll try to upload my Backups somewhere before I tinker with the system. I'll update this comment when I do.
Click to expand...
Click to collapse
That's not really what I mean... I was referring to some interesting documents from lenovo. Have a few of those hardware but unfortunately didn't grab those files. Anyone also interested in these can PM me maybe we can do something about it.

when will twrp be avable

Interesting as there has a been a few of these turn up to auction of late .
I have gone with the 10' for main room and 8' for bedroom.. love them..
Got the oldies the little 7'
Great for streaming too..

The one I wish it did was announce the time by voice when the internet was down and we said "Hey Google". I am blind without my glasses and often when I am in bed, the internet is down in my area for maintenance period. The clock becomes useless when the internet goes down.

How are people getting the web browser to appear? I'm able to unlock the bootloader but can not boot with the AVB unlocked (well...technically it boots but still shows the spinning circle even though it will let you go to settings). I tried flashing the stock fastboot img and booting with avb unlocked and still get spinning circle. Not trying to get too fancy with this...just want to be able to point to a status page that I can leave it on.

Does anyone try to build a new firmware image and install this instead of stock?
Maybe compiling Android Things from source is possible, but looks like Google has stopped the development. The Lenovo Smart Frame seems to have the same MT8167S and runs on Android 10. Maybe it's possible to compile a LineageOS version?
lenovo.com/us/en/coming-soon/Lenovo-CD-3L501/p/ZZISZSDCD04
Another option might be fuchsia that contains a mt8167s board ref.
fuchsia.googlesource.com/fuchsia/+/master/boards/mt8167s_ref.gni
Googles Coral announced a Dev Board Mini based on MT8167s, maybe they port the Debian-based Mendel Linux to it.
coral.ai/products/dev-board-mini

hugo987 said:
Does anyone try to build a new firmware image and install this instead of stock?
Maybe compiling Android Things from source is possible, but looks like Google has stopped the development. The Lenovo Smart Frame seems to have the same MT8167S and runs on Android 10. Maybe it's possible to compile a LineageOS version?
lenovo.com/us/en/coming-soon/Lenovo-CD-3L501/p/ZZISZSDCD04
Another option might be fuchsia that contains a mt8167s board ref.
fuchsia.googlesource.com/fuchsia/+/master/boards/mt8167s_ref.gni
Googles Coral announced a Dev Board Mini based on MT8167s, maybe they port the Debian-based Mendel Linux to it.
coral.ai/products/dev-board-mini
Click to expand...
Click to collapse
I suppose the smart frame is running android things as well. Compiling android things does make much sense except to prove the drivers are sort of working, this is not designed to let users have fun (ie installing apps).
Google *really* loves mt8167s for some reason. I'd say there's a good chance of we having full android on it but everyone's busy.

They are throwing these things at our head now. 35/40 USD during black fridays.
I don't think you can order the components for that price
Anybody still working on it ? Lenovo claims it's still working on the sound bug - hxxps :// forums.lenovo.com/t5/Lenovo-Smart-Display-Lenovo-Smart-Clock-with-Google-Assistant/Smart-clock-alarm-volume-too-loud-at-first/m-p/5040962?page=4 (latest reply 2020-13-11 from Lenovo) and they did some unanounced pretty good updates in september 2020 - hxxps :// 9to5google.com/2020/09/21/lenovo-smart-clock-night-light/
They also claim the source is on their website hxxps :// smartsupport.lenovo.com/us/en/products/smart/smart-home/smart-clock/za4r/downloads/ds539701
So is this dead ?

deadman96385 said:
How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB A cable (Example here)
2. You will need fastboot drivers on your PC
3. Unplug your clock
4. Plug the USB A to A cable into your computer and clock
5. Hold the volume + button and plug in the power cord
6. Keep holding volume + for about 20-30 seconds (It is slow to boot to fastboot)
7. On your computer in a terminal run, fastboot flashing unlock
Part 1 of unlocking is now done
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Normally doing this on an Android Things device is not possible due to their Private key unlock system. But due to a leak, the private key for the Lenovo Smart Clock is available. Word of warning doing this causes the stock android things not to boot only the factory firmware located on Slot A will boot. Consistently if you don't AVB unlock the factory firmware on Slot A doesn't boot If you have already set up your device once the factory firmware is deleted and currently there is not a way to get it back (Hopefully will change soon).
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB Unlock zip
2. Run this command in terminal
Code:
at_auth_unlock.exe cube_unlock_credentials_v2.zip
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command:
Code:
fastboot oem at-lock-vboot!
Locale changer instructions:
Coming soon (Need to figure it out)
Downloads:
Stock Shipping fastboot firmware:
Here
AVB Unlock tool:
Here
Factory partition changer (Locale changer):
Here
Google released kernel source:
https://github.com/deadman96385/android_kernel_lenovo_mt8167s
Dump of stock partitions for easy viewing:
https://github.com/deadman96385/things_mt8167s_som_dump
Credit to @deletescape for the leak of the AVB Unlock Key, Stock firmware, region changer
Click to expand...
Click to collapse
how about smart display ,the same way?

jasonzhang1987 said:
how about smart display ,the same way?
Click to expand...
Click to collapse
We do not have the AVB unlock files for the smart displays sadly.

Pixel 4xl bricked itself

Hey all. My wifes phone decided to brick itself. Hers is/was an unlocked unit not purchased from verizon but on their network. I noticed its now locked. It randomly reset and on boot, the screen started blinking and was unresponsive. Then it rebooted again and the "try again, factory reset" note came up at the top of the screen. Try again yielded the same pattern. So, I tried full wipe, same thing, loop back to the try again screen. Then, I tried to side load the ota. All seemed ok. Installed her sim, all good. Went to settings to change to 3 button nav and boom, fail and try again screen. Was this a delay from maybe a bad sim card? Is 3 button nav an issue? Did evil verizon lock her phone? Can they do that?
So, I ordered another 4xl because she needs a solid phone to function for work. Id still like to know if I can recover the borked unit. Any help is appreciated.

You did all the correct things. Unfortunately it sounds like a hardware issue. Anytime you factory reset you have ruled out a software issue. Further, flashing a "rescue ota" via adb that resets the phone even with a locked bootloader. You've done everything you can do, except leave the red devil.

So now, I have it working, but not trusting it. I dont dare change to 3 button nav though...hahaha Still going to use the one we bought so she has a solid phone for work.
On another note. We're now stuck in the gmail recovery loop. 2 email addresses referencing eachother for recovery of passwords. Its maddening. I thought if I could get her phone to work, there would be some google magic that may kick in.
Its all evil.

sadly my 4xl has the same problem, it seems to be a serious bug from Google and needs to be fixed. Phone can't access Fastboot mode or Recovery mode, it can only stay in 9008 mode. This situation happened when I tried to update android 12 version but failed. Hope to have help from the developer, because there will be many people facing the same situation.

Hey all.
So for carbon coupe:
1. Verizon can't just lock your phone if it is unlocked, this is something that happens during the manufacturer process. So if it randomly restarted there may be another cause.
2. You wrote that when on 3 button navigation it works fine but if you switch the phone starts boot looping. This is clearly a software issue rather than a hardware issue(there is no chip responsible for the type of navigation system), so there may be a problem with the OS. This is a good thing because it means it's fixable without the need of money.
Factory reset usually fixes most problems but not all of them, as some partition aren't changed during the process, like boot or system.
So the problem is in one of those partition, just like when you have a locked phone and after reseting it it still knows it is lock.
The solution is to flash the firmware of the phone to fix it.
For sSjBlueVN197,
if you are on this mode it's called EDL mode. If you are on this mode it means fastboot and adb aren't available. On that mode you can flash firmware to the phone, even if it is locked or bricked.
This propose of this mode is to allow developers to flash firmware if when the system is damage, and some other partitions like boot and others are also damage. It's just like an emergency mode to rescue the phone.
Anyway, for both of you, here is what you need to fix your phone:
*Keep in mind this only works on windows, and I am assuming you have ADB and Fastboot command line installed, and you have some experience using the command line, and you are using a recent version of Windows10,*
1. Remove Lmobile drivers(from device manager on windows) and install the Google one's instead. If you don't know how to do it just search on google and you will find a tutorial
2. You need to download Qualcomm drivers and QPST tool. I will leave a link to a website where you can download it.
3. After Qualcomm drivers are installed, set up QPST.
3. On your phone, if you have access to adb, run without quotes "adb reboot EDL"(for carbon coupe)
If the phone can't reach adb there are other 2 methods, one using fastboot commands and other using the testing pins(requires phone disassembly)
As my phone is working and running fine android 12 I only know the adb command.
Once on EDL mode the screen is going to be completely black, and device manager will se your phone as :
QUALCOMM HS-USB QDLOADER 9008(COM "USB port number")​or something similar.
Now you can use the QPST tool to flash the firmware and boot image, or any other software that supports EDL mode.
Here is a link to a website which explains very well how to set up and use the QPST tool and where you can download all you need.
Hope this helps you!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

You are going to need also these files, that are the programmer files.
PLEASE KEEP IN MIND I DIN'T TRY OUT THIS FILES, SO THEY MAY BE FOR OTHER PHONE OR MAY NOT WORK.
So please use this files with caution, I found them on a post of XDA and they are in theory from a working Google Pixel 4XL, so they should work.
Though I didn't test them so they may just not work at all.

#mcl said:
You are going to need also these files, that are the programmer files.
PLEASE KEEP IN MIND I DIN'T TRY OUT THIS FILES, SO THEY MAY BE FOR OTHER PHONE OR MAY NOT WORK.
So please use this files with caution, I found them on a post of XDA and they are in theory from a working Google Pixel 4XL, so they should work.
Though I didn't test them so they may just not work at all.
Click to expand...
Click to collapse
hi, i have pixel 4 xl firehose but its asking for 2 more files raw program and patch file...
pixel4-XL_firehose - Google Drive
drive.google.com

#mcl , can you advices me the method that can fix this problem . so xml file can not meet this point .