Related
This is the Optimus 4x bootloader / bct / flash.cfg dump from kdz
http://cafe.naver.com/androidhacker/487 (in Korean)
kdz file can be extracted with LGExtract.exe
The extracted *.dz file is very similar with the old style dz file.
So I can extract it manually (please see the above link)
the old style dz file format: http://www.frenchcoder.com/dzextract-lg-dz-file-format-and-extract-tool-lg-ks20/
Im not sure It is worth for Optimus 4x
(I don't have Optimus 4x and I can't test it)
but you can try the following recent nvflash crack~
http://androidroot.mobi/2012/05/27/introducing-wheelie-nvflash-for-asus-transformer-tf101-b70/
happy hacking~
Changes
●dzextract script added
●flash.bct.encrypt file added
-----
EDIT:
SBK Detector for Transformer by [email protected]
http://forum.xda-developers.com/showthread.php?t=1232612 v1
http://forum.xda-developers.com/showthread.php?t=1290503 v2
See also http://www.xda-developers.com/android/sbk-detection-tool-for-the-asus-transformer/
SBK is leaked for Transformer...
nice, someone is testing it? cause i don't have a linux (downloading now, lol)
@down nah, f*ck.
wkpark said:
This is the Optimus 4x bootloader / bct / flash.cfg dump from kdz
http://cafe.naver.com/androidhacker/487 (in Korean)
Click to expand...
Click to collapse
so now we just need the secret SBK key, which is somewhere in the kdz or in the upgrade modem firmware as well.
otherwise those files are worthless, since you cannot boot without a SBK.
and that is IF you get the sbk extracted and they got the device open and you got the driver in place.
Dexter_nlb said:
so now we just need the secret SBK key, which is somewhere in the kdz or in the upgrade modem firmware as well.
otherwise those files are worthless, since you cannot boot without a SBK.
and that is IF you get the sbk extracted and they got the device open and you got the driver in place.
Click to expand...
Click to collapse
Yes the hardest part! already mentioned at androidroot.mobi
http://androidroot.mobi/technical/tf-secure-boot-key/
wkpark said:
This is the Optimus 4x bootloader / bct / flash.cfg dump from kdz
http://cafe.naver.com/androidhacker/487 (in Korean)
kdz file can be extracted with LGExtract.exe
The extracted *.dz file is very similar with the old style dz file.
So I can extract it manually (please see the above link)
the old style dz file format: http://www.frenchcoder.com/dzextract-lg-dz-file-format-and-extract-tool-lg-ks20/
Im not sure It is worth for Optimus 4x
(I don't have Optimus 4x and I can't test it)
but you can try the following recent nvflash crack~
http://androidroot.mobi/2012/05/27/introducing-wheelie-nvflash-for-asus-transformer-tf101-b70/
happy hacking~
Click to expand...
Click to collapse
Thanks for the info. I will start doing some hacking
_RSAobj said:
Thanks for the info. I will start doing some hacking
Click to expand...
Click to collapse
the bootloader do seem to contain "unlock" functionality, and it does also seem to support blob files , so one of the partitions should be able to contain a flashable blob like on prime. but still without unlocking mechanism, those blob's need signing too.
Dexter_nlb said:
the bootloader do seem to contain "unlock" functionality, and it does also seem to support blob files , so one of the partitions should be able to contain a flashable blob like on prime. but still without unlocking mechanism, those blob's need signing too.
Click to expand...
Click to collapse
thanks to all of you guys for your passion and for your help in trying to make the 4x an even better phone!
Hm, i hope we'll get the early christmas present soon
It's really good that we've a clue
@The Troll Like u see, it works, but it needs sth to work, like Dexter said
Sent from my LG-P880 using xda premium
did anyone extract and confirm?
i tried dz-extract loonnnggg ago but didnt seem to work
too sleepy atm to check..
temme what to do in the morning
i got ubuntu installed and v10c and f downloaded aleady
The Troll said:
did anyone extract and confirm?
i tried dz-extract loonnnggg ago but didnt seem to work
too sleepy atm to check..
temme what to do in the morning
i got ubuntu installed and v10c and f downloaded aleady
Click to expand...
Click to collapse
Yes, I managed to extract it. Thanks to the hint above.
For the first, got the flash.cfg and bootloader.bin. Will continue tomorrow.
I love this community!!!
so we got the bootloader..
what are the chances of it being unlocked?
i mean suppose we find the sbk keys in there..
what else will we need? and how do we get it?
The Troll said:
did anyone extract and confirm?
i tried dz-extract loonnnggg ago but didnt seem to work
too sleepy atm to check..
temme what to do in the morning
i got ubuntu installed and v10c and f downloaded aleady
Click to expand...
Click to collapse
ok Ive just added my dzextact script
and dump "flash.bct.encrypt" file found at the BCT_ENCRYPT subfile entry.
The Troll said:
so we got the bootloader..
what are the chances of it being unlocked?
i mean suppose we find the sbk keys in there..
what else will we need? and how do we get it?
Click to expand...
Click to collapse
I guess P880 have "fused" SBK that's why the flash.bct.encrypt found in the kdz.
See also http://www.sourceconference.com/publications/bos12pubs/android-modding-source.pdf
LG's old tegra2 devices have no SBK (P990/P999/SU660)
and some fuse information can be obtained via sysfs
(for kernel 2.6.39)
arch/arm/mach-tegra/tegra_odm_fuses.c
http://nv-tegra.nvidia.com/gitweb/?...62fd10ddbae8bed780ca80204efe11ee8;hb=rel-14r7
for SU660(P990 variant)
Code:
# busybox uname -a
Linux localhost 2.6.39.4-gb348b1e #1 SMP PREEMPT Sun Oct 28 01:37:22 KST 2012 armv7l unknown
# ls /sys/firmware/fuse
device_key
ignore_dev_sel_straps
jtag_disable
odm_production_mode
odm_reserved
sec_boot_dev_cfg
sec_boot_dev_sel
secure_boot_key
sw_reserved
Code:
[email protected]:/sys/firmware/fuse # cat secure_boot_key
0x00000000000000000000000000000000
How about P880 ?
----
Edit:
See also http://forum.xda-developers.com/showthread.php?t=1847950
I guess the fuse information work correctly only for a developer version
is fused a good news or bad?
what are the chances of this being unlocked? :/
should i sell it off or not? :/
wkpark said:
LG's old tegra2 devices have no SBK (P990/P999/SU660)
and some fuse information can be obtained via sysfs
(for kernel 2.6.39)
arch/arm/mach-tegra/tegra_odm_fuses.c
http://nv-tegra.nvidia.com/gitweb/?...62fd10ddbae8bed780ca80204efe11ee8;hb=rel-14r7
for SU660(P990 variant)
Code:
# busybox uname -a
Linux localhost 2.6.39.4-gb348b1e #1 SMP PREEMPT Sun Oct 28 01:37:22 KST 2012 armv7l unknown
# ls /sys/firmware/fuse
device_key
ignore_dev_sel_straps
jtag_disable
odm_production_mode
odm_reserved
sec_boot_dev_cfg
sec_boot_dev_sel
secure_boot_key
sw_reserved
Code:
[email protected]:/sys/firmware/fuse # cat secure_boot_key
0x00000000000000000000000000000000
How about P880 ?
----
Edit:
See also http://forum.xda-developers.com/showthread.php?t=1847950
I guess the fuse information work correctly only for a developer version
Click to expand...
Click to collapse
Code:
[email protected]:/sys/firmware/fuse # ls -la
-rw-rw-r-- radio system 4096 2012-10-29 07:21 device_key
-rw-rw-r-- radio system 4096 2012-10-29 07:21 ignore_dev_sel_straps
-rw-rw-r-- radio system 4096 2012-10-29 07:21 jtag_disable
-rw-rw-r-- radio system 4096 2012-10-29 07:21 odm_production_mode
-rw-rw-r-- radio system 4096 2012-10-29 07:21 odm_reserved
-rw-rw-r-- radio system 4096 2012-10-29 07:21 sec_boot_dev_cfg
-rw-rw-r-- radio system 4096 2012-10-29 07:21 sec_boot_dev_sel
-rw-rw-r-- radio system 4096 2012-10-29 07:21 secure_boot_key
-rw-rw-r-- radio system 4096 2012-10-29 07:21 sw_reserved
Code:
[email protected]:/sys/firmware/fuse $ su
[email protected]:/sys/firmware/fuse # cat secure_boot_key
[email protected]:/sys/firmware/fuse #
Code:
[email protected]:/sys/firmware/fuse # cat device_key
0xffffffff
[email protected]:/sys/firmware/fuse # cat ignore_dev_sel_straps
0x00000001
[email protected]:/sys/firmware/fuse # cat jtag_disable
0x00000000
[email protected]:/sys/firmware/fuse # cat odm_production_mode
0x00000001
[email protected]:/sys/firmware/fuse # cat odm_reserved
0x0000000000000000000000000000000000000000000000000000000000000000
[email protected]:/sys/firmware/fuse # cat sec_boot_dev_cfg
0x00000011
[email protected]:/sys/firmware/fuse # cat sec_boot_dev_sel
0x00000000
[email protected]:/sys/firmware/fuse # cat secure_boot_key
[email protected]:/sys/firmware/fuse # cat sw_reserved
0x00000000
wkpark said:
Code:
[email protected]:/sys/firmware/fuse # cat secure_boot_key
0x00000000000000000000000000000000
How about P880 ?
Click to expand...
Click to collapse
i believe life is not that simple. secret are to remain secrets until revealed by improper handling , this would have been plain stupid to enable if it was shown here.
Dexter_nlb said:
i believe life is not that simple. secret are to remain secrets until revealed by improper handling , this would have been plain stupid to enable if it was shown here.
Click to expand...
Click to collapse
I just make it clear
anyway LG sometime do stupid things like as leaking their RSA keys for some locked omap4 devices
so.. can someone temme whats with the fused sbk?
and if its even possible to get it?
Hi there.
I want to buy this phone and was just around on this forum for some weeks. Now i have an optimus black and in our forum an user made a tool for extracting al tables and content from kdz files. I dont know if it will work for 4x hd but have a look here and maybe dexter or other devs will come with some ideas.
http://forum.xda-developers.com/showthread.php?t=1566532
And here for an attemp to boot from sdcard http://forum.xda-developers.com/showthread.php?t=1960047.
Sorry for my awfull english.
http://android.clients.google.com/packages/data/ota/google_mako/de8b8d101614.signed-occam-JDQ39-from-JOP40D.de8b8d10.zip
Patching radio is just the modem drivers, most of the time there is a new one with every update release.
If they're going to disable LTE via radio/modem then that can easily be replaced by a previous or modified version but if its baked into the actual coding then thats another story.
UZ7 said:
Patching radio is just the modem drivers, most of the time there is a new one with every update release.
If they're going to disable LTE via radio/modem then that can easily be replaced by a previous or modified version but if its baked into the actual coding then thats another story.
Click to expand...
Click to collapse
Thanks. Fixed.
I'm not on ATT but with 4.2.2 changing to LTE only immediately reverts to WCDMA preferred..
There is indeed a new baseband. Phone Info shows that all the various LTE modes are still there though. Can someone on ATT or someone in Canada test to see whether LTE is still working?
---------- Post added at 04:57 PM ---------- Previous post was at 04:50 PM ----------
El Daddy said:
I'm not on ATT but with 4.2.2 changing to LTE only immediately reverts to WCDMA preferred..
Click to expand...
Click to collapse
If you select all the other LTE modes (LTE/GSM auto), it stays selected.
bioyuki said:
There is indeed a new baseband. Phone Info shows that all the various LTE modes are still there though. Can someone on ATT or someone in Canada test to see whether LTE is still working?
---------- Post added at 04:57 PM ---------- Previous post was at 04:50 PM ----------
If you select all the other LTE modes (LTE/GSM auto), it stays selected.
Click to expand...
Click to collapse
upload baseband only please
zephiK said:
upload baseband only please
Click to expand...
Click to collapse
Link me to a how-to and I'll be happy to do it for you
bioyuki said:
Link me to a how-to and I'll be happy to do it for you
Click to expand...
Click to collapse
$ adb shell
# == inside adb shell ==
$ su
# dd bs=256 count=49153 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/radio of=/sdcard/radio.img
49153+0 records in
49153+0 records out
12583168 bytes transferred in 11.365 secs (1107185 bytes/sec)
# exit
$ exit
# == adb shell exited ==
$ adb pull /sdcard/radio.img .
# done
(do those through ADB... or you can manually type it in terminal emulator)
when you type exit exit..... (and you didnt do it through ADB) just go to your /sdcard/ and upload the radio.img and include md5 hash please
zephiK said:
$ adb shell
# == inside adb shell ==
$ su
# dd bs=256 count=49153 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/radio of=/sdcard/radio.img
49153+0 records in
49153+0 records out
12583168 bytes transferred in 11.365 secs (1107185 bytes/sec)
# exit
$ exit
# == adb shell exited ==
$ adb pull /sdcard/radio.img .
# done
(do those through ADB... or you can manually type it in terminal emulator)
when you type exit exit..... (and you didnt do it through ADB) just go to your /sdcard/ and upload the radio.img and include md5 hash please
Click to expand...
Click to collapse
On it
zephiK said:
$ adb shell
# == inside adb shell ==
$ su
# dd bs=256 count=49153 if=/dev/block/platform/omap/omap_hsmmc.0/by-name/radio of=/sdcard/radio.img
49153+0 records in
49153+0 records out
12583168 bytes transferred in 11.365 secs (1107185 bytes/sec)
# exit
$ exit
# == adb shell exited ==
$ adb pull /sdcard/radio.img .
# done
(do those through ADB... or you can manually type it in terminal emulator)
when you type exit exit..... (and you didnt do it through ADB) just go to your /sdcard/ and upload the radio.img and include md5 hash please
Click to expand...
Click to collapse
Umm thats for a omap device it looks like. I don't think that will work.
winner00 said:
Umm thats for a omap device it looks like. I don't think that will work.
Click to expand...
Click to collapse
Yeah, not working. I found a tool to grab the radio but it works for Windows only. Anyone else?
winner00 said:
Umm thats for a omap device it looks like. I don't think that will work.
Click to expand...
Click to collapse
really? worked on my Nexus S (same exact instructions) which was a hummingbird processor. hmmm, probably because they played around with the partitioning system in 4.2.x
bioyuki said:
There is indeed a new baseband. Phone Info shows that all the various LTE modes are still there though. Can someone on ATT or someone in Canada test to see whether LTE is still working?
Click to expand...
Click to collapse
LTE no longer works on 4.2.2
bioyuki said:
If you select all the other LTE modes (LTE/GSM auto), it stays selected.
Click to expand...
Click to collapse
It stays selected, but once you exit the menu, it reverts back to WCDMA preferred.
efrant said:
LTE no longer works on 4.2.2
It stays selected, but once you exit the menu, it reverts back to WCDMA preferred.
Click to expand...
Click to collapse
Whaaaat?
Can anybody else confirm please
This thread beat you by a few minutes
http://forum.xda-developers.com/showthread.php?t=2147137
Closed
There's a lot of people out there with bricked KFHD 2013 (the newest Fire HD), with a lot of them requesting for the stock system images for this device. Unfortunately, no one has done so yet. However, if you have this device, and are rooted, you can help. To create these images, connect to a PC via ADB and enter these commands:
Code:
adb shell su -c "dd if=/dev/block/mmcblk0p10 of=/data/local/backup/stock-boot.img"
adb shell su -c "dd if=/dev/block/mmcblk0p11 of=/data/local/backup/stock-system.img"
adb pull "/data/local/backup/stock-recovery.img"
adb pull "/data/local/backup/stock-boot.img".
adb pull "/data/local/backup/stock-system.img""
If someone could upload these somewhere and provide the download link it would be greatly appreciated.
Ph0enix_216 said:
There's a lot of people out there with bricked KFHD 2013 (the newest Fire HD), with a lot of them requesting for the stock system images for this device. Unfortunately, no one has done so yet. However, if you have this device, and are rooted, you can help. To create these images, connect to a PC via ADB and enter these commands:
Code:
adb shell su -c "dd if=/dev/block/mmcblk0p10 of=/data/local/backup/stock-boot.img"
adb shell su -c "dd if=/dev/block/mmcblk0p11 of=/data/local/backup/stock-system.img"
adb pull "/data/local/backup/stock-recovery.img"
adb pull "/data/local/backup/stock-boot.img".
adb pull "/data/local/backup/stock-system.img""
If someone could upload these somewhere and provide the download link it would be greatly appreciated.
Click to expand...
Click to collapse
*clapping*
About time someone posted this, i was thinking of doing it myself soon. Hopefully someone will pull their images and maybe, just maybe they will get added to kffa.
stunts513 said:
*clapping*
About time someone posted this, i was thinking of doing it myself soon. Hopefully someone will pull their images and maybe, just maybe they will get added to kffa.
Click to expand...
Click to collapse
There are so many threads for bricks posted in the Q&A section that it's seriously disorienting. My mom's got the Fire HD 2013, but I've been told that tinkering with it is a major no-no .
Assuming someone can pull the system images off the Fire HD 2013, then this script here should work on it as well.
Nobody wants to help?
>>>Sent from my homebuilt TARDIS running Android 4.4... or maybe it's a rooted Kindle Fire HD running CyanogenMod 11<<<
I'll do it, I have adb setup but am getting an error entering the first command in. Do I have to have the device rooted for this to work?
Error is "su: not found"
su makes me think I need to root it...
Lol, yeah it needs to be rooted.
Sent from my KFHD running CM11
Ok I've rooted, now getting different error. I'll see what I can do to work through it.
C:\android-sdk\platform-tools>adb shell su -c "dd if=/dev/block/mmcblk0p10 of=/data/local/backup/stock-boot.img"
/data/local/backup/stock-boot.img: cannot open for write: No such file or directory
---------- Post added at 10:14 PM ---------- Previous post was at 10:10 PM ----------
Got past that error as well, just had to create the /data/local/backup directory
I've entered the first command in and I'm waiting... not sure if it locked up or if it should take a while to run.
---------- Post added at 10:16 PM ---------- Previous post was at 10:14 PM ----------
And of course right when I post it finishes. I'm running the second command, but are we missing on command to create the stock-recovery.img file?
---------- Post added at 10:39 PM ---------- Previous post was at 10:16 PM ----------
Ok I don't really know what I'm doing but I did some quick reading about partitions so that I could grab the recovery and I found the command that lists the data I think we want. So this is the layout on my kindle.
[email protected]:/dev/block/platform/omap_hsmmc.1/by-name # ll
ll
lrwxrwxrwx root root 2014-02-17 21:42 boot -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2014-02-17 21:42 bootloader -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2014-02-17 21:42 cache -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2014-02-17 21:42 crypto -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2014-02-17 21:42 efs -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2014-02-17 21:42 idme -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2014-02-17 21:42 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2014-02-17 21:42 recovery -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2014-02-17 21:42 system -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2014-02-17 21:42 userdata -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2014-02-17 21:42 xloader -> /dev/block/mmcblk0p1
So these are the commands that I ran.
adb shell su -c "dd if=/dev/block/mmcblk0p8 of=/data/local/backup/stock-boot.img"
adb shell su -c "dd if=/dev/block/mmcblk0p7 of=/data/local/backup/stock-recovery.img"
adb shell su -c "dd if=/dev/block/mmcblk0p9 of=/data/local/backup/stock-system.img"
-- I had to do a chmod 644 * on the /data/local/backup/ directory so that I could pull the files.
adb pull "/data/local/backup/stock-recovery.img"
adb pull "/data/local/backup/stock-boot.img"
adb pull "/data/local/backup/stock-system.img"
I should have the files posted soon. Do we need any of the others?
---------- Post added at 11:01 PM ---------- Previous post was at 10:39 PM ----------
Here are the files.
* Removed link
---------- Post added at 11:02 PM ---------- Previous post was at 11:01 PM ----------
I'll check this thread tomorrow, hopefully I can help out with getting this device going.
Your sure your Kindle is the "KIndle Fire HD 7 2013 MODEL, right?'
davethebrave14 said:
Your sure your Kindle is the "KIndle Fire HD 7 2013 MODEL, right?'
Click to expand...
Click to collapse
I just got this as a warranty replacement from Amazon yesterday. Model on the back cover is P48WVB4. This is the add supported model, not sure if that matters.
bmasephol said:
I just got this as a warranty replacement from Amazon yesterday. Model on the back cover is P48WVB4. This is the add supported model, not sure if that matters.
Click to expand...
Click to collapse
Does it have a front mounted camera and HDMI output? Also, run the command "adb shell mount > /sdcard/mount.txt" Then pull it off your device and post it here.
Sent from my iPod touch using Tapatalk
Ph0enix_216 said:
Does it have a front mounted camera and HDMI output? Also, run the command "adb shell mount > /sdcard/mount.txt" Then pull it off your device and post it here.
Sent from my iPod touch using Tapatalk
Click to expand...
Click to collapse
No front camera. Only port is headphone and micro USB. I'll have to do the adb later tonight to check that.
---------- Post added at 02:50 PM ---------- Previous post was at 02:34 PM ----------
Maybe another important piece is that this is the 8gb version, not a 16gb.
bmasephol said:
No front camera. Only port is headphone and micro USB. I'll have to do the adb later tonight to check that.
---------- Post added at 02:50 PM ---------- Previous post was at 02:34 PM ----------
Maybe another important piece is that this is the 8gb version, not a 16gb.
Click to expand...
Click to collapse
You definitely have the 2013 version. If you have 8GB of storage on your SD card, try to keep in mind that the total space of all three images is about 1GB (the boot and recovery ones should be pretty small, whereas the system image is pretty massive).
Sent from my iPod touch using Tapatalk
Ph0enix_216 said:
There's a lot of people out there with bricked KFHD 2013 (the newest Fire HD), with a lot of them requesting for the stock system images for this device. Unfortunately, no one has done so yet. However, if you have this device, and are rooted, you can help. To create these images, connect to a PC via ADB and enter these commands:
Code:
adb shell su -c "dd if=/dev/block/mmcblk0p10 of=/data/local/backup/stock-boot.img"
adb shell su -c "dd if=/dev/block/mmcblk0p11 of=/data/local/backup/stock-system.img"
adb pull "/data/local/backup/stock-recovery.img"
adb pull "/data/local/backup/stock-boot.img".
adb pull "/data/local/backup/stock-system.img""
If someone could upload these somewhere and provide the download link it would be greatly appreciated.
Click to expand...
Click to collapse
Kindle Fire HD 2013 Soho:
boot0block.img 4096 kb ~ 4 mb
stock-recovery.img 8192 kb ~ 8mb
stock-boot.img 8192 kb ~ 8 mb
stock-system.img 1277952 kb ~ 1.22 gb
Uploading to server. Will post links asap.
blambo said:
Kindle Fire HD 2013 Soho:
boot0block.img 4096 kb ~ 4 mb
stock-recovery.img 8192 kb ~ 8mb
stock-boot.img 8192 kb ~ 8 mb
stock-system.img 1277952 kb ~ 1.22 gb
Uploading to server. Will post links asap.
Click to expand...
Click to collapse
Those are the exact sizes of the files inside the zip I have posted... minus the boot0block.img. Didn't pull that one. But would probably be good to have more than one source.
bmasephol said:
Those are the exact sizes of the files inside the zip I have posted... minus the boot0block.img. Didn't pull that one. But would probably be good to have more than one source.
Click to expand...
Click to collapse
Sure, exactly.
Links:
boot0block.zip img CRC = AA7AB538
stock-boot.zip img CRC = DF69BAA8
stock-recovery.zip img CRC = B95DDD44
stock-system.zip img CRC = CA6A9595
Please check your CRCs.
Good luck with it.
blambo said:
Sure, exactly.
Links:
boot0block.zip img CRC = AA7AB538
stock-boot.zip img CRC = DF69BAA8
stock-recovery.zip img CRC = B95DDD44
stock-system.zip img CRC = CA6A9595
Please check your CRCs.
Good luck with it.
Click to expand...
Click to collapse
Thank you, kind sir!
Sent from my iPod touch using Tapatalk
blambo said:
Sure, exactly.
Links:
boot0block.zip img CRC = AA7AB538
stock-boot.zip img CRC = DF69BAA8
stock-recovery.zip img CRC = B95DDD44
stock-system.zip img CRC = CA6A9595
Please check your CRCs.
Good luck with it.
Click to expand...
Click to collapse
how can I use the images on my kindle I get a red flash then it goes straight to fastboot im of the understanding that the images may fix my kindle can someone explain how I would go about using them thanks
Um just thought i'd add I wouldn't post your boot0block, it contains things like your serial number, device I'd to kindle market(used for blacklisting), mac address, etc), its kinda personal info, its like whenever someone dumps their nvram they always erase their imei out of it so no one can jack their imei.
Sent from my Amazon Kindle Fire HD using Tapatalk
blambo said:
Sure, exactly.
Links:
boot0block.zip img CRC = AA7AB538
stock-boot.zip img CRC = DF69BAA8
stock-recovery.zip img CRC = B95DDD44
stock-system.zip img CRC = CA6A9595
Please check your CRCs.
Good luck with it.
Click to expand...
Click to collapse
stunts513 said:
Um just thought i'd add I wouldn't post your boot0block, it contains things like your serial number, device I'd to kindle market(used for blacklisting), mac address, etc), its kinda personal info, its like whenever someone dumps their nvram they always erase their imei out of it so no one can jack their imei.
Sent from my Amazon Kindle Fire HD using Tapatalk
Click to expand...
Click to collapse
True. But it's always good to back it up, as there have been a few cases (according to @Hashcode) where the boot0block has been wiped. Always good to have a backup of it handy. You just can't use someone else's to restore yours, and vice versa.
My next question is: does fastboot work for the Fire HD 2013 (soho) in the same way as the Fire HD 2012 (tate)?
Dead upon arrival.
I would have sent you mine if it wasn't rooted by amazon this very afternoon by update 11.3.2.1... going past my hosts file... probably a new push server IP.
i have found out what files to change/edit to enable all LTE bands in CN/WW ect versions
but need some help here
i cant find out were in the hell the file is located
so can u help please do so
RFSKUID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/rf_sku_id)needs to be changed but cant locate it
PROJID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/project_id)no problem changing
COUNTRY_CODE=$(cat /factory/PhoneInfodisk/country_code)no problem changing
-fluffy- said:
i have found out what files to change/edit to enable all LTE bands in CN/WW ect versions
but need some help here
i cant find out were in the hell the file is located
so can u help please do so
RFSKUID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/rf_sku_id)needs to be changed but cant locate it
PROJID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/project_id)no problem changing
COUNTRY_CODE=$(cat /factory/PhoneInfodisk/country_code)no problem changing
Click to expand...
Click to collapse
Not sure if this is the file u are asking for but still i am attaching it...I opened this file and found only "2" written in it
mhp1995 said:
Not sure if this is the file u are asking for but still i am attaching it...I opened this file and found only "2" written in it
Click to expand...
Click to collapse
didt u take it from ur data on the phone
because its locked so we cant put it on the phone again
-fluffy- said:
didt u take it from ur data on the phone
because its locked so we cant put it on the phone again
Click to expand...
Click to collapse
I opened root browser and extracted this file from sys/module/intel_mid_sfi.... Can't we push this file via adb? I am sorry i dont know anything about this... I am learning things
mhp1995 said:
I opened root browser and extracted this file from sys/module/intel_mid_sfi.... Can't we push this file via adb? I am sorry i dont know anything about this... I am learning things
Click to expand...
Click to collapse
no we cant
thats why i need to know from were this file comes frome
sysfs is pseudo filesystem. The content there is not stored on disk, and will be reset on reboot.
updateing said:
sysfs is pseudo filesystem. The content there is not stored on disk, and will be reset on reboot.
Click to expand...
Click to collapse
I know that's why I need to know we're it is hidden in boot.img
-fluffy- said:
I know that's why I need to know we're it is hidden in boot.img
Click to expand...
Click to collapse
They are not in the ramdisk. Instead, the device drivers populate these sysfs files/nodes. You may want to check the discussion thread about unlocking bands in general forum. The OP there is planning to add some hax into kernel, which I think more reasonable.
In boot.img somewere the band code is hidden just need to find out we're so I can change it so it's gets the same code on reboot
This would mean that the phone would require an unlocked bootloader in order to have all LTE bands enabled as the boot.img is signed...one changed byte and the checksum wouldn't match
bootloader unlock:
http://forum.xda-developers.com/zenfone2/general/congrats-to-bootlocker-unlocked-t3138547
tachno said:
bootloader unlock:
http://forum.xda-developers.com/zenfone2/general/congrats-to-bootlocker-unlocked-t3138547
Click to expand...
Click to collapse
Yeah, I know - the OP is mentioning my nickname along with shakalaca's :silly:
Problem is that not everyone wants to risk the unlock and have possible warranty issues, this is the point I am trying to refer to
TheSSJ said:
Yeah, I know - the OP is mentioning my nickname along with shakalaca's :silly:
Problem is that not everyone wants to risk the unlock and have possible warranty issues, this is the point I am trying to refer to
Click to expand...
Click to collapse
I'm trying the unlock later today. Don't give a rats u know about the warranty ?
LTE bands depends on RF_SKU_ID value.
In kernel sources RF_SKU_ID is defined based on "zenfone2.MR7.1-2.18.40\linux\kernel\arch\x86\platform\intel-mid\intel_mid_sfi.c" file.
Possibly, if we change it to static WW value "0", then LTE bands may become available.
Not sure if this helps, but thought I'd mention it.
My CN region ZF2 has unlocked bootloader and is rooted. I am very much interested in this thread. Using adb shell as su, I have poked around the phone and see that under /factory/PhoneInfodisk/PhoneInfo_inf contains 'CN' along with the the serial no, and other items.
Also, in the same directory /factory/PhoneInfodisk the file 'country_code' contains only CN.
Code:
127|[email protected]:/factory/PhoneInfodisk # ls -l
ls -l
-r----x--t root root 612 1999-12-31 22:36 PhoneInfo_inf
-rw-rw-rw- root root 18 1999-12-31 22:36 bd_addr.conf
-rw-rw-rw- root root 3 1999-12-31 22:36 color_id
-rw-rw-rw- root root 3 1999-12-31 22:36 country_code
-rw-rw-rw- root root 5 1999-12-31 22:36 customer_id
-rw-rw-rw- root root 13 1999-12-31 22:36 ssn
Also, the rf_sku_id is 2 on my phone. I looked under /factory/telephony and there is a directory called 2 and contains a file:
Code:
[email protected]:/factory # cd telephony
cd telephony
[email protected]:/factory/telephony # ls -l
ls -l
drwxrwx--- system radio 1999-12-31 16:01 2
-rw-rw---- system radio 131072 1999-12-31 22:36 calib.nvm
[email protected]:/factory/telephony # ls -l 2
ls -l 2
-rw-rw---- system radio 131072 1999-12-31 22:37 calib.nvm
Here's the Intel 726x radio datasheet - http://download.intel.com/newsroom/archive/mobile-xmm-7260-1-brief.pdf
And, just so you know, I modified one file which enabled my original ZF2 CN version (converted to WW) to get LTE Band 2.
hi-phile said:
Not sure if this helps, but thought I'd mention it.
My CN region ZF2 has unlocked bootloader and is rooted. I am very much interested in this thread. Using adb shell as su, I have poked around the phone and see that under /factory/PhoneInfodisk/PhoneInfo_inf contains 'CN' along with the the serial no, and other items.
Also, in the same directory /factory/PhoneInfodisk the file 'country_code' contains only CN.
Code:
127|[email protected]:/factory/PhoneInfodisk # ls -l
ls -l
-r----x--t root root 612 1999-12-31 22:36 PhoneInfo_inf
-rw-rw-rw- root root 18 1999-12-31 22:36 bd_addr.conf
-rw-rw-rw- root root 3 1999-12-31 22:36 color_id
-rw-rw-rw- root root 3 1999-12-31 22:36 country_code
-rw-rw-rw- root root 5 1999-12-31 22:36 customer_id
-rw-rw-rw- root root 13 1999-12-31 22:36 ssn
Also, the rf_sku_id is 2 on my phone. I looked under /factory/telephony and there is a directory called 2 and contains a file:
Code:
[email protected]:/factory # cd telephony
cd telephony
[email protected]:/factory/telephony # ls -l
ls -l
drwxrwx--- system radio 1999-12-31 16:01 2
-rw-rw---- system radio 131072 1999-12-31 22:36 calib.nvm
[email protected]:/factory/telephony # ls -l 2
ls -l 2
-rw-rw---- system radio 131072 1999-12-31 22:37 calib.nvm
Here's the Intel 726x radio datasheet - http://download.intel.com/newsroom/archive/mobile-xmm-7260-1-brief.pdf
And, just so you know, I modified one file which enabled my original ZF2 CN version (converted to WW) to get LTE Band 2.
Click to expand...
Click to collapse
As fore now we need to find out we're we change the country code an RF_sku file so it gets the right info on boot
How has the progress been on changing the RF_sku country code?
mrbubs3 said:
How has the progress been on changing the RF_sku country code?
Click to expand...
Click to collapse
Not yet
But they are working on it
-fluffy- said:
Not yet
But they are working on it
Click to expand...
Click to collapse
Fluffy, is this the best place to watch for update news on this WIP??
If not, where??
Boowho??
Hello! I'm having problems with my mobile connection. I can connect without any problems on LTE but if LTE signal is not available, my phone does not connect on HSDPA or 3G. Is that a problem on my network provider or with the my zf2? Sorry if this is the wrong place to ask question.
First of all, this was all made possible by s3axel
Now on to the tutorial:
Flash s3axel's stock recovery with adb enabled (Tutorial in post)
Now you have that, boot into the recovery and put in your security method (pattern, pin, etc)
Now open CMD and type "adb shell"
To find a specific module
type "ls -Ral data/adb/modules"
Now to remove the magisk module
type "rm -r data/adb/modules/module_name"
(module_name is the name of the module)
I'll be sure to try and help with any questions in the comments so don't be shy to ask
Don't you have to cd to a path before executing the remove command?
EDIT:
You have to cd to data/adb/modules and then run the rm -r command. It worked perfectly! Now I can actually try different modules. Thanks!
Sent from my OnePlus7TPro using XDA Labs
Lossyx said:
Don't you have to cd to a path before executing the remove command?
EDIT:
You have to cd to data/adb/modules and then run the rm -r command. It worked perfectly! Now I can actually try different modules. Thanks!
Sent from my OnePlus7TPro using XDA Labs
Click to expand...
Click to collapse
Sorry forgot that yeah, thanks for the heads up. I edited the post
HolyChickenGuy said:
First of all, this was all made possible by s3axel
type "rm -r data/adb/modules/module_name"
Click to expand...
Click to collapse
Remembers me of how to shoot yourself in the foot with bash...
Code:
$ ls
foot.c foot.h foot.o toe.c toe.o
$ rm * .o
rm:.o no such file or directory
$ ls
$
Always be carefull when using "rm -r" or "rm -rf". :laugh:
thank you very much for you post, really helped me
I followed this guide but didn't succeed!
When imputing the command "ls -ral /data/adb/modules" I get the message that there is not that file or directory...
Inputing "ls -ral /data/adb" I find that there are 2 directorys under /adb: "system" and "root", but no "modules"
I'm stuck here. please help me
salomaoa said:
I followed this guide but didn't succeed!
When imputing the command "ls -ral /data/adb/modules" I get the message that there is not that file or directory...
Inputing "ls -ral /data/adb" I find that there are 2 directorys under /adb: "system" and "root", but no "modules"
I'm stuck here. please help me
Click to expand...
Click to collapse
I think you can use "cd file_name" to enter file
"cd .." to back
You can type "ls" to show any file
And you go in the file and type "rm -r *" to remove all file and folder
ricky886 said:
I think you can use "cd file_name" to enter file
"cd .." to back
You can type "ls" to show any file
And you go in the file and type "rm -r *" to remove all file and folder
Click to expand...
Click to collapse
I was hoping you could guide me? I want to delete lock.ogg and unlock.ogg in system/product/media/ui folder and copy new ones. BTW, I have got the adb enabled img of 10.0.8...
adeelsmatrix said:
I was hoping you could guide me? I want to delete lock.ogg and unlock.ogg in system/product/media/ui folder and copy new ones. BTW, I have got the adb enabled img of 10.0.8...
Click to expand...
Click to collapse
You'll have to use magisk for that.
System is permanent read only in Android 10
Sent from my OnePlus7TPro using XDA Labs
adeelsmatrix said:
I was hoping you could guide me? I want to delete lock.ogg and unlock.ogg in system/product/media/ui folder and copy new ones. BTW, I have got the adb enabled img of 10.0.8...
Click to expand...
Click to collapse
You can try this to remove that two files
Adb shell
CD system/product/media/ui
Rm lock.ogg
Rm unlock.ogg
ricky886 said:
You can try this to remove that two files
Adb shell
CD system/product/media/ui
Rm lock.ogg
Rm unlock.ogg
Click to expand...
Click to collapse
Thanks for the reply bro, Actually I need to overwrite these two files with the files of same names. So how to put new files with the same names. PEACE...
adeelsmatrix said:
Thanks for the reply bro, Actually I need to overwrite these two files with the files of same names. So how to put new files with the same names. PEACE...
Click to expand...
Click to collapse
Check this
https://adbshell.com/commands
I think you can use cp(copy) or mv(move) commands
Lossyx said:
You'll have to use magisk for that.
System is permanent read only in Android 10
Sent from my OnePlus7TPro using XDA Labs
Click to expand...
Click to collapse
How magisk could help in this regard. Is there any specific module...?
---------- Post added at 07:23 AM ---------- Previous post was at 07:22 AM ----------
ricky886 said:
Check this
https://adbshell.com/commands
I think you can use cp(copy) or mv(move) commands
Click to expand...
Click to collapse
Thanks, I'll try this...
ricky886 said:
Check this
https://adbshell.com/commands
I think you can use cp(copy) or mv(move) commands
Click to expand...
Click to collapse
I can enter into systems but adb shell is displaying only three directories/folders (bin, etc and lib64). I can't get into system/product/media/audio/ui folder. Any suggestions....?
As I know off you can't mount system rw in Android 10 for now...
salomaoa said:
I followed this guide but didn't succeed!
When imputing the command "ls -ral /data/adb/modules" I get the message that there is not that file or directory...
Inputing "ls -ral /data/adb" I find that there are 2 directorys under /adb: "system" and "root", but no "modules"
I'm stuck here. please help me
Click to expand...
Click to collapse
I am stuck here as well, "ls -ral /data/adb" tells me no such file or directory.
"ls -ral /data" only returns
# ls -Ral data
data:
total 0
drwxr-xr-x 2 root root 40 2019-12-25 01:32 .
drwxr-xr-x 28 root root 1100 1970-03-14 14:38 ..
I installed a Magisk module and Now im stuck in boot animation. Have no way of uninstalling at the moment. Please let me know if you have a solution
thanks for this guide !!
c19932 said:
I am stuck here as well, "ls -ral /data/adb" tells me no such file or directory.
"ls -ral /data" only returns
# ls -Ral data
data:
total 0
drwxr-xr-x 2 root root 40 2019-12-25 01:32 .
drwxr-xr-x 28 root root 1100 1970-03-14 14:38 ..
I installed a Magisk module and Now im stuck in boot animation. Have no way of uninstalling at the moment. Please let me know if you have a solution
Click to expand...
Click to collapse
Looks like you forgot the "/" infront of data so unless you are already in the root directory it is listing the contents of the directory "data" that is in your current location which it looks like doesn't exist.
Either run
# ls -Ral /data
or
# cd /
# ls -Ral data
Hope that helps ya out.
Stay Kung Flu Free
Later
Thanks for this helpful guide,
Just an FYI for my 10.0.7AA i reboot into recovery but i cannot decrypt, however I could use those commands and helped me remove the modules.
However, the phone is still not booting, does it have anything to do with the recovery pushed? Do I need to then go place the stock recovery back?
Or has it got something else wrong?
Thanks again.
Another way with a computer running adb:
If adb debugging is enabled:
"adb wait-for-device shell magisk --remove-modules"
If not, flash the stock boot.img, enable USB debugging, flash the magisk_patched_boot.img and then run the command.
It will remove all modules even if your SystemUI crashes. If you are stuck before adb commands can be issued, the OT's tutorial will do.
Macusercom said:
Another way with a computer running adb:
If adb debugging is enabled:
"adb wait-for-device shell magisk --remove-modules"
If not, flash the stock boot.img, enable USB debugging, flash the magisk_patched_boot.img and then run the command.
It will remove all modules even if your SystemUI crashes. If you are stuck before adb commands can be issued, the OT's tutorial will do.
Click to expand...
Click to collapse
Thanks, good to know!
So only prerequisite is that ADB/USB debugging is enabled and it works for both Magisk and Xposed modules?