Database Develop

[STICKY][Guide] Creating and Flashing Custom Boot Logo's (Replace Viewsonic Logo)

ADVANCED USERS ONLY - NVFLASH REQUIRED
I would like to reiterate the importance of when I say this is not for the faint of heart. You should be familiar with nvflash, know how to pull the partition table, know how to do a full restore, etc. You are directly and blindly flashing a partition. A small percentage of devices have a different partition table, which this guide would not work for.
1)Follow this guide to setup Nvflash, and enter APX mode: http://wiki.tegratab.com/index.php/Nvflash_FAQ
2)Download boot logo if you don't have one.
3)Open a command line and change directory to the image location on your hard drive.
4)Enter APX mode
5)Run command:
Code:
nvflash --bl bootloader.bin --download 6 (imagename).bmp
-a)Note: 6 is the number of the partition that this image is stored on, nothing else resides on this partition, and nothing else will be damaged
6)Reboot and you should see something other than the Viewsonic Birds
Sample:
Do not save this image preview as template(it is a png instead of bmp).
Download here: http://www.multiupload.com/OWS9JEPVXE
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Creating Logo:
Tools:
Gimp (or equivalent)
-free photo editing software
1)Open my sample image in Gimp
2)Find logo that you want
-a)For example you could find a android image
3)Select and delete tegra logo
4)Paste your logo onto the white tegra background (this has correct dimensions)
5)Merge layers
6)Save as .bmp
7)Flash like above method
Bootloader
Correct bootloader.bin is located in the stock Gtablet TnT Nvflash restore(one without 46 in name): http://db.tt/Wm25t7U

Cool Tip thanks for sharing
Hey thanks, that's awesome! By any chance, would you know how to change the GTablet Oval Graphic and the animated X that's after it?
BTW, what do you guys think of a possible animated logo for Roebeets and Rothnics builds. I think they deserve their own animated logos ala Cyanogen Mod. What do you guys think? Hoping someone with some graphics talent sees this. ;P

The animated X is easily changable, I know its just a zip file you replace. (From what I read about my Droid 2.) I would assume it would be the same in this case. I've not done it though.
I also would like to know how to remove the gTablet oval logo that shows up after the Viewsonic birds logo.

Its gone in CM6.1 but TNT is way more stable/functional

KnightCrusader said:
The animated X is easily changable, I know its just a zip file you replace. (From what I read about my Droid 2.) I would assume it would be the same in this case. I've not done it though.
I also would like to know how to remove the gTablet oval logo that shows up after the Viewsonic birds logo.
Click to expand...
Click to collapse
gTablet logo is in the boot.img, and could be replaced with a little effort.
The main animation is the zip file, like you point out, and it is easily replaceable. I have used the Nexus One animation in the ZPad 2.2 ROM. I believe it is under /system/media.

Hmm.....any thoughts?
EDIT: Ignore me. Read that you can't use stock NVIDIA bootloader.bin ::face palm::. Working now
Code:
c:\Program Files (x86)\NVIDIA Corporation\tegra_froyo_20101105>nvflash --bl boot
loader.bin --download 6 tegra.bmp
Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 3
chip sku: 0x8
chip uid: 0x1714118842c051d7
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: nand
operating mode: 3
device config strap: 0
device config fuse: 0
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
| 933404/933404 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
sending file: tegra.bmp
\ 1441792/1843256 bytes sentdata send failed NvError 0x30012
command failure: partition download failed

h8rift said:
Hmm.....any thoughts?
EDIT: Ignore me. Read that you can't use stock NVIDIA bootloader.bin ::face palm::. Working now
Code:
c:\Program Files (x86)\NVIDIA Corporation\tegra_froyo_20101105>nvflash --bl boot
loader.bin --download 6 tegra.bmp
Nvflash started
rcm version 0X20001
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 3
chip sku: 0x8
chip uid: 0x1714118842c051d7
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: nand
operating mode: 3
device config strap: 0
device config fuse: 0
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
| 933404/933404 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
sending file: tegra.bmp
\ 1441792/1843256 bytes sentdata send failed NvError 0x30012
command failure: partition download failed
Click to expand...
Click to collapse
ummm yea, I got the same thing. I have the version of NVFLASH from week one with the original files that we used to bring it back to stock.
What am I missing?
EDIT: I'M WITH YOU, SORRY FALSE ALARM, guess I grabbed the wrong one (idiot)
Nice find Rothnic
Also, if you find another boot up logo you want (where the malata, nexus, ect. animated screen is), its just a .zip that can be replaced in /system/media Nice little change!

deleted...

So its not working for me. It connects, downaloads and starts the bootloader, then downloads the bmp successfully. I shut the tab off and restart and I see those damn birds....
Any ideas?
I already redownloaded the nvflash files. Still doesn't work.
I formated partition 6 with nvflash and put my picture there and still have the damn birds. Every time it says it's successful! Damn It! LOL!

Noob question: Where do I get bootloader.bin?
-=Sent from my ViewSonic G Tablet (Zpad 2.2) using Tapatalk=-

Bump...
Seriously... I managed to modify the boot.img and change the g-tablet logo, but I can't get this one done! It's very frustrating. Something so simple, yet it won't work!
I used nvflash in Win 7
I used nvflash in Ubuntu
I formated partition 6
I dumped 16MB from partition 6 and tried to view it
NUTIN!
Does anyone have any ideas?

Make sure you are not using the nvidia nvflash but the one in the other folder.

Lil Help
So I was trying to get this to work, realized I could format partition 6 (to try to get the file to copy) and did that, must have removed some stuff that needs to be there cause now I keep getting an error, process acore stopped. The on screen keyboard no longer pops up.
So there must be more than just the .bmp file in partition 6?
Can someone please look at partition 6 and maybe zip or list the files and folders in it. I would rather rebuild partition 6 than rebuild my whole setup.
Aditionally rothnic can you add step 1a to the instructions.
1a) replace the bootloader.bin file with one from the original or a custom rom specifically for the gtab.
I did get the new image installed though

it2steve said:
ummm yea, I got the same thing. I have the version of NVFLASH from week one with the original files that we used to bring it back to stock.
What am I missing?
EDIT: I'M WITH YOU, SORRY FALSE ALARM, guess I grabbed the wrong one (idiot)
Nice find Rothnic
Also, if you find another boot up logo you want (where the malata, nexus, ect. animated screen is), its just a .zip that can be replaced in /system/media Nice little change!
Click to expand...
Click to collapse
i dont get it, how did you guys get this to work? did you have to download the bootloader.bin from else where and not use the one included in the folder?
please help!
thanks!

popezaphod said:
Noob question: Where do I get bootloader.bin?
-=Sent from my ViewSonic G Tablet (Zpad 2.2) using Tapatalk=-
Click to expand...
Click to collapse
I'm with you and lost. I am running TnT Lite 2.2. I've got nvflash up and running, but I guess am misssing the bootloader.bin file as I get an erro at the end.

realsol said:
Make sure you are not using the nvidia nvflash but the one in the other folder.
Click to expand...
Click to collapse
what other folder? could you please explain?
thanks!

liquidcaffeine said:
I'm with you and lost. I am running TnT Lite 2.2. I've got nvflash up and running, but I guess am misssing the bootloader.bin file as I get an erro at the end.
Click to expand...
Click to collapse
yea i get you get the same error im getting. look below:
System Information:
chip name: t20
chip id: 0x20 major: 1 minor: 3
chip sku: 0x8
chip uid: 0x17141188445fd217
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: nand
operating mode: 3
device config strap: 0
device config fuse: 0
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
| 933404/933404 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
sending file: tegra.bmp
/ 1835008/1843256 bytes sentdata send failed NvError 0x30012
command failure: partition download failed

liquidcaffeine said:
I'm with you and lost. I am running TnT Lite 2.2. I've got nvflash up and running, but I guess am misssing the bootloader.bin file as I get an erro at the end.
Click to expand...
Click to collapse
The really weird thing now is after a reboot, half if the new graphic is showing up!

i got past the error when pushing out the tegra.bmp file but now the screen turns black and says "entering nvlash recovery mode / nv3p server"
i followed this...
http://forum.xda-developers.com/showthread.php?t=859834

felizf said:
i got past the error when pushing out the tegra.bmp file but now the screen turns black and says "entering nvlash recovery mode / nv3p server"
i followed this...
http://forum.xda-developers.com/showthread.php?t=859834
Click to expand...
Click to collapse
That means you are done, now restart.

[Q] NVFLASH commands for tegra2 on LG P990 (Linux4Tegra)

Hi all folks,
I'm a curious owner of one O2X aka LG P990 aka LG Optimus Dual, the famous device with nvdia's Tegra2 SoC.
I'm not sure that this is the correct place for this thread, but, as new member, I'm not able to post elsewhere.
Excuse me for my bad english.
Get down...
As we know, NvFlash is the nvidia tool for flashing devices over USB connection, documentations regarding this tool are a bit hard to find, but not so much.
Depending on the platform, nvidia provides the "NVIDIA Tegra Linux Driver Package (L4T)", sure, for free (sure, for Linux)!
Among other things L4T contains NvFlash.
I searched for platform code-named harmony, according to wikipedia.org, the same that seems to be under our device.
First I want to make a complete backup of my device, so if somethings goes wrong, the backup can restore my O2X.
I found some information about this, summarizing:
Code:
./nvflash --bl fastboot.bin --go
or better:
Code:
./nvflash --bl fastboot.bin --getbct --bct ./myBCT.bct --go
This command start nvflash and load the bootloader fastboot.bin (also found in L4T package) in memory. The command also read back the "boot/binary configuration table" in a file called myBCT.bct
After this command terminate correctly, I want to read the partition table of the device, so as to know which partition I'll have to backup.
Code:
./nvflash -r --getpartitiontable ptable.txt
I'm stuck on getting the partition table.
NvFlash return me this erros:
Code:
Nvflash v1.9.86345 started
[resume mode]
failed executing command 20 NvError 0x120002
command failure: get partition table failed (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x4 (0x4) flags: 0
Can anyone help me please?
I don't want to use any kind of oneclicktool that hide the "real" actions performed on my box, as I said, I'm curoius!
Thanks!

Download the flashtool from homero2 for Linux and open the shell with an editor, so there you'll find the commands you're looking for, if not all at least the most used.
Do not say "thanks"; just press it under here.

louiscypherbr said:
Download the flashtool from homero2 for Linux and open the shell with an editor, so there you'll find the commands you're looking for, if not all at least the most used.
Do not say "thanks"; just press it under here.
Click to expand...
Click to collapse
Ok I'll click on the thanks button, but my question has not been answered.
I'm stuck on getting the partition table.
NvFlash return me this erros:
Code:
Nvflash v1.9.86345 started
[resume mode]
failed executing command 20 NvError 0x120002
command failure: get partition table failed (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x4 (0x4) flags: 0
Can someone who has already seen this error help me?
What could the cause be?
Thanks in advance!

Change USB cable. On some low quality cables nvflash work with errors.
Sent from my LG-P990 using xda premium

Acider_HardStyle said:
Change USB cable. On some low quality cables nvflash work with errors.
Sent from my LG-P990 using xda premium
Click to expand...
Click to collapse
Yes I heared about problems due to cable, I'm using the original LG USB cable, hope it is good.
I think the error concern a specific thing,
Code:
bootloader status: partition table is required for this command (code: 8) message: nverror:0x4 (0x4) flags: 0
but i cannot find nothing about this message on the internet.
Help me please...

tryin said:
Ok I'll click on the thanks button, but my question has not been answered.
Click to expand...
Click to collapse
Lol.. You don't need to thank me for nothing. I'm sorry, it's my signature, and just a way to say people stop posting "oh, thank you" and anything else that justifies a new post. I'll remove it anyway.
Btw, back to the topic, I always used that scripts to make the things by myself, understanding what command is for and so. Perhaps it's the easy way to learn, looking at codes.

louiscypherbr said:
Lol.. You don't need to thank me for nothing. I'm sorry, it's my signature, and just a way to say people stop posting "oh, thank you" and anything else that justifies a new post. I'll remove it anyway.
Btw, back to the topic, I always used that scripts to make the things by myself, understanding what command is for and so. Perhaps it's the easy way to learn, looking at codes.
Click to expand...
Click to collapse
Don't worry louis,
did you used the nvflash elf executable packed in the homero2's packet..?

tryin said:
Don't worry louis,
did you used the nvflash elf executable packed in the homero2's packet..?
Click to expand...
Click to collapse
Yes.

louiscypherbr said:
Yes.
Click to expand...
Click to collapse
and you know where that elf does come from?

No.
But now a suggestion comes to my mind. Did you tried passing -bl fastboot.bin on the command you're getting error? I think it's always necessary to pass the fastboot.bin to make the phone boot on nvflash mode and read its partition table.
Sent from my LG-P990 using xda app-developers app

..

louiscypherbr said:
No.
But now a suggestion comes to my mind. Did you tried passing -bl fastboot.bin on the command you're getting error? I think it's always necessary to pass the fastboot.bin to make the phone boot on nvflash mode and read its partition table.
Sent from my LG-P990 using xda app-developers app
Click to expand...
Click to collapse
Fastboot is loaded without any problem, i think the error was caused by the --getparitiontable in resume mode, " -r ".
I would like to know the origin of that executable, or al least the version...

tryin said:
Fastboot is loaded without any problem, i think the error was caused by the --getparitiontable in resume mode, " -r ".
I would like to know the origin of that executable, or al least the version...
Click to expand...
Click to collapse
I think I got similar error when I was playing with nvflash tool as well. I guess you are correct, it will be related to resume mode.
I have all commands in batch and it works fine, but when insert one by one, then error can happen.
My code for GB partition backup:
Code:
nvflash.exe --bl fastboot.bin --getbct --bct backup\backup.bct --go
nvflash.exe -r --getpartitiontable backup\partition.txt
nvflash.exe -r --read 2 backup\bct.img
nvflash.exe -r --read 4 backup\bootloader.img
nvflash.exe -r --read 10 backup\boot.img
nvflash.exe -r --read 12 backup\lgdrm.img
nvflash.exe -r --read 14 backup\recovery.img
nvflash.exe -r --read 16 backup\data.img
nvflash.exe -r --read 6 backup\system.img
nvflash.exe -r --go

p.valenta said:
I think I got similar error when I was playing with nvflash tool as well. I guess you are correct, it will be related to resume mode.
I have all commands in batch and it works fine, but when insert one by one, then error can happen.
Click to expand...
Click to collapse
And what version of nvflash did you used?

tryin said:
And what version of nvflash did you used?
Click to expand...
Click to collapse
I extract it from ProgMaq zip file. I cannot search on XDA now, but you can try to get it from this thread: http://forum.xda-developers.com/showthread.php?t=1975274. Well, I download it from another thead, but XDA search not works now, hard to find.

Ok,
obviously here:
http://forum.xda-developers.com/wiki/Nvflash
http://developer.download.nvidia.com/assets/mobile/files/tegra-linux-12.alpha.1.0.tar.gz
this is the only "official" link that give me a version of NvFlash that work without problems on my O2X.
It with fastbootICS.bin packed in homero2's Optimus_Toolkit_6-in-1_V-1.1.1 tar.
With the fastboot.bin found in the same packed of the official nvflash i get stuck!
Why?
I don't know yet...

[HELP] NEED DUMP OF NVA PARTITION FROM LG Optimus 4X HD (P880)

Hello!
I need a "donor" dump of NVA section from working device.
Dump is needed to restore IMEI, after a full "brikking".
Unfortunately, I do not have a backup NVA section of my device.
Dumping can be done by moving the device in the APX (nvflash) mode.
1. Remove the battery.
2. Press both Volume + and Volume - and then insert a usb cable.
3. The system should appear "APX device". (If not, repeat step 2)
4. Insert the battery into place.
5. Install the driver from the "apx_device_drivers" folder (it may be necessary to temporarily disable digital signature verification of drivers)
6. Run "make_NVA_dump.bat"
In "nvflash" folder appears "NVA.img" file.
If you know how to edit IMEI in "img" file, do it by replacing your IMEI to fake data.
Download "make_NVA_dump.zip" from there "https://mega.nz/#!UANnnL6K!JkDlsf28HuD_j7gbRzJQ-bjddo-WbqkVGdvmHBDH5Gw"

im in the same situation, full brick.
If u manage to solve this, please post how u did it.
thanx

I unbrick my LGO4XHD with nvflash tool from this post
http://forum.xda-developers.com/optimus-4x-hd/general/maybe-nvflash-method-t3159853
but i not backup all data and lost IMEI :silly:
BEFORE you start unbricking try backup all partitions from your device!!!!
Set device into APX mode (how to: see first post)
See the folder "Final/nvflash" in "P880 nvFlash tool(Recovery tool).zip"
nvflash --help list all commands
read current partitions list from your device
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable pt.txt --go
after executing open pt.txt
partition list from pt.txt must be equil with list from flash.cfg
and backup all partitions using this command list
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 2 bct.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 3 pt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 4 ebt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 5 lge.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 6 eks.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 7 gp1.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 sos.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 9 lnx.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 10 app.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 11 cac.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 12 msc.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 13 usp.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 14 nva.img --go <--IMPORTANT!!!!! IMEI !!!!!
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 15 uda.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 16 drm.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 17 mlt.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 18 fot.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 19 cal.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 20 udb.img --go
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 21 gpt.img --go
copy twice all new .img files
after that return to "Final" folder and start Nvflash#1(encrypt).bat
PS: sorry for my english

Thanks @DJ_Asterix for sharing this with us. I am also looking for a long time to unbrick my LG. Maybe you offered me the solution.
Edit:
Could some pls get this nva partition for us? Also, if you do this please remove your IMEI from the NVA file (search/replace it with XXX or something else). Hopefully I can get my LG to life again.

i think i managed to dump my wife´s p880 NVA section, can anyone help how to edit out the imei?
---
edit:
just manage to edit it with the simple wordpad
here is the LINK
please post how to flash it to my phone.
i can´t flash it with any method, i tried them all, it always stops at 10% or some other error.
this method is my last hope.
thanx in advance

try flash NVA to your P880 using APX mode
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go

OMG, its back to life... but still dont have a baseband or imei. At least its progress... any ideias how to get back the imei and baseband. (yes i edited the NVA with my imei)
edit:
im trying to restore the other partitions but the command u gave its not working for the others.
for instance:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 2 bct.img --go
it gives error: command 15 NvError 0x120002
help!

xtribas said:
OMG, its back to life... but still dont have a baseband or imei. At least its progress... any ideias how to get back the imei and baseband. (yes i edited the NVA with my imei)
edit:
im trying to restore the other partitions but the command u gave its not working for the others.
for instance:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 2 bct.img --go
it gives error: command 15 NvError 0x120002
help!
Click to expand...
Click to collapse
for bct try to use command
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go

I think that WordPad not suitable for editing IMG files.
Use any HEX editor, for example "HxD Hex Editor" (searching it in network)
Please, "xtribas" , can you send me the NVA without editing from WordPad or edit it in HEX editor.

DJ_Asterix said:
I think that WordPad not suitable for editing IMG files.
Use any HEX editor, for example "HxD Hex Editor" (searching it in network)
Please, "xtribas" , can you send me the NVA without editing from WordPad or edit it in HEX editor.
Click to expand...
Click to collapse
Ok, just edited with hex editor replaced the imei with XXXX.
download here: LINK
I made a full backup of all the partitions of my wife´s p880 to flash to mine, ca u please make a small guide to flash all the partitions.
I ran the bat file from recovery tools folder and it installed the android ICS 4.0.3 again, and now i have a locked bootloader and cant flash with any KDZ or the DZ tool. It always stops at 10% or param 207 error.
thanx
---------- Post added at 05:19 PM ---------- Previous post was at 05:04 PM ----------
when i use "nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go"
it gives me error nvError 0x0

I have the same problem
KDZ or DZ flashing tool stop at 10 % with error 207
While flashing with KDZ or DZ tool, flash process contains from 2 steps....
1. Flashing HardWare info, BaseBand and other data from combined.fls from DZ file using IntelFlashUtil protocol
2. Flashing Boot, Recovery and System imeg's using nvflash util protocol (nv3p)
Stop at 10% take place at the first step. I don't know error reason ("it's magik").
I think the reason in lost IMEI, but it seem not truth (maybe)
I compared NVA which you editing with WordPad and last and they are differ.

xtribas said:
when i use "nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct bct.img --setbct --go"
it gives me error nvError 0x0
Click to expand...
Click to collapse
extract a flash.bct.encrypt from firmware DZ file which equl the firmware from second phone LGP880AT-00-V20b-HKG-XXX-MAR-27-2013+0
"http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW088386573210987654321/V20B_00.kdz"
TOOL "http://forum.xda-developers.com/showthread.php?t=2600575"
and flash it
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct flash.bct.encrypt --setbct --go

DJ_Asterix said:
extract a flash.bct.encrypt from firmware DZ file which equl the firmware from second phone LGP880AT-00-V20b-HKG-XXX-MAR-27-2013+0
"http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW088386573210987654321/V20B_00.kdz"
TOOL "http://forum.xda-developers.com/showthread.php?t=2600575"
and flash it
nvflash --blob blob.bin --bl bootloader.bin.encrypt --bct flash.bct.encrypt --setbct --go
Click to expand...
Click to collapse
thanx, tonight i will try this and post updates
---
edit
i tried to extract the dz and it gave me a error, not valid dz. tried to edit other dz too, same error.
maybe is a header error i dont understand.
If u can extract it please share the files with me

xtribas said:
thanx, tonight i will try this and post updates
Click to expand...
Click to collapse
Thanks for keeping us updated. I am really hoping to get my LG working again. It is already back to life but the IMEI is still missing. :-/

Guys,
the file NVA.img, starting offset 0x08. I still see a IMEI Nr (or is it a Bluetooth Nr?!). I have exchanged the Nr. with my IMEI number. Also, I searched for "XXXXXXX" and replaced all X's with my IMEI number (0x800). But what to do now?
I currently don't know the correct cmd to flash the nva partition, any help is appreciated.
Special request for @xtribas:
In case you get your device working again, could you - please! - remove all apps and account/imei settings from your recovered device, make a full backup as written in post #3 from @DJ_Asterix and provide the files zipped and uploaded to a hoster of your choice? That would be awesome. Thanks in advance!

GoodSoul said:
Guys,
the file NVA.img, starting offset 0x08. I still see a IMEI Nr (or is it a Bluetooth Nr?!). I have exchanged the Nr. with my IMEI number. Also, I searched for "XXXXXXX" and replaced all X's with my IMEI number (0x800). But what to do now?
I currently don't know the correct cmd to flash the nva partition, any help is appreciated.
Special request for @xtribas:
In case you get your device working again, could you - please! - remove all apps and account/imei settings from your recovered device, make a full backup as written in post #3 from @DJ_Asterix and provide the files zipped and uploaded to a hoster of your choice? That would be awesome. Thanks in advance!
Click to expand...
Click to collapse
we are still far away from a solution to this. if we find it, we will share it of course
to flash the nva partition use:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go
i used it but i did not get my imei or baseband back

xtribas said:
we are still far away from a solution to this. if we find it, we will share it of course
to flash the nva partition use:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --download 14 nva.img --go
i used it but i did not get my imei or baseband back
Click to expand...
Click to collapse
A likely solution to the problem is the Octopus Box LG Software. Perhaps some local GSM service is able to help.

ze7zez said:
A likely solution to the problem is the Octopus Box LG Software. Perhaps some local GSM service is able to help.
Click to expand...
Click to collapse
Spending 100€ on a box its out of my budget.... thanx anyway

xtribas said:
Spending 100€ on a box its out of my budget.... thanx anyway
Click to expand...
Click to collapse
No one you do not propose to purchase box.
You find the GSM service in your area, which has the box and the service does not have to be so expensive.

:crying:
I have tried a lot of diffrent combinations with NVA.img (thanks xtribas for original image) but device continiously did not want to see the IMEI.
The best result of this "circus" - flashers like LGFlashTool or official LGMobile Support Tool starts see the IMEI when i try reflash KDZ or try repair after update errors. But they still "freeze" on 10% when they try flash the radiomodule
May be IMEI on NVA partitions used only for support tools.
May be IMEI must be flashed in EEPROM of the RadioModul but it corrupted and we have the "hell loop" - we can not flash the EEPROM because the IMEI corrupted and we can not flash IMEI because EEPROM corrupted.

TF701T NvFlash Unbrick Solution(tested)

TF701T NvFlash Unbrick Solution(tested)
(continue of the threadhttps://forum.xda-developers.com/showthread.php?t=2655888)
Charge tab before unbricking.
Connect tab to PC.
If your tab not started already in APX mode, then run APX mode by pressing button combination Vol+ and Power.
Insall drivers from "usb_drivers" if needed.
If there is a problem with the installation of drivers, use Google to search- how to install unsigned drivers.
When device installed correctly run "tf701t_flash.bat".
If flash process interrupts with error like ...read\write error..., then probably EMMC memory chip is damaged and need to replace.
If flash process complete, then we ready to next step.
Prepare fat32 formatted microSD card.
Download from ASUS site update package.
https://www.asus.com/us/Tablets/The_New_ASUS_Transformer_PadTF701T/HelpDesk_BIOS/
It _MUST_ be Version V10.14.1.47, SKU(region)- of your choice.
The downloaded file will look like **_epaduser_10_14_1_47_UpdateLauncher.zip
There will be another archive inside that archive.
Extract it, and rename it to t4_sdupdate.zip
Put t4_sdupdate.zip in root of microSD card.
Insert microSD card in tab, then start tab in recovery mode by pressing Vol- and Power key combination.
Follow onscreen instructions to complete recovery process.
After all you tab must be restored to factory state JB Android.
Now you may update firmware version using OTA or sdcard.
NvFlash TF701T Unbrick
http://mega.nz/#!mk8k0Y5S!TQJVfcQudH9HIMnapiGZWccV3VvygnTjDWYLxJte4lo
mirror
http://smartjtagbox.com/owncloud/index.php/s/T8DKqDuhSZzffSp

What is this? A covert ad campaign for Mega? How about hosting the file somewhere that does not force you to download an app, open an account and all that cr***? I'd be really curious to see the code, but not like this.....
Sent from my TF700T using Tapatalk

berndblb said:
What is this? A covert ad campaign for Mega? How about hosting the file somewhere that does not force you to download an app, open an account and all that cr***? I'd be really curious to see the code, but not like this.....
Click to expand...
Click to collapse
Where did you see the ad or need to register, or requirement of install the program for downloading?
Just checking in IE and FF.
I see a big red button- "download", no ads, and no requirements.
Ok, for those who have problems with mega.nz added a mirror for download.

TF701t - Hard Reset Fails ...
Dear Community,
I wanted to hard reset my TF701t to delete my data and give it to another one.
But now it stucks in "deleting data" ... that endures a minute then a dead android is on the screen.
When I want to reboot it, the hard reset comes again and want to delete everything, but the dead android is coming back :/
I can't go in Recovery Mode (Volume-down + Power)
Connection to APX works but, see pic below ...
I don't know what I could try anymore ...
Hope somebody have an idea.
Best greetings,
Symbic
Bild -> url: ibb.co/iFP5JH
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Symbic said:
Dear Community,
I wanted to hard reset my TF701t to delete my data and give it to another one.
But now it stucks in "deleting data" ... that endures a minute then a dead android is on the screen.
When I want to reboot it, the hard reset comes again and want to delete everything, but the dead android is coming back :/
I can't go in Recovery Mode (Volume-down + Power)
Connection to APX works but, see pic below ...
I don't know what I could try anymore ...
Hope somebody have an idea.
Best greetings,
Symbic
Bild -> url: ibb.co/iFP5JH
Click to expand...
Click to collapse
Link to the picture is broken, so we cannot see what result you got...
What's your situation: Bootloader unlocked? Custom recovery? I guess not since you get the dead Android?

link to screenshot ok.
as i can see- problems begin after trying access to EMMC chip.
"Taking backup of EKS"
unfortunately with 90% certainty i can say that the EMMC chip damaged.

mr.bin said:
link to screenshot ok.
as i can see- problems begin after trying access to EMMC chip.
"Taking backup of EKS"
unfortunately with 90% certainty i can say that the EMMC chip damaged.
Click to expand...
Click to collapse
Can I do anything else to test the EMMC chip?

Symbic said:
Can I do anything else to test the EMMC chip?
Click to expand...
Click to collapse
In that state the EMMC chip can be tested with the special equipment like EasyJtag box.

Hello Mr Bin, registered an account just to say thank you...
You have no idea.. was helping a friend to update, but the guy who sold it(tf701) had bought it from different region and turned it to US, so we ended up hard bricking it.
Long story short, we hard bricked it.
Thank you for your hard work in making the fix, and a big THANK you for sharing it...
Perfect fix, its better than before because it got updated to .47 (we couldnt update, no OTA no manual, too old version for custom recoveries)
Again.. thanks :good::good:

Thanks.
But, after clicking to RCK, shows Android with blue procesing line and after few seconds android with open door and red triangle !. After few minutes bootloop....nothing more.
What can i doing again?

Wow! It's back!
Hi.
First of all: Thank you very much! I was sure my tablet was a goner... It is actually back. One tip I'd like to add: I had to try around a bit to get into APX mode. But essentially I just had to connect the tablet to my PC and then push "Volume up" and power at the same time - and ignore that the screen did not light up ...
Again: Thanks a lot!

Mr.Bin,
You have resurrected my TF701T! Thank you SOOOO MUCH! You are an actual genius! Thanks!

Help w installation
I have the same problems although i have not installed any custom OS but after few months of not using it didnt load up and ended in APX mode.
Tried this solution, installed the driver, started the .bat file and ended up here :
Nvflash 3.08.1704 started
Using blob 3.08.1704
chip uid from BR is: 0x600000015c3e10080c000000190301c0
rcm version 0X350001
Skipping BoardID read at miniloader level
System Information:
chip name: unknown
chip id: 0x35 major: 1 minor: 2
chip sku: 0x3
chip uid: 0x000000015c3e10080c000000190301c0
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
board id: 0
warranty fuse: 0
dk burned: true
boot device: emmc
operating mode: 6
device config strap: 0
device config fuse: 17
sdram config strap: 0
RCM communication completed
sending file: flash.bct
- 8192/8192 bytes sent
flash.bct sent successfully
BCT sent successfully
odm data: 0x82098000
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.bin
data send failed NvError 0x120002
command failure/warning: bootloader download failed (bad data)
I would be very thankful for any information you could read from this. Just would like to know if i even have a chance of getting it back on.

So, I was running fine with CROMi-X KitKat, but wanted to upgrade to Marshmallow (to install sw not supported in KitKat), so decided to try KatKiss 6.0. It's been years since I've played with flashing ROMs, but I did a little reading to refresh my memory. Then I rebooted into recovery (ClockworkMod), backed everything up, then wiped everything, formatted /data, and tried flashing the KatKiss zip file. At that point, it just sat there forever at the ASUS logo screen:
I've tried several times to boot back into recovery by holding the Vol+ and Power buttons, but it either doesn't boot, or boots to the above screen. I've connected it to my Mac w/ the Android SDK Platform Tools, but adb doesn't see any device listed. [I've got an old Windows laptop (XP?)] I could use if it will do something the Mac can't.]
Any advice on how I can save this tablet?

This method can be apply to tft300t?

Hi! What a great thread! After lurking on this forum for many years, i've registered to expose my issue with an old tf701 that was given to me by a friend. He say me he installed esexplorer and deleted file to clean space. Next day he rebooted and never been able to boot system. Now tablet is in bootloop ending with blackscreen and backlight on. Im able to open in fastboot and talk with minimal adb and fastboot. RCK update ending with fallen robot, Wipe data/cache ending with fallen robot. APX mode also working and ive run mr.bin's Nvflash unbrick tool with this result:
Nvflash 3.08.1704 started
Using blob 3.08.1704
chip uid from BR is: 0x600000015c3e10060400000001058440
rcm version 0X350001
Skipping BoardID read at miniloader level
System Information:
chip name: unknown
chip id: 0x35 major: 1 minor: 2
chip sku: 0x3
chip uid: 0x000000015c3e10060400000001058440
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
board id: 0
warranty fuse: 0
dk burned: true
boot device: emmc
operating mode: 6
device config strap: 0
device config fuse: 17
sdram config strap: 1
RCM communication completed
sending file: flash.bct
- 8192/8192 bytes sent
flash.bct sent successfully
BCT sent successfully
odm data: 0x82098000
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.bin
| 1463232/1463232 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
Taking backup of EKS
Receiving file: EKS_0400000001058440.bin, expected size: 4194304 bytes
/ 4194304/0 bytes received
file received successfully
Taking backup of PER
Receiving file: PER_0400000001058440.bin, expected size: 8388608 bytes
/ 8388608/0 bytes received
file received successfully
Taking backup of ABT
Receiving file: ABT_0400000001058440.bin, expected size: 4194304 bytes
/ 4194304/0 bytes received
file received successfully
Continuing create using flash.cfg
setting device: 2 3
deleting device partitions
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: DFI
creating partition: BMP
creating partition: ABT
creating partition: GP1
creating partition: SOS
creating partition: DTB
creating partition: LNX
creating partition: APP
creating partition: CAC
creating partition: APD
creating partition: ADF
creating partition: MSC
creating partition: USP
creating partition: PER
creating partition: CRA
creating partition: MDA
creating partition: EKS
creating partition: UDA
creating partition: GPT
sending file: bootloader.bin
| 1463232/1463232 bytes sent
bootloader.bin sent successfully
sending file: xusb_sil_rel_fw
- 126464/126464 bytes sent
xusb_sil_rel_fw sent successfully
sending file: ABT_0400000001058440.bin
/ 4194304/4194304 bytes sent
ABT_0400000001058440.bin sent successfully
sending file: recovery.img
\ 7272704/7272704 bytes sent
recovery.img sent successfully
sending file: boot.img
- 6760704/6760704 bytes sent
boot.img sent successfully
sending file: PER_0400000001058440.bin
/ 8388608/8388608 bytes sent
PER_0400000001058440.bin sent successfully
sending file: EKS_0400000001058440.bin
/ 4194304/4194304 bytes sent
EKS_0400000001058440.bin sent successfully
failed executing command 26 NvError 0x120002
command failure/warning: sync failed (bad data)
bootloader status: Bct Write Failed (code: 22) message: nverror:0x40005 (0x14000
5) flags: 0
Click to expand...
Click to collapse
Advise would be great help. I dont know if mmc could be dead, it showing some successful tranfert but keep failing at same place. Thanks!

Hello. These commands for nvflash make a backup and installation of the system.
REED
@cls
@nvflash.exe --blob blob.bin --bl bootloader.bin --read 9 recovery.img --read 11 boot.img --read 12 system.img
@pause
WRITE
@cls
@nvflash.exe --blob blob.bin --bl bootloader.bin --download 9 recovery.img --download 11 boot.img --download 12 system.img
@pause
Thanks mr.bin for a great tool

Important information who uses nvflash!
3 files (ABTxxxxxxxxxxxxxxxx.bin, EKS_xxxxxxxxxxxxxxxx.bin, PER_xxxxxxxxxxxxxxxx.bin, which are created after running nvflash, must be flashed again. Otherwise, it will be impossible to unlock the tablet again and the serial number will be lost. Save in a safe place and then rename the files to EKS, ABT, PER.
To do this, create a second file with the bat extension. In a text editor, type these lines
Code:
nvflash --wait --blob blob.bin --bl bootloader.bin --download 7 ABT --download 21 EKS --download 18 PER --go
If these files are saved on the unlocked tablet, then after their firmware unlocking will be restored.
Also, using nvflash, you can resize partitions, flash a bootloader with file system markup, recovery.

There is no way to load an unlocked bootloader in this process ??

[TUTORIAL] How to unbrick Nexus 7 without blob.bin (REQUIRES ANOTHER NEXUS 7 2012)

Thanks to @Jirmd for letting me use his post as a reference.
Original post: https://forum.xda-developers.com/nexus-7/general/unbrick-nexus-7-tegra-3-device-t4078627
Alternative Method:
1. https://github.com/tofurky/tegra30_debrick
2. https://forum.xda-developers.com/t/...-without-another-n7-or-tegra30-device.4305955
(Both methods do not require another Nexus 7)
Requirements:
1. Linux-based OS (I use Ubuntu 18.04)
2. NvFlash and Wheelie (You can download the Linux version down below)
3. A USB cable (A good and sturdy one)
4. Nerve of steel lol
5. Must have APX driver installed.
6. Another Nexus 7 (Ask someone that have it or ask me)(MUST BE ROOTED AND HAVE TWRP RECOVERY INSTALLED)
7. ADB (platform-tools)
1. DUMP SBK VIA USB
Step 1: Download fusee-launcher for Nexus 7 from this link and extract it to a folder:
http://www.mediafire.com/file/sgwsa79idk24z8u/fusee-launcher-n7.zip/file
Step 2: Open a terminal inside of the folder then type:
Code:
sudo apt-get install python-usb python3-usb
Wait for it to complete. After that, type:
Code:
pip install pyusb
Step 3: Connect your device to a USB 3.0 port (REQUIRED). You can check for connection using "lsusb". There must be a "NVidia Corp" in the list.
Step 4: Type:
Code:
sudo ./fusee-launcher.py –tty dump-sbk-via-usb.bin
Something like this should appear:
Code:
05f4a5d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x00004de0
overwrite_payload_off: 0x00004de0
payload_second_length: 0x0000c7b0
b'00a0004000300040e04d0000b0c70000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'
Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x00000000
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 73728 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
txing 4096 bytes (20480 already sent) to buf[1] 0x40005000
txing 4096 bytes (24576 already sent) to buf[0] 0x40003000
txing 4096 bytes (28672 already sent) to buf[1] 0x40005000
txing 4096 bytes (32768 already sent) to buf[0] 0x40003000
txing 4096 bytes (36864 already sent) to buf[1] 0x40005000
txing 4096 bytes (40960 already sent) to buf[0] 0x40003000
txing 4096 bytes (45056 already sent) to buf[1] 0x40005000
txing 4096 bytes (49152 already sent) to buf[0] 0x40003000
txing 4096 bytes (53248 already sent) to buf[1] 0x40005000
txing 4096 bytes (57344 already sent) to buf[0] 0x40003000
txing 4096 bytes (61440 already sent) to buf[1] 0x40005000
txing 4096 bytes (65536 already sent) to buf[0] 0x40003000
txing 4096 bytes (69632 already sent) to buf[1] 0x40005000
txing 4096 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
b'4445414442454546'
DEADBEEF
b'3030303030303030'
00000000
b'3030303030303030'
00000000
b'3034303030303930'
04000090
b'4634314330433241'
F41C0C2A
b'3133333731333337'
13371337
b'3535353535353535'
55555555
b'3430303033303030'
40003000
b'3430303035303030'
40005000
b'4141414141414141'
AAAAAAAA
b'3131313131313131'
11111111
b'3030303030303236'
00000026
b'3232323232323232'
22222222
b'68656c6c6f2c20776f726c640a00'
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'
Traceback (most recent call last):
File "./fusee-launcher.py", line 823, in <module>
buf = switch.read(USB_XFER_MAX)
File "./fusee-launcher.py", line 530, in read
return self.backend.read(length)
File "./fusee-launcher.py", line 134, in read
return bytes(self.dev.read(0x81, length, 3000))
File "/usr/local/lib/python3.6/dist-packages/usb/core.py", line 988, in read
self.__get_timeout(timeout))
File "/usr/local/lib/python3.6/dist-packages/usb/_debug.py", line 60, in do_trace
return f(*args, **named_args)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 833, in bulk_read
timeout)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 936, in __read
_check(retval)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 595, in _check
raise USBError(_strerror(ret), ret, _libusb_errno[ret])
usb.core.USBError: [Errno 110] Operation timed out
Search for the line "hello, world" inside of your log. It looks like this in this example:
Code:
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'
The last 8 characters are not your SBK. This is the first 8 numbers of your Device ID. Delete this and delete the b' at the start and also the ' at the end.
The result should look like this:
Code:
e57de3bab6cb499d874d5772cb219f01
Congratulation, you have successfully dump your device SBK via USB.
2. GETTING YOUR CPU UID
Step 1: Download Wheelie and NvFlash then extract it to a folder.
Step 2: Download this broken blob.bin file (REQUIRE)
http://www.mediafire.com/file/32cxvjv2wajokqf/blob.bin/file
Then place it inside of the Wheelie and NvFlash folder.
Step 3: Open a terminal inside of the folder then type:
Code:
./wheelie --blob blob.bin
After that, something like this should appear:
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
[=] Chip UID: 0x98254853062001158
[-] Incorrect SBK or SBK type selected. nverror: 0x4.
Search for "Chip UID", remove the "0x" at the beginning. The result should look like this:
Code:
98254853062001158
Congratulation, you got your chip UID
3. GENERATE BLOB FILES USING ANOTHER NEXUS 7
Step 1: Download MkNvfBlob from this link:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/precompiled/precompiledN7.tar.xz
Note: Extract this to your Nexus 7.
Step 1.1: Reboot into TWRP recovery.
Step 2: Open a terminal inside of you ADB folder then type:
Code:
adb shell
After that:
Code:
su
Type this command after that:
Code:
mkdir /AndroidRoot
Last one:
Code:
cat /proc/cpuinfo > /AndroidRoot/cpuinfo
Pull the cpuinfo file using this command:
Code:
adb pull /AndroidRoot
Note: You could copy your cpuinfo file to your PC using MTP (IDK how to do this so search Google lol)
Open your ADB folder and there should be a AndroidRoot folder with a cpuinfo file inside of it.
Open cpuinfo using a Text Editor. Something like this should be inside:
Code:
Processor : ARMv7 Processor rev 9 (v7l)
processor : 0
BogoMIPS : 1993.93
processor : 1
BogoMIPS : 1993.93
processor : 2
BogoMIPS : 1993.93
processor : 3
BogoMIPS : 1993.93
Features : swp half thumb fastmult vfp edsp neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 9
Hardware : grouper
Revision : 0000
Serial : 015d4a5f202c0401
Replace the Serial line with your Chip UID.
After that, place the cpuinfo file back to the /AndroidRoot folder on your device using this command:
Code:
adb push AndroidRoot /
After you are done, don't close the ADB windows.
Step 3: Download bootloader.xbt:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bootloaders/bootloader.grouper.XBT
And BCT for your device:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bct/n7.bct
And copy these two files to the /AndroidRoot folder on your device.
Step 4: Type this command on the ADB windows:
Code:
cd /AndroidRoot
After that, type:
Code:
chmod 777 ./mknvfblob
After that, type:
Code:
./mknvfblob -W -K <your SBK> --blob /AndroidRoot/test.blob --bctin /AndroidRoot/n7.bct --bctr /AndroidRoot/testr.bct --bctc /AndroidRoot/testc.bct --blin /AndroidRoot/bootloader.grouper.XBT --blout /AndroidRoot/test.ebt
Wait for it to do its job.
After that, go to your /AndroidRoot folder and copy all the file that just got generated (testr.bct, testc.bct. test.ebt, test.blob) to your PC using the adb pull command on Step 2
Congratulation, you have successfully generate blob for your bricked device.
4. UNBRICK YOUR DEVICE (The fun part )
Step 1: Boot your bricked device into APX mode either using Power button or Power + Vol UP.
Step 2: Open a terminal inside of the folder where you place your NvFlash folder (move the blob file inside of that folder, all of them)
Step 3: Open a terminal inside of your Wheelie and NvFlash folder. Type:
Code:
sudo ./nvflash --bl test.ebt --bct testr.bct --blob test.blob
If you got this command:
Code:
command error: no command found
Then try this one instead:
Code:
./nvflash --setbct --create --configfile <your flash.cfg> --bl test.ebt --bct testr.bct --blob test.blob
If you got the NvError, its fine.
Something like this should appear (the first command):
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000
chip uid from BR is: 0x0000000000000000015d2bc285340e0f
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2bc285340e0f
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: recovery.bct
- 6128/6128 bytes sent
recovery.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.ebt
- 2146912/2146912 bytes sent
bootloader.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
A Google Logo should appear on your device screen with the text "Battery is too low" on the upper left corner. Unplug the battery and replug it. After that, plug it into a wall charger for atleast 4 hour.
Step 4: Unplug the battery and boot into APX mode again using the button combination.
Step 5: Type this command while holding down the Vol DOWN button:
Code:
sudo ./nvflash --resume --download 8 boot.img
Replace "boot.img" with your ROM boot.img file. If you download another boot.img that isn't for your ROM, your device will bootloop.
Step 6:
Type:
Code:
sudo ./nvflash --resume --download 4 bootloader.img
Replace "bootloader.img" with your bootloader.img file name (You could get it inside of the Factory Image)
And after its done, your device should technically unbrick now. But I still recommend you re-flash stock ROM.
Step 7: The final step
Boot into your OS using the command below:
Code:
sudo ./nvflash --resume --go
If your device boot back into APX mode, maybe you have done something wrong. Try again.
If you got a Google logo on your device then congratulation! Your device is now unbricked.
Note: If step 7 didn't work, try booting this recovery image using this command:
Code:
fastboot boot flatline_grouper.img
Link for the recovery image is in the "Links" section.
Note: To get into Fastboot, add the "--go" line at the end of the command in Step 5
Code:
sudo ./nvflash --resume --download 8 boot.img --go
HOLD DOWN VOL DOWN while doing this command, you should get into fastboot at
After you are in the Flatline recovery, navigate to the "Advanced" section using the VOL buttons. Select it using the POWER button.
Select the "wheelie" at the end of the list.
Select "I agree".
After that, select "Step 1: Flash AndroidRoot.mobi custom bootloader." IGNORE Step 2 because it won't gonna work anyways.
Your device should reboot and the Google logo should appear, that means that your device is unbricked.
Note: If you wanted to flash stock ROM, open the "image-*******.zip" inside of the factory image and open the android-info.txt file. Edit the "require-bootloader" line to "4.13". After that, it should work.
Links:
flash.cfg: http://www.mediafire.com/file/j90hc1dfz58aytq/flashcfg.zip/file
flatline_grouper.img: https://www.mediafire.com/file/z1jvgy6km33f7bf/flatline_grouper.img/file
Wheelie, NvFlash and platform-tools (For ADB) (Works for both Linux and Windows): https://www.mediafire.com/file/0nuy4indgvagq3v/nvflash-and-platformtool.zip/file
Download the Factory Image for your Nexus 7 incase you want to re-flash stock ROM (nakasi or nakasig): https://developers.google.com/android/images#nakasi
That is. If you need any help, message me.
Update: After a few days of troubleshooting, fixing and updating my post, it seems like the step to unbrick your Nexus 7 2012 may depends on how did you brick it, what OS version you are running or the condition of your device. So you may have to "think outside the box" sometimes in this guide.
Update #2: Some helpful advice from @Jirmd with some minor change:
When you get this error :
Code:
Nvflash v1.10.76762 started
Using blob v1.13.00000
chip uid from BR is: 0x0000000000000000015d4a5f202c0401
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d4a5f202c0401
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 2
device config fuse: 17
sdram config strap: 1
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0
after this command :
Code:
./nvflash --configfile flash.cfg --create --bct testr.bct --setbct --bl test.ebt --blob test.blob --sync
Probably you have broken your internal storage!
You can probably flash:
Bootloader image (bootloader.img)
Kernel image (boot.img)
Recovery image (recovery.img aka TWRP)
But you CAN'T flash a new system via TWRP or fastboot, because the bootloader or the recovery was unable to connect to the partitions table.
You can try this command to erase bad blocks:
Code:
./nvflash --resume --configfile flash.cfg --obliterate
Reboot to APX mode and try the above command again.
But, broken internal storage is pretty much unrepairable.
There is some possibility of disassembly your device and overheat your memory IC, but this method is not easy and need more technical skill.
And in my case this did not help.
Click to expand...
Click to collapse
In my case, this command also gives me the nverror 0x4 but it also did something to my Nexus 7 as it was required for the next step.
Update #3: Updated the guide and removed some unessacery steps.
Update #4: Updated.

Hi, enderzip...
I've been keeping track of the recent developments regarding bricked Nexus 7's, APX mode and nvFlash, here on XDA. There's currently quite a few threads on this topic.
As I understand it, you've been motivated by a desire to recover data from your bootloader bricked Nexus 7. So my question is simple...
'Have you been successful?'
Have you actually resurrected a bricked Nexus 7 with no functioning bootloader AND with no originally created flatline wheelie blobs?
If so, you have done what I thought could not be done! I tip my hat to you, with your tenacity and your technical understanding of the complex issues involved.
If I had a Linux system myself, I'd be half-minded to dig out my old Nexus 7, deliberately bugger up the bootloader, and follow your instructions for the sheer technical challenge!
--------------------------------------
Some general thoughts...
The Nexus 7 is old (c.2012), and likely not many people use it anymore, but that's not what's important here. What is important is the persistence, the huge technical ability, and the sheer bloody minded refusal ~ by some ~ to let their Nexus 7 die... to go into what the poet Dylan Thomas called that 'good night'...
"Do not go gentle into that good night,
Old age should burn and rave at close of day;
Rage, rage against the dying of the light."
https://poets.org/poem/do-not-go-gentle-good-night
And in so doing, mayhap enderzip and others, have provided potential clues for other devices, other hardware, other phones or tablets, when faced with similar hard brick problems. One can but hope.
The above post by enderzip is technically way beyond me, and I have no immediate use for it, but it's a fundamental distillation of everything XDA stands for - namely, experimentation and creativity.
It's basically, amazing!
Thanks enderzip
Rgrds,
Ged.

Hello Enderzip,
Thank you so much for this very good an detailed tuto.
I followed cautiously your instructions but I am blocked @ step 3.
The command "mkdir /AndroidRoot" returns "mkdir : '/AndroidRoot' : Read-only file system".
I suspect Android system partition as read only but does know way to change.
I would appreciate your clever support.
Thank you in advance.
Envoyé de mon Nexus 4 en utilisant Tapatalk

zak4 said:
Hello Enderzip,
Thank you so much for this very good an detailed tuto.
I followed cautiously your instructions but I am blocked @ step 3.
The command "mkdir /AndroidRoot" returns "mkdir : '/AndroidRoot' : Read-only file system".
I suspect Android system partition as read only but does know way to change.
I would appreciate your clever support.
Thank you in advance.
Envoyé de mon Nexus 4 en utilisant Tapatalk
Click to expand...
Click to collapse
You could manually create the folder if you have root. By using those Root File explorer on Google Play Store.
I recommend you using this one: https://play.google.com/store/apps/details?id=com.clearvisions.explorer
Open the app then go to the root section, create a new folder name: AndroidRoot
And you are good to go.
If the above method didnt work, type these command one by one:
Code:
adb shell
su
mount -o rw,remount /system
You can mount your /system back to Read-Only using this command:
Code:
mount -o ro,remount /system

GedBlake said:
Hi, enderzip...
I've been keeping track of the recent developments regarding bricked Nexus 7's, APX mode and nvFlash, here on XDA. There's currently quite a few threads on this topic.
As I understand it, you've been motivated by a desire to recover data from your bootloader bricked Nexus 7. So my question is simple...
'Have you been successful?'
Have you actually resurrected a bricked Nexus 7 with no functioning bootloader AND with no originally created flatline wheelie blobs?
If so, you have done what I thought could not be done! I tip my hat to you, with your tenacity and your technical understanding of the complex issues involved.
If I had a Linux system myself, I'd be half-minded to dig out my old Nexus 7, deliberately bugger up the bootloader, and follow your instructions for the sheer technical challenge!
--------------------------------------
Some general thoughts...
The Nexus 7 is old (c.2012), and likely not many people use it anymore, but that's not what's important here. What is important is the persistence, the huge technical ability, and the sheer bloody minded refusal ~ by some ~ to let their Nexus 7 die... to go into what the poet Dylan Thomas called that 'good night'...
"Do not go gentle into that good night,
Old age should burn and rave at close of day;
Rage, rage against the dying of the light."
https://poets.org/poem/do-not-go-gentle-good-night
And in so doing, mayhap enderzip and others, have provided potential clues for other devices, other hardware, other phones or tablets, when faced with similar hard brick problems. One can but hope.
The above post by enderzip is technically way beyond me, and I have no immediate use for it, but it's a fundamental distillation of everything XDA stands for - namely, experimentation and creativity.
It's basically, amazing!
Thanks enderzip
Rgrds,
Ged.
Click to expand...
Click to collapse
Yes, I have successfully unbrick my Nexus 7 WITHOUT any type of blob file i have generated before.
And no, you should thank @Jirmd instead of me. If he didn't post his thread, my Nexus is still probably a paperweight.

Deleted.

@enderzip
Thank you Enderzip. I succeeded the creation of AndroidRoot with the command for write permission on system.
I have another issue about extraction of SBK of my bricked Nexus 7. I prepared everything (download of fusee-launcher, pyusb installation ...), checked connection of my device through APX (see below) but when I type sudo ./fusee-launcher.py –tty dump-sbk-via-usb.bin I got :
[email protected]:~/Downloads/fusee-launcher-n7$ lsusb
Bus 002 Device 096: ID 058f:6362 Alcor Micro Corp. Flash Card Reader/Writer
Bus 002 Device 061: ID 0955:7330 NVIDIA Corp.
Bus 002 Device 004: ID 046d:0805 Logitech, Inc. Webcam C300
Bus 002 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
...
[email protected]:~/Downloads/fusee-launcher-n7$ sudo ./fusee-launcher.py --tty dump-sbk-via-usb.bin
sudo: ./fusee-launcher.py : command not found
Sorry to be blocked again.

@enderzip
I found a solution to my issue by allowing the "execution of the file as program" in the permissions of fusee-launcher.py file.
Fusee-launcher started but quickly stopped before application stack dumping : message delivered by fusee-launcher is to use USB 3.0 and I realized that I have only USB 2.0 on my old desk computer.
Does someone know how to patch EHCI driver ? Is it a possible solution ?
Thanks for your advice.

enderzip said:
Yes, i have successfully unbrick my Nexus 7 WITHOUT any type of blob file i have generated before.
And no, you should thank @Jirmd instead of me. If he didn't post his thread, my Nexus is still probably a paperweight.
Click to expand...
Click to collapse
enderzip, wow, you soo good and cool. I am totaly glad for this, how you make your tutorial. And we must give thanks for AndroidRoot team and Jenkinsen. Without this people, we all have only paperweight.
Now, i will try make my moded mknvfblob worked standalone. Without Tegra 3, only on linux X86 PC.
And, i will try make tutorial for nexus 7 , how boot linux from usb, without multiboot. ( For case, when is your internal storage totaly unreparable damaged.)

Deleted.

Thank you Enderzip. I will follow your advice and buy a USB 3.0 PCI Express card and try later.
Again many thanks to you and Jmrd for your tutorial that will enable us to revive our bricked Nexus 7.
Envoyé de mon Nexus 4 en utilisant Tapatalk

I know this might be a stupid question, but what is the boot.img at step 6? The grouper factory image contains a "bootloader-grouper-4.23.img" and a zip containing a "boot.img", I guess that's the file we should flash?

gormatrax said:
I know this might be a stupid question, but what is the boot.img at step 6? The grouper factory image contains a "bootloader-grouper-4.23.img" and a zip containing a "boot.img", I guess that's the file we should flash?
Click to expand...
Click to collapse
The boot.img is inside the .zip inside of the factory image. I think the name is "image-nz---.zip"

Step 5 works and returns the same as in the guide, the tablet shows the google logo, without the battery too low in the corner.
However, at step 6, i get this:
Code:
Nvflash v1.13.87205 started
[resume mode]
command failure: Error querying partition type (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0
what should i do?
edit: for good measure this is the result from step 5:
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000iles ┼§˛■q
chip uid from BR is: 0x0000000000000000015d25689b3c1019
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d25689b3c1019
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0

@enderzip thank you so much for this detailed guide. Now I was able to generate the image (blobs) myself. When flashin the images (blobs), both the ones generated by you and the ones generated by me, following error is received... Could you help on this?
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
Waiting for device in APX mode...
[=] Chip UID: 0x15d16897a500403
[=] RCM Version: 0x30001
[=] CPU Model: Tegra 3
[+] Sending bootloader...
[-] Error 3 sending command
Thanks Steffen

gormatrax said:
Step 5 works and returns the same as in the guide, the tablet shows the google logo, without the battery too low in the corner.
However, at step 6, i get this:
Code:
Nvflash v1.13.87205 started
[resume mode]
command failure: Error querying partition type (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0
what should i do?
edit: for good measure this is the result from step 5:
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000iles ┼§˛■q
chip uid from BR is: 0x0000000000000000015d25689b3c1019
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d25689b3c1019
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0
Click to expand...
Click to collapse
In this case, uss this command instead:
Code:
sudo ./nvflash --setbct --create --configfile <flash.cfg file name> --resume --download 8 boot.img --go
It may or may not work.

enderzip said:
In this case, uss this command instead:
Code:
sudo ./nvflash --setbct --create --configfile <flash.cfg file name> --resume --download 8 boot.img --go
It may or may not work.
Click to expand...
Click to collapse
It doesn't work, it says that --resume must be first in the command. I moved it to the front, but then it said that it needed the bct file:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
bct file required for this command
command failure: create failed
I tried passing the testr.bct to it, but it looks even worse:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --bct testr.bct --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
failed executing command 12 NvError 0x120002
command failure: create failed (bad data)
bootloader status: module is in invalid state to perform the requested operation
(code: 4) message: nverror:0x8 (0x8) flags: 0
When executing each command, the tablet was showing the Google logo, after performing part 4 step 4.
Note that I also get the error that @steffenm82 is getting when running
Code:
wheelie --blob test.blob
, however that didn't stop the next step from working...

gormatrax said:
It doesn't work, it says that --resume must be first in the command. I moved it to the front, but then it said that it needed the bct file:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
bct file required for this command
command failure: create failed
I tried passing the testr.bct to it, but it looks even worse:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --bct testr.bct --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
failed executing command 12 NvError 0x120002
command failure: create failed (bad data)
bootloader status: module is in invalid state to perform the requested operation
(code: 4) message: nverror:0x8 (0x8) flags: 0
When executing each command, the tablet was showing the Google logo, after performing part 4 step 4.
Note that I also get the error that @steffenm82 is getting when running
Code:
wheelie --blob test.blob
, however that didn't stop the next step from working...
Click to expand...
Click to collapse
Hmm, have you tried switching the USB port? Maybe the USB cable too.

steffenm82 said:
@enderzip thank you so much for this detailed guide. Now I was able to generate the image (blobs) myself. When flashin the images (blobs), both the ones generated by you and the ones generated by me, following error is received... Could you help on this?
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
Waiting for device in APX mode...
[=] Chip UID: 0x15d16897a500403
[=] RCM Version: 0x30001
[=] CPU Model: Tegra 3
[+] Sending bootloader...
[-] Error 3 sending command
Thanks Steffen
Click to expand...
Click to collapse
Sorry for my late reply, in this case, try skipping to the next step.

I must say that @enderzip guide make my nexus 7 back on it´s feet despite not having previously generated blobs. After some days of research and some nights via PM and FB messenger he managed to bring my Nexus back on. So Yes @GedBlake he managed to unbrick a nexus 7 with no previous generated blobs. But the mentor of this tutorial was @Jirmd. In adittion, thanks to this 2 wonderful persons that make my Nexus 7 back to it´s gold years!!!