Database Develop

Trinity bootloader

i'm using the hermes/artemis reference to see what works and not
first: almost every other commands give the "Command Error"
the wdata exists and gives: Command is Locked!
The first thing will be to get into the radio bootloader - seems that the password is fixed. As far as the bootloader I hope that it can be downgraded.
---
info 2:
HTCSHTC__102Ã;¿HTCE
info 3:
HTCST
info 4:
IsAllBytesTheSame-: dwLength=8, bResult=0
HTCSHTC__102Ã;¿HTCE
info 6:
HTCST ÚÈÒHTCE
info 7:
HTC Integrated Re-Flash Utility, Common Base Version : 1.51b
Device Name: TRIN100, Bootloader Version : 1.06.0000
Built at: Oct 19 2006 20:31:29
Copyright (c) 1998-2006 High Tech Computer Corporation
CPU ID=0x41129200
Main CPLD version=0xA
Main Board version=0x5
info 8:
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x18700
Partition[3], type=0x4, start=0x1B700, total=0x1F100
CE Total Length(with sector info) = 0x37BB800
CE CheckSum Length(without sector info) = 0x36E0000
-----
task 32 : Level FF
-----
checkimage
IPL CRC checksum = 0x96BE3C47
SPL CRC checksum = 0xBA45D40C
CE CRC checksum = 0xE86D6EC6
ExtROM CRC checksum = 0x3FBE8D13
Radio Image CRC checksum = 0xAB599ED8
-----
progress - shows bar

SD Upgrade
I tried the SD upgrade method.
I placed an nbh file on it called TRINIMG.nbh but after cheking gaves me "NOT ALLOW" 00028002
Any ideea ?

As your seclevel is FF, the CID on the NBH should be the same on your device. info 2 shows your CID = HTC__102 (HTC Germany), so you need to put an HTC german rom in the TRINIMG.nbh file or CID unlock your device.
Nice work on the bootloader

I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
getdevinfo
ResetDevice
progress
ruustart
rbmc
password
info
task
emapi
btrouter
wdata
lnbs
erase
checkimage
checksum
wdata
wdatah
Click to expand...
Click to collapse
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?

pof said:
I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?
Click to expand...
Click to collapse
excellent. i'm in office only with my trusted Universal (i'll fill up all the info tonight).

from artemis Wiki:
Artemis Bootloader Password
Seems that artemis bootloader password is static: BsaD5SeoA
If you enter this password in mtty terminal, you may not be able to boot device into Windows, only in bootloader. Be carefull.
It's meaning that Artemis has the same bootloader (or similar) with trinity.
The question: why it cannot get out from the bootloader ??

decebal said:
It's meaning that Artemis has the same bootloader (or similar) with trinity.
Click to expand...
Click to collapse
No, if you compare SPL they are very different one from the other.
Trinity's SPL is more similar to Hermes SPL, but Artemis SPL is different.
decebal said:
The question: why it cannot get out from the bootloader ??
Click to expand...
Click to collapse
probably you just need to 'set 14 0' or hard reset to go back to OS, I don't know... the wiki edit was done by fdp24, he can probably explain

pof said:
I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?
Click to expand...
Click to collapse
Cmd>getdevinfo
GetDevInfo: Get CID OK
HTCSTRIN100HTCE
--
Reset Device - works
--
Progress - works
--
ruustart - blocked - hard reset needed
--
rbmc - not working
--
password works with the password BsaD5SeoA
--
info - works as in wiki
--
task - works as in wiki
--
emapi and btrouter - blocks the device
--
wdata - works with the password provided
--
lnbs - not working
--
erase - working
HTCST ÚÈÒHTCE
--
checkimage - working as in wiki
--
checksum - seems working
--
wdatah - not working

seems that the 1.06 is somehow limited as bootloader. how can we get the 1.04 or other upgrade solution ??
thanks

Nice work on the wiki decebal
Answers to your comments:
rbmc and lnbs - probably only work on SuperCID devices.
emapi and btrouter - I think it switches to wlan or bluetooth and disables USB connection.
wdata and wdatah - In hermes wdatah is for flash NBH and wdata for flash NBF in preproduction devices. Have you captured a full ROM upgrade using USB monitor?? which one it uses the RUU? Probably it has a dynamic password which enables wdatah for NBH files. Does 'info 3' works as in Hermes (you need to watch usb monitor output, can't see in mtty generally).
decebal said:
seems that the 1.06 is somehow limited as bootloader. how can we get the 1.04 or other upgrade solution ??
Click to expand...
Click to collapse
Generally by flashing a ROM matching your CID with bootloader 1.04.

rbmc is not in spl in Artemis device. On Trinity probably too.
These are some commands for Artemis:
Could be similarity for Trinity
CASE SENSITIVE!
Cmd>fm
Wrong parameters of FM Command!!
Usage:
fm [command] [frequency]
where:
if[command] = i Initialize FM.
if[command] = o Power on FM.
if[command] = f Power off FM.
if[command] = t Tune FM channel to [frequency].
if[command] = a FM auto seek test.
if[command] = m Mono(1) or Stereo(0).
if[command] = v Volume (0x00 - 0x0F).
if[command] = u Mute(0)
if[command] = g AGC(1)
if[command] = h Set seek threshold (0x00 - 0xFF).
if[command] = s Seek Up(1) or Down(0).
if[command] = r Get RSSI (0x00 - 0xFF).
if[command] = c Get current channel [frequency].
if[command] = d Get RDS data (1 - 10 groups of data).
*****************************************************************************************************
Cmd>cpldver
xsvfExecute - CpldType=1
SUCCESS - Completed XSVF execution.
CPLD Ver[0]=1
CPLD Ver[1]=FC
CPLD Ver[2]=26
CPLD Ver[3]=5
SetDsbDBGMSGT
Unknown yet.
*****************************************************************************************************
Cmd>ReadExtROM
Dump Ext ROM to MTTY terminal
*****************************************************************************************************
Cmd>WLANReset
Usage:
WLANReset 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>WLANReset 0
WLANReset(FALSE)
Cmd>WLANReset 1
WLANReset(TRUE)
*****************************************************************************************************
Cmd>SDSelect
Usage:
SDSelect 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>SDSelect 1
Select SD Card
*****************************************************************************************************
Cmd>emapiWlanMac
Notice: This MAC address takes effect only when your platform is EEPRON-less configuration. Please use (emapiTest) to verify it !
Copying GSM DATA image to SDRAM:00004000
Wlan data header ++++++++++++++++++++
Signature : 0xEE1250
UpdateStatus : 0x2
UpdateCount : 0xA
BodyLength : 0x1A1
BodyCRC : 0x4349311B
Wlan data header --------------------------
0x00000000
0x00000009
0x0000002D
0x000000D2
0x000000D5
0x000000FB
*****************************************************************************************************
Cmd>emapiTest
+emapiTest
1. Power on WLAN
2. Reset WLAN
3. Switch MUX to WLAN
4. Enable WLAN clock
5. Init WLAN SDIO interface
6. DeviceID Test
DeviceID = 4030xxx
EEPROMless configuration!
-emapiTest
*****************************************************************************************************
Cmd>emapiPwrDwn
*****************************************************************************************************
Cmd>emapiRead
Parameter Wrong!!
*****************************************************************************************************
Cmd>getdevinfo
Need password!
*****************************************************************************************************
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
*****************************************************************************************************
Cmd>password
Usage:
password [String]
Enter the password string to enable wdata, erase and rbmc functions.
*****************************************************************************************************
Cmd>set
Usage:
set [Type Value]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Current flag settings:
Type 1(Operation mode flag): g_cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_dwFColor24bit=(0x0).
Type 5(Background color): g_dwBColor24bit=(0xFFFFFF).
Type 6(Set color of screen): None.
Type 32: Unlock Flash Command
Set control flags.
*****************************************************************************************************
Cmd>SetDebugMethod
Copying GSM DATA image to SDRAM:00004000
Default DebugTransport Value =00000000
Current Usage:
0 No Debug
A UART MTTY Output Debug Message
B USB MTTY Output Debug Message
*****************************************************************************************************
Cmd>checksum
Usage:
checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*****************************************************************************************************
Cmd>ResetDevice
no comments
*****************************************************************************************************
**When CID is locked.
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
**When CID is locked.
*****************************************************************************************************
**When CID unlocked
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==
**When CID unlocked
*****************************************************************************************************
Cmd>GPSRouting
Dump code to mtty console.
*****************************************************************************************************
Cmd>BTRouting
Dump code to mtty console.
*****************************************************************************************************
Cmd>BTRouting
+GSM_Modem_Init : include DAGON
Copying GSM DATA image to SDRAM:00004000
GSM - dwSize = 3479D
GSM Page0
GSM - dwSize = 45457
GSM Page1
GSM - dwSize = 4B768
GSM Page2
GSM - dwSize = 4E0A9
GSM Page3
GSM - dwSize = 4B4C4
GSM Page4
GSM - dwSize = 4C71F
GSM Page5
GSM - dwSize = 2958E
GSM Page6
GSM - dwSize = E8D8
GSM Page7
Copying GSM CODE image to SDRAM:00000000
ARMBOOT = 1 --> boot from CS3
Reset ARM 7 -- ok
Please close MTTY USB connection and open BT Testing program...
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
password BsaD5SeoA - this is static password used during flashing device. (USB sniffer)
battery seems to be charging during bootloader.
If you stuck at bootloader during manipulations with commands, try this:
password BsaD5SeoA
ruurun 0
Alternatively, you can run rom flasher even on CID locked device. It will give you error message about Device ID or something, but your device will be back to normal and boot normally.

[Q] Loop in bootanimation after update to CROMi-X 7.0.2

Hi to everyone.
I was updating my tab to the latest version of the ROM of sbdags.
Everything was fine until i reboot the tab to use it for the first time: loop in the boot animation and never come out from it.
I came from the previous version of the rom, the Cromi-x 6.1 with 10.26.1.18 bootloader.
The process i use to update was this:
1) wipe of data/factory reset, wipe with format /boot, wipe with format /system
2) Install the CWM recovery 6.0.5.0 and update the bootloader to 11.4.1.17 by flashing they with the file that you can find in the rom page.
3) repeat point 1
4) install the rom by flashing it from an SD. Complete the Aroma installer and answer to every option that it ask to me.
5) reboot the system and stuck in the bootanimation
I use the WW format cause i'm italian and i check the md5
What's wrong? I can go to recovery everytime i need and i have a backup just in case i need it.
Sdbags, i really want to offer you a beer for your work. I think i will do it in every case, but yes, kitkat on my tab would be great :victory:
Sorry for bad english. For every question, i'm here. Thanks a lot.
M.

aMachi said:
Hi to everyone.
I was updating my tab to the latest version of the ROM of sbdags.
Everything was fine until i reboot the tab to use it for the first time: loop in the boot animation and never come out from it.
I came from the previous version of the rom, the Cromi-x 6.1 with 10.26.1.18 bootloader.
The process i use to update was this:
1) wipe of data/factory reset, wipe with format /boot, wipe with format /system
2) Install the CWM recovery 6.0.5.0 and update the bootloader to 11.4.1.17 by flashing they with the file that you can find in the rom page.
3) repeat point 1
4) install the rom by flashing it from an SD. Complete the Aroma installer and answer to every option that it ask to me.
5) reboot the system and stuck in the bootanimation
I use the WW format cause i'm italian and i check the md5
What's wrong? I can go to recovery everytime i need and i have a backup just in case i need it.
Sdbags, i really want to offer you a beer for your work. I think i will do it in every case, but yes, kitkat on my tab would be great :victory:
Sorry for bad english. For every question, i'm here. Thanks a lot.
M.
Click to expand...
Click to collapse
Don't do step 3. Try it again please.
Try the default options first.

sbdags said:
Don't do step 3. Try it again please.
Try the default options first.
Click to expand...
Click to collapse
If default option are those who are pre-selected on the aroma installer i've already try it.
Also i try to do it without point 3. Nothing
Here a log of the installation of the rom
AROMA INSTALLER version 2.56
(c) 2012 by amarullz xda-developers
ROM Name : CROMi-Xenogenesis KitKat
ROM Version : 7.0.2 DEODEX
ROM Author : sbdags
Device : Asus Transformer TF701T
Start at : Mon Aug 25 20:30:02 2014
Thank you for installing CROMi-Xenogenesis KitKat 4.4.2!
Sit back and relax...
-----------------------------------------------------
This will take a few minutes!
Preparing File System...
about to run program [/sbin/umount] with 3 args
umount: can't umount /system: Invalid argument
run_program: child exited with status 1
about to run program [/sbin/umount] with 3 args
Formatting System....
Creating filesystem with parameters:
Size: 2147483648
Block size: 4096
Blocks per group: 32768
Inodes per group: 8192
Inode size: 256
Journal blocks: 8192
Label:
Blocks: 524288
Block groups: 16
Reserved block group size: 127
Created filesystem with 11/131072 inodes and 17193/524288 blocks
Tuning System....
about to run program [/tmp/tune2fs.ext4] with 6 args
tune2fs 1.41.12 (17-May-2010)
Tuning Data - Journaling Enabled.....
about to run program [/tmp/tune2fs.ext4] with 6 args
tune2fs 1.41.12 (17-May-2010)
Wiping Cache.....
Installing Core System.....
Installing Options...
Region Specific Files
- TF701 WW Build
Kernel Preparation
- sbdag's 11.4.1.17 Stock Modded Kernel
package_extract_file: no extras/kernel/sbmodded/701sb3.img in package
DPI Preparation
- 320 DPI
Resolution Preparation
- 2560x1600 res
Boot Animation
- Google Android-L
Launcher
- Asus Stock Launcher
Asus Apps 1
- Asus Email
- Asus Desk Clock & Widget
- Asus Weather & Time Widget
- Asus Splendid
- Asus Calculator
- Asus MyDictionary
- Asus Studio
Asus Apps 2
Google Apps 1
- Google Calendar
- Google Now and Voice Search
- Google Music
- News and Weather Genie
- YouTube
- Maps
- Hangouts
Google Apps 2
- Google Chrome
- Google Drive Docs
Misc Apps
- ES File Explorer
- AdAway installed
- Keyboard Manager
- Terminal Emulator
- Polaris Office
Installing CROMi-X System Tweaks.....
about to run program [/tmp/cromix-build-prop.sh] with 1 args
Tweaks and Scripts
- Browser2RAM enabled
- Ad Blocker enabled
- Zip Align Script installed
- Keyboard Dock Remapping installed
Building symlinks.....
Setting permissions.....
Installing BusyBox.....
about to run program [/system/xbin/busybox] with 4 args
Setting ROOT.....
DRM Options
- Google Video & Hulu+ DRM
Installing build.prop
about to run program [/sbin/sh] with 2 args
about to run program [/sbin/sh] with 2 args
Finalising ROM
about to run program [/sbin/umount] with 3 args
---------------------------------------
All Done!
Don't forget to follow @sbdags on Twitter
If you like it please donate to [email protected] on paypal
Enjoy CROMi-X!
script succeeded: result was [Enjoy CROMi-X!]
Installer Sucessfull (Status 0)
I don't know if this can be helpful, but if i restore the backup of the previous version of the rom everything work fine. I'm reading the discussion of the guy with the partition problem and i was wondering if maybe the problem was the same, but i don't think it.
Another time, sorry for bad english and thanks for all your work sdbags.
M.

That log is fine - everything is installed.
Read out the bootloader version from the bootloader screen to double check please.
Also you are rebooting after installing the bootloader and cwm package aren't you?
aMachi said:
If default option are those who are pre-selected on the aroma installer i've already try it.
Also i try to do it without point 3. Nothing
Here a log of the installation of the rom
AROMA INSTALLER version 2.56
(c) 2012 by amarullz xda-developers
ROM Name : CROMi-Xenogenesis KitKat
ROM Version : 7.0.2 DEODEX
ROM Author : sbdags
Device : Asus Transformer TF701T
Start at : Mon Aug 25 20:30:02 2014
Thank you for installing CROMi-Xenogenesis KitKat 4.4.2!
Sit back and relax...
-----------------------------------------------------
This will take a few minutes!
Preparing File System...
about to run program [/sbin/umount] with 3 args
umount: can't umount /system: Invalid argument
run_program: child exited with status 1
about to run program [/sbin/umount] with 3 args
Formatting System....
Creating filesystem with parameters:
Size: 2147483648
Block size: 4096
Blocks per group: 32768
Inodes per group: 8192
Inode size: 256
Journal blocks: 8192
Label:
Blocks: 524288
Block groups: 16
Reserved block group size: 127
Created filesystem with 11/131072 inodes and 17193/524288 blocks
Tuning System....
about to run program [/tmp/tune2fs.ext4] with 6 args
tune2fs 1.41.12 (17-May-2010)
Tuning Data - Journaling Enabled.....
about to run program [/tmp/tune2fs.ext4] with 6 args
tune2fs 1.41.12 (17-May-2010)
Wiping Cache.....
Installing Core System.....
Installing Options...
Region Specific Files
- TF701 WW Build
Kernel Preparation
- sbdag's 11.4.1.17 Stock Modded Kernel
package_extract_file: no extras/kernel/sbmodded/701sb3.img in package
DPI Preparation
- 320 DPI
Resolution Preparation
- 2560x1600 res
Boot Animation
- Google Android-L
Launcher
- Asus Stock Launcher
Asus Apps 1
- Asus Email
- Asus Desk Clock & Widget
- Asus Weather & Time Widget
- Asus Splendid
- Asus Calculator
- Asus MyDictionary
- Asus Studio
Asus Apps 2
Google Apps 1
- Google Calendar
- Google Now and Voice Search
- Google Music
- News and Weather Genie
- YouTube
- Maps
- Hangouts
Google Apps 2
- Google Chrome
- Google Drive Docs
Misc Apps
- ES File Explorer
- AdAway installed
- Keyboard Manager
- Terminal Emulator
- Polaris Office
Installing CROMi-X System Tweaks.....
about to run program [/tmp/cromix-build-prop.sh] with 1 args
Tweaks and Scripts
- Browser2RAM enabled
- Ad Blocker enabled
- Zip Align Script installed
- Keyboard Dock Remapping installed
Building symlinks.....
Setting permissions.....
Installing BusyBox.....
about to run program [/system/xbin/busybox] with 4 args
Setting ROOT.....
DRM Options
- Google Video & Hulu+ DRM
Installing build.prop
about to run program [/sbin/sh] with 2 args
about to run program [/sbin/sh] with 2 args
Finalising ROM
about to run program [/sbin/umount] with 3 args
---------------------------------------
All Done!
Don't forget to follow @sbdags on Twitter
If you like it please donate to [email protected] on paypal
Enjoy CROMi-X!
script succeeded: result was [Enjoy CROMi-X!]
Installer Sucessfull (Status 0)
I don't know if this can be helpful, but if i restore the backup of the previous version of the rom everything work fine. I'm reading the discussion of the guy with the partition problem and i was wondering if maybe the problem was the same, but i don't think it.
Another time, sorry for bad english and thanks for all your work sdbags.
M.
Click to expand...
Click to collapse

sbdags said:
That log is fine - everything is installed.
Read out the bootloader version from the bootloader screen to double check please.
Also you are rebooting after installing the bootloader and cwm package aren't you?
Click to expand...
Click to collapse
When i install cwm and bootloader package i reboot from cwm but i stuck in boot animation. The same that happen when i try to reboot after install the rom.
In bootloader screen i read
Android macallan-user BL released by WW_epad-11.4.1.17-20140711

aMachi said:
When i install cwm and bootloader package i reboot from cwm but i stuck in boot animation. The same that happen when i try to reboot after install the rom.
In bootloader screen i read
Android macallan-user BL released by WW_epad-11.4.1.17-20140711
Click to expand...
Click to collapse
Right and then you boot back to CWM, do a full wipe (you may need to wipe your internal sdcard so back it up first) and then flash the rom. After that it should boot fine.
If not please search xda for how to get a logcat and post one of it bootlooping please.

sbdags said:
Right and then you boot back to CWM, do a full wipe (you may need to wipe your internal sdcard so back it up first) and then flash the rom. After that it should boot fine.
If not please search xda for how to get a logcat and post one of it bootlooping please.
Click to expand...
Click to collapse
I try the first thing that you say but nothing, still loop in bootanimation.
I'll do a logcat through adb in the afternoon. Now i had some problem cause i can't mount usb storage through cwm for some reason. Late i'll find drivers or what's missing.
Maybe can help: when i reboot frequently cwm ask me if i want to fix root. It's normal?
Thanks you for your help.

aMachi said:
I try the first thing that you say but nothing, still loop in bootanimation.
I'll do a logcat through adb in the afternoon. Now i had some problem cause i can't mount usb storage through cwm for some reason. Late i'll find drivers or what's missing.
Maybe can help: when i reboot frequently cwm ask me if i want to fix root. It's normal?
Thanks you for your help.
Click to expand...
Click to collapse
That message is normal. Just a bug in CWM.
We need to find why you are bootlooping.

sbdags said:
That message is normal. Just a bug in CWM.
We need to find why you are bootlooping.
Click to expand...
Click to collapse
Ok, logcat is here.
Hope it can help.

aMachi said:
Ok, logcat is here.
Hope it can help.
Click to expand...
Click to collapse
OK You got some serious problems there. It would appear that your internal sdcard doesn't mount:
Code:
D/Vold ( 359): Volume sdcard state changing -1 (Initializing) -> 0 (No-Media)
D/Vold ( 359): *********** Success!! "ro.epad.mount_point.sdcard=/mnt/media_rw/sdcard"
D/Vold ( 359): Volume usbdrive state changing -1 (Initializing) -> 0 (No-Media)
D/Vold ( 359): *********** Success!! "ro.epad.mount_point.usbdrive=/mnt/media_rw/usbdrive"
I/Vold ( 359): opening the sysfs of TF701
E/Vold ( 359): lookupVolume usbdisk1 failed!
E/Vold ( 359): lookupVolume usbdisk2 failed!
E/Vold ( 359): lookupVolume sdreader failed!
D/Vold ( 359): checkUsbdisk sucess.
D/DirectVolume( 359): i:0 minor:48
D/Vold ( 359): Volume sdcard state changing 0 (No-Media) -> 2 (Pending)
D/DirectVolume( 359): i:1 minor:49
D/Vold ( 359): Volume sdcard state changing 2 (Pending) -> 1 (Idle-Unmounted)
@lj50036, @_that any suggestions for this one?
@aMachi - what is the SKU of your device? And you can restore a nandroid back to 4.3 and it works fine?

sbdags said:
OK You got some serious problems there. It would appear that your internal sdcard doesn't mount:
Code:
D/Vold ( 359): Volume sdcard state changing -1 (Initializing) -> 0 (No-Media)
D/Vold ( 359): *********** Success!! "ro.epad.mount_point.sdcard=/mnt/media_rw/sdcard"
D/Vold ( 359): Volume usbdrive state changing -1 (Initializing) -> 0 (No-Media)
D/Vold ( 359): *********** Success!! "ro.epad.mount_point.usbdrive=/mnt/media_rw/usbdrive"
I/Vold ( 359): opening the sysfs of TF701
E/Vold ( 359): lookupVolume usbdisk1 failed!
E/Vold ( 359): lookupVolume usbdisk2 failed!
E/Vold ( 359): lookupVolume sdreader failed!
D/Vold ( 359): checkUsbdisk sucess.
D/DirectVolume( 359): i:0 minor:48
D/Vold ( 359): Volume sdcard state changing 0 (No-Media) -> 2 (Pending)
D/DirectVolume( 359): i:1 minor:49
D/Vold ( 359): Volume sdcard state changing 2 (Pending) -> 1 (Idle-Unmounted)
@lj50036, @_that any suggestions for this one?
@aMachi - what is the SKU of your device? And you can restore a nandroid back to 4.3 and it works fine?
Click to expand...
Click to collapse
i've some problem to find the SKU code. I search on the box of the tablet but there are too many codes and i don't know what's the right. Can you give me an exemple of it?
Yes, i can restore to 4.3. In this right moment i'm writing with the tab with cromix 6. Everything seems to work fine.
In case like this you really know how much important is to do a backup..

aMachi said:
i've some problem to find the SKU code. I search on the box of the tablet but there are too many codes and i don't know what's the right. Can you give me an exemple of it?
Yes, i can restore to 4.3. In this right moment i'm writing with the tab with cromix 6. Everything seems to work fine.
In case like this you really know how much important is to do a backup..
Click to expand...
Click to collapse
SKU is just your country code - so if you have changed it it could be causing issues with the clean install.
US, WW, TW, CN, JP are the only 5 I know of.
So if you changed the bootloader from US to WW I heard another user reporting some issues.
But in your case I am at a loss as to how you can boot 4.3 but not 4.4.2 as you are apparently on a 4.4.2 compatible bootloader and recovery .......

sbdags said:
SKU is just your country code - so if you have changed it it could be causing issues with the clean install.
US, WW, TW, CN, JP are the only 5 I know of.
So if you changed the bootloader from US to WW I heard another user reporting some issues.
But in your case I am at a loss as to how you can boot 4.3 but not 4.4.2 as you are apparently on a 4.4.2 compatible bootloader and recovery .......
Click to expand...
Click to collapse
Ah, right, i understand. I am WW, and i use it in every installation that i've done on my eee pad, from the rooting process and the unlocking of bootloader to the change of the rom.
Now that i am on the previous version of your rom those are infos of kernel, firmware, ecc.
Android Version 4.3
Kernel Version 3.4.57-g47dbe4d [email protected]#1
Tue Dec 17 23.26.15 CST 2013
Build Number TF701T_CROMi-Xenogenesis-6.1-WW_DEODEX-ORIGINAL-10.26.1.18 020115_201310210002
In ROM Manager i can see that my Recovery still is the 6.0.5.0 version.
In bootloader i can see that it is "WW_epad-11.4.1.17-20140711"
Hope that this might be helpful and hope that i don't write anything of unsafe.
M.

aMachi said:
Ah, right, i understand. I am WW, and i use it in every installation that i've done on my eee pad, from the rooting process and the unlocking of bootloader to the change of the rom.
Now that i am on the previous version of your rom those are infos of kernel, firmware, ecc.
Android Version 4.3
Kernel Version 3.4.57-g47dbe4d [email protected]#1
Tue Dec 17 23.26.15 CST 2013
Build Number TF701T_CROMi-Xenogenesis-6.1-WW_DEODEX-ORIGINAL-10.26.1.18 020115_201310210002
In ROM Manager i can see that my Recovery still is the 6.0.5.0 version.
In bootloader i can see that it is "WW_epad-11.4.1.17-20140711"
Hope that this might be helpful and hope that i don't write anything of unsafe.
M.
Click to expand...
Click to collapse
NO that is expected but hat is not expected is why you can't boot 4.4.2. Let's wait for _that and lj50036 to cast their expert eyes over your issues.

sbdags said:
@lj50036, @_that any suggestions for this one?
Click to expand...
Click to collapse
This seems to be the core of the problem:
Code:
E/dalvikvm(13002): JNI posting fatal error: Native registration unable to find class 'com/android/internal/os/RuntimeInit'; aborting...
Check that the framework is correctly installed and the BOOTCLASSPATH is set correctly:
Code:
adb shell echo $BOOTCLASSPATH > bootclasspath.txt
adb shell ls -l /system/framework > framework.txt

_that said:
This seems to be the core of the problem:
Code:
E/dalvikvm(13002): JNI posting fatal error: Native registration unable to find class 'com/android/internal/os/RuntimeInit'; aborting...
Check that the framework is correctly installed and the BOOTCLASSPATH is set correctly:
Code:
adb shell echo $BOOTCLASSPATH > bootclasspath.txt
adb shell ls -l /system/framework > framework.txt
Click to expand...
Click to collapse
Ok, so maybe now i need some help.
I run adb in my pc then i type adb shell to run the remote shell interactively.
Then what i need to type?
Anyway if i type "ls -l /system/framework > framework.txt" the response is "No such file or directory"
Sorry for my n00b questions. Really hope to learn something here, and give a chance to reward everyone for the help.

aMachi said:
Ok, so maybe now i need some help.
I run adb in my pc then i type adb shell to run the remote shell interactively.
Then what i need to type?
Anyway if i type "ls -l /system/framework > framework.txt" the response is "No such file or directory"
Sorry for my n00b questions. Really hope to learn something here, and give a chance to reward everyone for the help.
Click to expand...
Click to collapse
The commands were supposed to be typed as is on your computer. However I think I missed to quote the "echo $BOOTCLASSPATH" - I want the bootclasspath of your device, not of your PC.
Anyway, if you type "adb shell" first and then "ls -l /system/framework" and you get back "No such file or directory" that's strange...

_that said:
The commands were supposed to be typed as is on your computer. However I think I missed to quote the "echo $BOOTCLASSPATH" - I want the bootclasspath of your device, not of your PC.
Anyway, if you type "adb shell" first and then "ls -l /system/framework" and you get back "No such file or directory" that's strange...
Click to expand...
Click to collapse
Ok so tomorrow i'll give you the result of this test. I hope that i learn how to right use this command.
Any other thing that i can do?

aMachi said:
Ok so tomorrow i'll give you the result of this test. I hope that i learn how to right use this command.
Any other thing that i can do?
Click to expand...
Click to collapse
Post screenshots of your cmd window so that they can see the actual input/output

berndblb said:
Post screenshots of your cmd window so that they can see the actual input/output
Click to expand...
Click to collapse
No need for a graphical screenshot - you can copy the text from the console window.

A7000 flashing checksum 1041

My Lenovo A7000 hang then i removed battary & switch it back
it stuck at lenovo logo
- boot in recovery mode by vol buttons + power wipe user data , fuse wip data or fuse format data
it give ok but still no change
- i used smart phone flash tool diff Versions with diff roms from diff locations ( stock roms & custom) throw all option
download , format all+donwlaod , firmware upgrade
it start flashing then give errors
BROM ERROR : S_CHKSUM_ERROR (1041)
or
BROM ERROR : S_DA_SDMMC_READ_FAILD (3153) at diff precentage of flashing
- i disabled usb checksum , storage checksum in options-> download
it success flah but nothing change
- tyr without battary device not detect in windows so i flash with battary on
- i auto format , manual format nothing change
- in memory test tab run test it give NAND Flash:
ERROR: NAND Flash was not detected!
EMMC:
EMMC_PART_BOOT1 Size = 0x0000000000400000(4MB)
EMMC_PART_BOOT2 Size = 0x0000000000400000(4MB)
EMMC_PART_RPMB Size = 0x0000000000080000(0MB)
EMMC_PART_GP1 Size = 0x0000000000000000(0MB)
EMMC_PART_GP2 Size = 0x0000000000000000(0MB)
EMMC_PART_GP3 Size = 0x0000000000000000(0MB)
EMMC_PART_GP4 Size = 0x0000000000000000(0MB)
EMMC_PART_USER Size = 0x00000001d2000000(7456MB)
UFS:
ERROR: UFS was not detected!
Data Bus Test:
OK
Address Bus Test
OK
- try all kind of drivers , and windows xp , 7 , diff cables no success
- when boot in meta mode & run adb devices get ? offline or ? unauthorize
- i can boot in recovery mode , meta mode , factory mode
- when connect to charger it show battary charging logo & charging percent
please any one can help figure the problem

OS corrupt (just before data backup), S1 boot works fine, any chance for data rescue?

As title says, I was JUST about to backup all my app data, contacts and stored messages from my Z3 Compact, when it started bootlooping on its own.
I did some researching since I have a basic background in Electronics repair (not to mention almost unlimited amounts of stubbornness and patience) and learned of a Serial debug test pads under the battery (the battery were a real pain in the rear to remove without ruining anything) which gave me following boot log (with IMEI numbers censored by me):
Code:
Format: Log Type - Time(microsec) - Message
Log type: B - since boot(excluding boot rom). D - delta
B - 253882 - SBL1, Start
B - 259158 - scatterload_region && ram_init, Start
D - 0 - scatterload_region && ram_init, Delta
B - 276147 - pm_device_init, Start
D - 27328 - pm_device_init, Delta
B - 303658 - boot_flash_init, Start
D - 217739 - boot_flash_init, Delta
B - 521733 - boot_config_data_table_init, Start
D - 0 - boot_config_data_table_init, Delta
B - 527863 - PBS setup, Start
D - 1159 - PBS setup, Delta
B - 533719 - sbl1_ddr_set_params, Start
B - 538355 - Pre_DDR_clock_init, Start
D - 244 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 551745 - pm_driver_init, Start
D - 237930 - pm_driver_init, Delta
B - 790041 - clock_init, Start
D - 183 - clock_init, Delta
B - 793152 - Image Load, Start
B - 907649 - Tz Execution, Start
D - 173392 - Tz Execution, Delta
B - 1090771 - Image Load, Start
B - 1147776 - Signal PBL to Jump to RPM FW
B - 1148050 - sbl1_wait_for_ddr_training, Start
D - 31750 - sbS1 BOOT
[120] USB init ept @ 0x7365000
[140] TA config read from GPT: 0x10 blocks of size 0x20000 @ 0x20000
S1 BOOT (1286-7314 S1_Boot_MSM8974AC_LA3.0_L_15.4)
[180] GPIO HW_ID[3:0]: [0000]
[180] soc_ver: 0x10001, pmic_ver: 3.1
[190] die_id: 0x1070712e, oem_product_id: 0x4, otp_lock: 0x155
PBA ID: 1285-0545 (4)
[200] CHG_STATUS_REG is 0x0 after pm8x41_chg_sts_get()
Startup flags: [ONKEY PRESSED]
Warmboot reason: [COLDBOOT]
Remote lock is UNSUPPORTED
Rooting status is: Not done
[340] OV: 0x80000 0x0 0x0
[ERROR @ S1/boot/src/s1boot_config_parser.c:595]:
MiscTA unit 2473 could not be read!
[ERROR @ S1/boot/src/s1boot_config_parser.c:845]:
None or incorrect vbus_pulse configuration!
[ERROR @ S1/boot/src/s1boot_config_parser.c:904]:
No variant configuration to store!
[360] USB ID: 1790
[360] OTG State is invalid
Service mode detected: [NONE]
[ERROR @ S1/boot/src/s1boot_lib_api.c:1448]:
TA read failed!
[450] S1 decisions complete, image to boot is 0.
[450] IMEI[0]: ##############
[450] Info: failed to retrieve secondary IMEI (optional) in facility 0x1 with code 0x2 (error ignored)
[1150] Using DTB entry 194/00010000/8/0 for device 194/00010001/8/0
[1160] CHG_STATUS_REG is 0x0 after pm8x41_chg_sts_get()
[1160] icon_flg is 0x0 battery_flg is 0x0 chg_presence_flg is 0x0
[1170] backlight_enable=1
[1190] Detected display: jdi novatek 720p cmd
[1310] No lp855x --> PMIC backlight
[1570] Battery is Good! go to HLOS
[1580] CHG_STATUS_REG is 0x0 after pm8x41_chg_sts_set()
[1580] cmdline: "androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3b7"\
[1590] " ehci-hcd.park=3 androidboot.bootdevice=msm_sdcc.1 vmalloc=3"\
[1600] "00M dwc3.maximum_speed=high dwc3_msm.prop_chg_detect=Y andro"\
[1600] "idboot.emmc=true androidboot.bootloader=s1 oemandroidboot.s1"\
[1610] "boot=1286-7314_S1_Boot_MSM8974AC_LA3.0_L_15.4 androidboot.se"\
[1620] "rialno=YT9112XZ6P ta_info=1,16,256 startup=0x00000001 warmbo"\
[1620] "ot=0x00000000 oemandroidboot.imei=##############00 oemandroi"\
[1630] "dboot.phoneid=0000:##############00 oemandroidboot.security="\
[1640] "1 oemandroidboot.babe08b3=50000000 lcdid_adc=0x5D4F8 display"\
[1640] "_status=on androidboot.baseband=msm".
[1650] Updating device tree: start
[1680] Updating device tree: done
Leaving S1 BOOT
[1730] If you can read this line, S1 BOOT is done. Start the stone rolling!
[1740] booting linux @ 0x8000, ramdisk @ 0x2000000 (3754834), tags/device tree @ 0x1e00000
[1740] Continuous splash enabled, keeping panel alive.
Format: Log Type - Time(microsec) - Message
Log type: B - since boot(excluding boot rom). D - delta
B - 89883 - SBL1, Start
B - 95160 - scatterload_region && ram_init, Start
D - 0 - scatterload_region && ram_init, Delta
B - 112148 - pm_device_init, Start
D - 27328 - pm_device_init, Delta
B - 139629 - boot_flash_init, Start
D - 65117 - boot_flash_init, Delta
B - 205082 - boot_config_data_table_init, Start
D - 30 - boot_config_data_table_init, Delta
B - 211243 - PBS setup, Start
D - 1159 - PBS setup, Delta
B - 217068 - sbl1_ddr_set_params, Start
B - 221460 - Pre_DDR_clock_init, Start
D - 244 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 235033 - pm_driver_init, Start
D - 237930 - pm_driver_init, Delta
B - 473451 - clock_init, Start
D - 183 - clock_init, Delta
B - 579805 - Image Load, Start
B - 689178 - Tz Execution, Start
D - 32574 - Tz Execution, Delta
B - 731512 - Image Load, Start
B - 787754 - Signal PBL to Jump to RPM FW
B - 788150 - sbl1_wait_for_ddr_training, Start
D - S1 BOOT
[120] USB init ept @ 0x7365000
[140] TA config read from GPT: 0x10 blocks of size 0x20000 @ 0x20000
S1 BOOT (1286-7314 S1_Boot_MSM8974AC_LA3.0_L_15.4)
[180] GPIO HW_ID[3:0]: [0000]
[180] soc_ver: 0x10001, pmic_ver: 3.1
[190] die_id: 0x1070712e, oem_product_id: 0x4, otp_lock: 0x155
PBA ID: 1285-0545 (4)
[200] CHG_STATUS_REG is 0x0 after pm8x41_chg_sts_get()
Startup flags: [ONKEY PRESSED]
Warmboot reason: [CRASH]
Remote lock is UNSUPPORTED
Rooting status is: Not done
[330] OV: 0x80000 0x0 0x0
[ERROR @ S1/boot/src/s1boot_config_parser.c:595]:
MiscTA unit 2473 could not be read!
[ERROR @ S1/boot/src/s1boot_config_parser.c:845]:
None or incorrect vbus_pulse configuration!
[ERROR @ S1/boot/src/s1boot_config_parser.c:904]:
No variant configuration to store!
[360] USB ID: 1790
[360] OTG State is invalid
Service mode detected: [NONE]
[ERROR @ S1/boot/src/s1boot_lib_api.c:1448]:
TA read failed!
[370] S1 decisions complete, image to boot is 1.
[380] IMEI[0]: ##############
[380] Info: failed to retrieve secondary IMEI (optional) in facility 0x1 with code 0x2 (error ignored)
[ERROR @ S1/util/src/s1_elf_loader.c:422]:
File image is not an known ELF-file.
[ERROR IN FAC 0xB CODE 0x3 @ S1/util/src/s1_elf_loader.c:1501]:
ELF-Loader initialization failed. De-initializing.
[ERROR @ S1/util/src/s1_elf_loader.c:1577]:
Invalid parameter.
[ERROR IN FAC 0xB CODE 0x3 @ S1/boot/src/s1boot_elf_loader.c:707]:
ELF loading failed!
[420] Crash detected, but ramdumper not found.
[420] clean ramdump info
[430] rebooting.
Leaving S1 BOOT
As for the OS, I wasn't running a recent version since I was rooted (despite what the log says) and Sony being both the only manufacturer of appropriately sized smartphones and a huge trouble to anyone who likes to have a rooted and fully functional phone at the same time (often nerfing the camera when rooting via their official means).
So is there any way to recovering the rest of the data on the internal eMMC chip? I frankly don't care much about rescuing the phone itself, only the data, so if it comes to having to desolder the eMMC and dumping the data via the backwards compatibility interface many eMMC chips have that's identical to the SD-card protocol and a holding jig (with eventual 1.8v to 3.3v level converter) then so be it, the data is number #1 priority while making the phone itself useful again is only a nice bonus, so if data recovery isn't possible at all then I'm not gonna bother spending more energy on it.
Any useful help appreciated

UPDATE: crisis toned down from DEFCON 1 to DEFCON 3, as it turns out I DID have a 3rd-party bootloader on the phone after all (Philz Touch fork of CWM) that I had completely forgotten both that I installed it and how to enter it.
Both embarrassing and a pleasant surprise.
So now I'm looking for a way to restore the late part of the original boot system and core OS files so It can boot, which'll enable me to make a nice dump of critical files with convenient app(s), instead of having to manually pilfer through a backup for data and figuring out how to transfer them over to my new phone the nicest way.
UPDATE #2
Dug through my computer backup and found the files from when I originally rooted it, including the latest .ftf file i flashed to the phone.
Could I be cheeky and get away with only flashing the kernel and the boot_delivery to make it boot normally again so I can do a "traditional" phone data transfer? or is that a waste of time?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"

[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...

foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
I am thinking that bytes 0...4487 is the real bootloader code, so:
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Wow! Excited to see this! Thanks

It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.

foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Good job, if needed i can help with the checking

tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
abl.img is not the bootloader i guess.

tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
On other devices they've been able to swap this image with another one to "hide" the message, to "get rid of it".

Would we sweet if we could get rid of the unlocked bootloader message too.

dennisbednarz said:
Would we sweet if we could get rid of the unlocked bootloader message too.
Click to expand...
Click to collapse
+1

U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool

jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.

Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...

foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Use this https://forum.xda-developers.com/oneplus-6t/how-to/tool-6t-msmdownloadtool-v4-0-oos-9-0-5-t3867448
Should try for several times with instruction here

Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.

patelparth120595 said:
Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.
Click to expand...
Click to collapse
Disabled dm-verity caused red warning, i guess.
---------- Post added at 10:01 AM ---------- Previous post was at 09:58 AM ----------
foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
And then:
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Edited abl.img ? and flashed via recovery/fastboot ?

AnoopKumar said:
Edited abl.img ? and flashed via recovery/fastboot ?
Click to expand...
Click to collapse
No, just flashed using dd command in TWRP shell.

foobar66 said:
No, just flashed using dd command in TWRP shell.
Click to expand...
Click to collapse
Phone still dead ?

OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5

foobar66 said:
OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5
Click to expand...
Click to collapse
I assume that, there is nothing to do with the abl.img. Only thing we can do with it is change the default strings to a song lyric or something. abl.img is the uefi firmware i guess. Bootloader is using the images stored in the logo partition.

Gsi's flash without breaking verity if u flash to both slots. And totally format. Fastboot -w. The phone sees any changes to partitions as corruption and breaks verity, hence red warning.. if someone would be inclined to talk to invisiblek from the essential threads, he could tell u of a fix. The solution is not in abl. It's in the stock boot.img. if I had more time, I would help
---------- Post added at 02:52 PM ---------- Previous post was at 02:51 PM ----------
tech_head said:
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.
Click to expand...
Click to collapse
No, they are talking about breaking verity also. Seems to be both messages, but more recently the broken verity message. Which there is two types, one u can boot from, one u cannot.

jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
I would love that idea. That would be really nice to have on our device