Related
Hello everyone.
Last week I got access to an old supposedly dead touchpad lying at my friends office. Had to fiddle with it for almost a day and a half to get it running as it was totally out of charge.
Tried all possible combinations of VolUp, VolDown, Home but it just would not start initially, even after leaving it for charging for whole night using the original charger.
Anyhow once it booted, to my surprise it had Android 2.3.3 preinstalled. The initialy few sec boot screen showed HP logo with few cmd lines mentioning topaz etc etc.
The few details in the back are as below...
Prototype - NfS
FB35UA-EVT
CPU - APQ80680(64M)Rev.2
So anyone around have been able to take a complete back of the original rom and then upgrade to CM9/Cm10?
I tried following the common steps for upgrading from WebOS to CMx but none works for obvious reasons.
I am currently trying to get help on how to install mboot and tenderlionCWM, hence any pointer would be of great help. FYI the terminal does not give SU access either.
Update 1 - Out of desperation, I ran the JC tool tpdebrick, well didn't went good, I believe.... the outcome is that the device does not show any activity on screen and under windows device manager it either shows Android or QHSUSB_DLOAD!!!
Hi, never heard of the hp touchpad coming with factory pre installed android, and j's debrick is i think only for something that is lifeless..
Anyway what I would suggest is this thread http://forum.xda-developers.com/showthread.php?t=1426244 paying particular attention to the first post on page 12. And with luck you will have a working TP.
PM if you want /need further assistance.
followed the give guid to restore to factory, however no positive results.
I got stuck on the first step itself as the PC shows the device as an Android device., Hence Novacom is unable to find the device.
The touchpad device property is as below.
Bus 002 Device 030: ID 18d1:d00d Google Inc.
I had to install the google usb drivers with tweaked inf as mentioned else where in the forums. The only difference was that the device id is different than the ones posted here.
I went ahead and tried placing the command
adb devices
but that too shows no device connected, even though the PC device manager shows it connect with drivers.
pls suggest possible wayouts
Android 2.3.3?, is there any pictures we can see? Pretty please.
Have you tried installing a camera launcher to see if the drivers are there?
Sent from my Nexus 7 using xda app-developers app
Well I wish I did a rom backup before moving forward, however as I had updated in my OP, Im in a brick situation right now, with no signs of life.
For last two days I am running tpdebrick by JC to revive it, but alas no positive signs for now.
P.S. For once when it did switch on, yes the stock camera was running, but the images were way below normal.
There were a select few Touchpads that accidentally shipped with Froyo 2.2 which was likely being used to test the hardware before WebOS was completed for it. But I've never heard of one shipping with GB, any CM7 ROMs for this were based on 2.3.7 IIRC.
sstar said:
Hi, never heard of the hp touchpad coming with factory pre installed android, and j's debrick is i think only for something that is lifeless..
Anyway what I would suggest is this thread http://forum.xda-developers.com/showthread.php?t=1426244 paying particular attention to the first post on page 12. And with luck you will have a working TP.
PM if you want /need further assistance.
Click to expand...
Click to collapse
I used the link above on a TP I bricked, did not work. What revived it was the TPdebrick following procedure
http://rootzwiki.com/topic/38786-tpdebrick-v004/
your tp might be valuable to developers. i would contact them and see if theres some system files on it they could use.
a very few prototype models had android installed on them, but they were never meant for the public. however a select few did manage to get out into the wild. this one you have is quite rare.
edit: never mind, i see you've bricked it. could have had some potential useful files on there
I'm guessing TP Debrick won't work for you because you're in Google Inc. mode already. A little modding of the tpdebrick script to skip the first steps would probably solve this problem.
I will attempt if no one beats me to it.
bonkers! I never realised that it was this a rare device . I had been careless handling this and overconfident in putting custom roms etc.
Anyway I spent the day last in running the tpdebrick004 again and again with different ways. Prior to that our fiddling with webdoctor, novaterm etc all failed.
The results are as below... for the honorary members here!
Test bed - Ubuntu live 12.04 32bit, with android-adb and fastboot installed and TPdebrick004
Scenario 1
1. Under Home+VolDown+Power mode
2. lsusb shows...
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
3. Running tpdebrick004 aborts with the following
Code:
tpdebrick-v004$ sudo ./tpdebrick 32
checking doc files ...
Requesting SoftwareVersion...
Version: PBL_DloadVER1.0
Requesting Params...
Params: 06 01 01 00 90 00 00
Uploading file 'emmcbld.bin' to QDLOAD...
Writing 1024 bytes to 0x2a000000; 164996 bytes left.
Writing 1024 bytes to 0x2a000400; 163972 bytes left.
Writing 1024 bytes to 0x2a000800; 162948 bytes left.
Writing 1024 bytes to 0x2a000c00; 161924 bytes left.
.
.
.
.
Writing 1024 bytes to 0x2a027400; 4228 bytes left.
Writing 1024 bytes to 0x2a027800; 3204 bytes left.
Writing 1024 bytes to 0x2a027c00; 2180 bytes left.
Writing 1024 bytes to 0x2a028000; 1156 bytes left.
Writing 1024 bytes to 0x2a028400; 132 bytes left.
Writing 132 bytes to 0x2a028800; 0 bytes left.
Executing file...
Checking QDL mode...
Writing file tz.mbn ...
Sending MAGIC...
MSG: Qfprom Fuse List: Blowing FAILED
MSG: Failed Fuse addr:
MSG: 0x00000000
MSG: Error Status:
MSG: 0x00000000
Sending secureMode...
Sending openMulti ...
Uploading file 'tz.mbn'...
Writing 1024 bytes to 0x18000000; 97896 bytes left.
Response: ACK 0x18000000 (outstanding: 0)
Writing 1024 bytes to 0x18000400; 96872 bytes left.
Response: ACK 0x18000400 (outstanding: 0)
Writing 1024 bytes to 0x18000800; 95848 bytes left.
Response: ACK 0x18000800 (outstanding: 0)
.
.
.
Response: ACK 0x06410e00 (outstanding: 0)
Writing 1024 bytes to 0x06411200; 552 bytes left.
Response: ACK 0x06411200 (outstanding: 0)
Writing 552 bytes to 0x06411600; 0 bytes left.
Response: ACK 0x06411600 (outstanding: 0)
Sending CloseFlush...
Writing file mbr32.bin ...
Sending MAGIC...
Sending secureMode...
Sending openMulti ...
Uploading file 'mbr32.bin'...
Writing 512 bytes to 0x00000000; 0 bytes left.
Response: ACK 0x00000000 (outstanding: 0)
Sending CloseFlush...
Done writing files.
Reseting device...
Requesting Reset...
Waiting for fastboot mode...
fastboot mode not found
Aborted.
Nothing happens thereafter.
Scenario 2
4. After reading few tips in the tpdebrick discussion in rootzwiki, after getting the fastboot mode not found message I manually reset the TP into Home+VolUp+Power mode
5. lsusb in sperate terminal window shows
Code:
Bus 002 Device 030: ID 18d1:d00d Google Inc.
6. running tpdebrick again continues further after fastboot message..
Code:
Response: ACK 0x00000000 (outstanding: 0)
Sending CloseFlush...
Done writing files.
Reseting device...
Requesting Reset...
Waiting for fastboot mode...
Loading TPToolbox-Headless ...
sending 'bootmem' (13200 KB)...
OKAY [ 0.827s]
writing 'bootmem'...
OKAY [ 2.924s]
finished. total time: 3.751s
Waiting for netchip mode... (may take 3+ mins)
Waiting for ping check... (may take 1-2 mins)
Checking/updating known_hosts...
Copying A6 files...
a6_firmware.txt.00 100% 48KB 48.3KB/s 00:00
PmA6Updater 100% 13KB 13.4KB/s 00:00
Copying bootloader files...
bootie-topaz305.bin 100% 113KB 112.8KB/s 00:00
emmc_appsboot.mbn 100% 45KB 44.7KB/s 00:00
Checking A6 firmware...
processing file: /tmp/a6_firmware.txt.00
A6 device: /dev/a6_0
2.13.10 (0x020d000a)
fw file size: 49461
fw file mapped at: 0x401a3000
Firmware verification complete
Updating A6 firmware...
Write failed: Broken pipe
A6 firmware update failed.
Aborted.
It takes hell lot of a time after the Updating A6 firmware message... almost half hour or more...
And that is where I am stuck right now... Hope this is of some help in figuring out the next steps...
your device has different partitioning and no webos installed. the tpdebrick and the methods for installing the CM7/9/10 won't work for you.
when you have started messing with tpdebrick, webos doctor you have probably bricked the device for good and every valuable part of software that has been shipped with this prototype rom you had is lost.
maybe, though webdoctor was not able to connect, however how one would know that the partitioning was different. do excuse my lame Q
Because it didn't have web os.
desihu said:
bonkers! I never realised that it was this a rare device . I had been careless handling this and overconfident in putting custom roms etc.
Anyway I spent the day last in running the tpdebrick004 again and again with different ways. Prior to that our fiddling with webdoctor, novaterm etc all failed.
The results are as below... for the honorary members here!
Test bed - Ubuntu live 12.04 32bit, with android-adb and fastboot installed and TPdebrick004
Scenario 1
1. Under Home+VolDown+Power mode
2. lsusb shows...
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
3. Running tpdebrick004 aborts with the following
Code:
tpdebrick-v004$ sudo ./tpdebrick 32
checking doc files ...
Requesting SoftwareVersion...
Version: PBL_DloadVER1.0
Requesting Params...
Params: 06 01 01 00 90 00 00
Uploading file 'emmcbld.bin' to QDLOAD...
Writing 1024 bytes to 0x2a000000; 164996 bytes left.
Writing 1024 bytes to 0x2a000400; 163972 bytes left.
Writing 1024 bytes to 0x2a000800; 162948 bytes left.
Writing 1024 bytes to 0x2a000c00; 161924 bytes left.
.
.
.
.
Writing 1024 bytes to 0x2a027400; 4228 bytes left.
Writing 1024 bytes to 0x2a027800; 3204 bytes left.
Writing 1024 bytes to 0x2a027c00; 2180 bytes left.
Writing 1024 bytes to 0x2a028000; 1156 bytes left.
Writing 1024 bytes to 0x2a028400; 132 bytes left.
Writing 132 bytes to 0x2a028800; 0 bytes left.
Executing file...
Checking QDL mode...
Writing file tz.mbn ...
Sending MAGIC...
MSG: Qfprom Fuse List: Blowing FAILED
MSG: Failed Fuse addr:
MSG: 0x00000000
MSG: Error Status:
MSG: 0x00000000
Sending secureMode...
Sending openMulti ...
Uploading file 'tz.mbn'...
Writing 1024 bytes to 0x18000000; 97896 bytes left.
Response: ACK 0x18000000 (outstanding: 0)
Writing 1024 bytes to 0x18000400; 96872 bytes left.
Response: ACK 0x18000400 (outstanding: 0)
Writing 1024 bytes to 0x18000800; 95848 bytes left.
Response: ACK 0x18000800 (outstanding: 0)
.
.
.
Response: ACK 0x06410e00 (outstanding: 0)
Writing 1024 bytes to 0x06411200; 552 bytes left.
Response: ACK 0x06411200 (outstanding: 0)
Writing 552 bytes to 0x06411600; 0 bytes left.
Response: ACK 0x06411600 (outstanding: 0)
Sending CloseFlush...
Writing file mbr32.bin ...
Sending MAGIC...
Sending secureMode...
Sending openMulti ...
Uploading file 'mbr32.bin'...
Writing 512 bytes to 0x00000000; 0 bytes left.
Response: ACK 0x00000000 (outstanding: 0)
Sending CloseFlush...
Done writing files.
Reseting device...
Requesting Reset...
Waiting for fastboot mode...
fastboot mode not found
Aborted.
Nothing happens thereafter.
Scenario 2
4. After reading few tips in the tpdebrick discussion in rootzwiki, after getting the fastboot mode not found message I manually reset the TP into Home+VolUp+Power mode
5. lsusb in sperate terminal window shows
Code:
Bus 002 Device 030: ID 18d1:d00d Google Inc.
6. running tpdebrick again continues further after fastboot message..
Code:
Response: ACK 0x00000000 (outstanding: 0)
Sending CloseFlush...
Done writing files.
Reseting device...
Requesting Reset...
Waiting for fastboot mode...
Loading TPToolbox-Headless ...
sending 'bootmem' (13200 KB)...
OKAY [ 0.827s]
writing 'bootmem'...
OKAY [ 2.924s]
finished. total time: 3.751s
Waiting for netchip mode... (may take 3+ mins)
Waiting for ping check... (may take 1-2 mins)
Checking/updating known_hosts...
Copying A6 files...
a6_firmware.txt.00 100% 48KB 48.3KB/s 00:00
PmA6Updater 100% 13KB 13.4KB/s 00:00
Copying bootloader files...
bootie-topaz305.bin 100% 113KB 112.8KB/s 00:00
emmc_appsboot.mbn 100% 45KB 44.7KB/s 00:00
Checking A6 firmware...
processing file: /tmp/a6_firmware.txt.00
A6 device: /dev/a6_0
2.13.10 (0x020d000a)
fw file size: 49461
fw file mapped at: 0x401a3000
Firmware verification complete
Updating A6 firmware...
Write failed: Broken pipe
A6 firmware update failed.
Aborted.
It takes hell lot of a time after the Updating A6 firmware message... almost half hour or more...
And that is where I am stuck right now... Hope this is of some help in figuring out the next steps...
Click to expand...
Click to collapse
I'm having the exact same issue on a 32GB 3G version of the Touchpad.
It always fails at the A6 flashing...
Redferne said:
I'm having the exact same issue on a 32GB 3G version of the Touchpad.
It always fails at the A6 flashing...
Click to expand...
Click to collapse
If you guys want to get these fixed, PM jcsullins and ask him to join you on IRC.
There are andriod 2.2.1 /2.3.3/2.3.4 os version for Touchpads in 2011(Never released).Andriod Version can flash back to webos. But need PalmWinDfuUtil/NovaDeviceInstaller/webos Tar files..etc
If use Tpdebrick 004 run to All Done. Will see flower type on the screen (The means into Revoery mode). Must use Nova Device Installer to flash the device.(Can not use doctor). But it will lost Wifi address and need to rewrite it....
Cannot get past Fastboot using TPDEBRICK 004
I posted the problem on RootzWiki, but essentially my 32GB 3G TP does not get past Fastboot:
Sending CloseFlush...
Done writing files.
Resetting device...
Requesting Reset...
Waiting for fastboot mode...
fastboot mode not found
Aborted.
Fastboot will work to communicate with the TP, but I don't know enough to troubleshoot the debrick scripts on my own.
lsusb reveals:
Bus 002 Device 015: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Is there anything that can be done manually via command line using fastboot? I'm not a Linux newbie, but i'm not a developer either.
So, I started digging because i'm curious...
in the tpdebrick script found the following:
devid_fastboot="18d1:d00d"
also found this:
echo "Reseting device..."
perl qdload.pl --lreset
echo "Waiting for fastboot mode..."
if ! `check_usbdevs 60 ${devid_fastboot}`
then
echo "fastboot mode not found"
echo "Aborted."
exit 1
fi
echo "Loading TPToolbox-Headless ..."
fastboot flash bootmem TPToolbox-Headless-v004
if [ $? -ne 0 ];
then
echo "TPToolbox-Headless load failed"
echo "Aborted."
exit 1
fi
So I sort of understand the script, but again i'm not a developer...
When I manually execute the perl command, I get the following result (is this a problem?):
[email protected]:~/Downloads/tpdebrick-v004# perl qdload.pl --lreset
Requesting Reset...
Invalid Response: 03 00 06
If the Invalid Response is correct, then it appears to be failing to execute the fastboot with the check_usbdevs devid.
Is there anyway to check the usbdevs and/or devid, and that these are correct?
[WIP]Dissecting the bootloader aka: get rid of annoying "Your device is corrupt"
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
I am thinking that bytes 0...4487 is the real bootloader code, so:
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Wow! Excited to see this! Thanks
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
foobar66 said:
This is WIP (work in progress) ... posting this as a separate thread to get other people involved so we can try to get rid of the annoying "Your device is corrupt" thing.
On the back of my thread on the splash screen (see https://forum.xda-developers.com/oneplus-6t/development/tool-splash-screen-modification-t3874158), @AnoopKumar and I started checking the bootloader.
The bootloader is in the partition called: abl_a (and/or abl_b) depending on whether you boot from A or B slot.
(https://forum.xda-developers.com/showpost.php?p=78409574&postcount=28)
All below is on Linux ... I am not a Windows guru ...
Take a raw dump of the abl_a partition. Reboot into TWRP, once there do: "adb shell".
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/abl_b of=/sdcard/img.abl_a
# <ctrl-D>
> adb pull /sdcard/img.abl_a
You will now have the dump of the bootloader partition in the file
Then, use "binwalk" to see what is inside the abl_a image:
Code:
> binwalk -e img.abl_a
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4488 0x1188 Certificate in DER format (x509 v3), header length: 4, sequence length: 1279
5771 0x168B Certificate in DER format (x509 v3), header length: 4, sequence length: 1133
6908 0x1AFC Certificate in DER format (x509 v3), header length: 4, sequence length: 1149
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 487624 bytes
I am thinking that bytes 0...4487 is the real bootloader code, so:
Code:
> head --bytes=4488 img.abl_b > abc
> file abc
abc: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, corrupted section header size
Not sure why it says "corrupt section header size".
Then check the detail of the ELF file:
Code:
> readelf abc
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x9fa00000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 3
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no sections to group in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
NULL 0x000000 0x00000000 0x00000000 0x00094 0x00000 0
NULL 0x001000 0x9fa30000 0x9fa30000 0x01988 0x02000 0x1000
LOAD 0x003000 0x9fa00000 0x9fa00000 0x30000 0x30000 RWE 0x1000
There is no dynamic section in this file.
There are no relocations in this file.
Dynamic symbol information is not available for displaying symbols.
No version information found in this file.
Elf file type is EXEC (Executable file)
Entry point 0x9fa00000
There are 3 program headers, starting at offset 52
The bootloader binary code is in the LOAD segment
More to follow later ... have to catch some sleep now ...
Click to expand...
Click to collapse
Good job, if needed i can help with the checking
tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
abl.img is not the bootloader i guess.
tech_head said:
It doesn't matter if you find it.
I don't think you can flash a modified BL partition and have the device boot.
This is part of secure boot. The notice will always be there with an unlocked BL.
It's on all devices that have ARM trust zone and secure boot, if they run Android.
This is part of Google's requirements.
Click to expand...
Click to collapse
On other devices they've been able to swap this image with another one to "hide" the message, to "get rid of it".
Would we sweet if we could get rid of the unlocked bootloader message too.
dennisbednarz said:
Would we sweet if we could get rid of the unlocked bootloader message too.
Click to expand...
Click to collapse
+1
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
Code:
> lsusb
Bus 001 Device 034: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
And then:
Code:
> dmesg
[ 9395.999112] usb 1-1: new high-speed USB device number 34 using xhci_hcd
[ 9396.149376] usb 1-1: New USB device found, idVendor=05c6, idProduct=9008
[ 9396.149380] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9396.149383] usb 1-1: Product: QUSB_BULK_CID:0402_SN:33B9DDAC
[ 9396.149386] usb 1-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 9396.150184] qcserial 1-1:1.0: Qualcomm USB modem converter detected
[ 9396.150372] usb 1-1: Qualcomm USB modem converter now attached to ttyUSB0
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Use this https://forum.xda-developers.com/oneplus-6t/how-to/tool-6t-msmdownloadtool-v4-0-oos-9-0-5-t3867448
Should try for several times with instruction here
Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.
patelparth120595 said:
Question - when does device show red warning? When u disable dm verity?
I unlocked and rooted but only had yellow warning, but when i installed aosp gsi i had a red warning. Once of the step to install the rom was flashing vbmeta and disabling dm verity.
Click to expand...
Click to collapse
Disabled dm-verity caused red warning, i guess.
---------- Post added at 10:01 AM ---------- Previous post was at 09:58 AM ----------
foobar66 said:
Well ... bad luck ... I tried to change abl_b and reflash it ... phone is sort of *dead* now.
Does no longer boot at all.
However, when I plug it into the PC, I can see:
And then:
So it is not completely *dead* but in some sort of Qualcomm low level mode. I found some info here: https://together.jolla.com/question...ss-modem-any-chance-to-bring-it-back-to-life/ but did not make any progress yet.
EDIT: looking at MsmDownloadTool to debrick the phone ...
Click to expand...
Click to collapse
Edited abl.img ? and flashed via recovery/fastboot ?
AnoopKumar said:
Edited abl.img ? and flashed via recovery/fastboot ?
Click to expand...
Click to collapse
No, just flashed using dd command in TWRP shell.
foobar66 said:
No, just flashed using dd command in TWRP shell.
Click to expand...
Click to collapse
Phone still dead ?
OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5
foobar66 said:
OK ... I managed to recover my phone !
A windows PC with the MSM program did the trick.
I am now back to stock 9.0.5
Click to expand...
Click to collapse
I assume that, there is nothing to do with the abl.img. Only thing we can do with it is change the default strings to a song lyric or something. abl.img is the uefi firmware i guess. Bootloader is using the images stored in the logo partition.
Gsi's flash without breaking verity if u flash to both slots. And totally format. Fastboot -w. The phone sees any changes to partitions as corruption and breaks verity, hence red warning.. if someone would be inclined to talk to invisiblek from the essential threads, he could tell u of a fix. The solution is not in abl. It's in the stock boot.img. if I had more time, I would help
---------- Post added at 02:52 PM ---------- Previous post was at 02:51 PM ----------
tech_head said:
Different issue.
They are not trying to get rid of the red warning but the yellow warning for an unlocked BL.
On this phone, if you have a "red" warning you use the MSMDownload tool and go back factory including locking the BL.
This is a different case.
Click to expand...
Click to collapse
No, they are talking about breaking verity also. Seems to be both messages, but more recently the broken verity message. Which there is two types, one u can boot from, one u cannot.
jacksummers said:
U guys should talk [email protected] We had this issue of broken verity with the essential phone and he came up with a redboot.img that u flash and it bootloops the phone and fixes verity. It keeps bootlooping till.it fixes it, then u flash a proper kernel and you are good. Cuz as It stands one can only resolve this properly with the tool
Click to expand...
Click to collapse
I would love that idea. That would be really nice to have on our device
Hi All.
Today i flashed TWRP on my phone Huawei P10 (europe version)
This works great so far so good.
I downloaded on this site and section:
1
VTR-L09C432E1R1P9B157 (9.0.1.157) the files:
update_full_VTR-L09_hw_eu.zip
update.zip
i cleaned cache/dalvik and i done a clean on internal storage.
then i say install :
HuRUpdater_0.3
boot no go...
then i install VTR-L09_hw_eu.zip
update.zip
but got allot of errors but i boots anyway....
It boots into PIE and touchscreen is not at correct place (its 3mm off) and i have no services with my provider (simcart not working)
when i take a closer look what software its running its:
model VKY
BUILD NR: LGRP2-OVS 9.0.1.163
EMUI 9.0.1
BASEBAND: 21C30B323S006C000
So its not VTR but i have PIE VKY... and i think the VKY got a different chipset for service provider then the VTR.
But my question is:
what am i doing wrong? do i need other flash file? can someone please point me to the good direction.
Regards.
Tim
Oke i discovered maybe the problem. I think its not flashing at all.. and the VKY is a wrong downloaded img from erecovery (i tryed that also) he connected thru wifi before and downloaded a img from huawei site.
When i flash update i got these msg:
installing zip file /external_sd/update/update.zip
no digest file found
script succeeded /data
script succeeded false
write radio image
check_write_data_to_partition,write data error
update_huawei_pkg_from_ota_zip update package from zip failed
E: unknown command errno
E: unknown command subproccesresult
updater ended with error 9
error installing zip file
updating partition details
...done.
update: and i hope someone would help me..
I have now TWRP only.
But for some reason i cant install the images i download. So i dont get a OS installed.
Can please someone help me
regards, Tim
is it possible that this is the problem:
c:\Users\Tim\Desktop\w>fastboot flash recovery twrp.img
target reported max download size of 471859200 bytes
sending 'recovery' (32034 KB)...
OKAY [ 0.693s]
writing 'recovery'...
FAILED (remote: partition length get error)
finished. total time: 0.705s
c:\Users\Tim\Desktop\w>fastboot flash recovery_ramdisk twrp.img
target reported max download size of 471859200 bytes
sending 'recovery_ramdisk' (32034 KB)...
OKAY [ 0.695s]
writing 'recovery_ramdisk'...
OKAY [ 0.301s]
finished. total time: 1.001s
Only recovery_ramdisk gives me TWRP not like the tutorials tell me todo (recovery)
Sorry, my English very bad. I have Mi A2 with bootloop. Bootloader locked. I tried to flash three different firmwares using MiFlash, but was getting one error. it 1st image.
Later it seems I changed my MiFlash version and got another error, this is the second image. What do these errors mean?
Me_gusta_98 said:
Sorry, my English very bad. I have Mi A2 with bootloop. Bootloader locked. I tried to flash three different firmwares using MiFlash, but was getting one error. it 1st image.
Later it seems I changed my MiFlash version and got another error, this is the second image. What do these errors mean?
Click to expand...
Click to collapse
Don't know what that means but 'ack' should refer to "android common kernels".
I found a few videos searching for "Android Ack count don't match". Maybe you could try their solutions / methods.
User699 said:
Don't know what that means but 'ack' should refer to "android common kernels".
I found a few videos searching for "Android Ack count don't match". Maybe you could try their solutions / methods.
Click to expand...
Click to collapse
I saw it, there Indians install the beta version of MiFlash and everything is fine. But the beta version does not work for me, it does not see the file "flash_all.bat"
Me_gusta_98 said:
I saw it, there Indians install the beta version of MiFlash and everything is fine. But the beta version does not work for me, it does not see the file "flash_all.bat"
Click to expand...
Click to collapse
Maybe try an older (beta) version. It could be a problem in the current release which didn't occur in prior releases.
I have the same problem with a brand new Mi A2
Stuck at the androidone bootlogo.
Entering fastboot works without problems.
Flashing results in this error: FAILED (remote: 'Error flashing partition : Write Protected')
No matter which slot is used.
Unlocking via fastboot tells me that everything is already unlocked.
Booting the twrp image from fastboot gets stuck at the twrp logo.
This also happens with the patched twrp_4pda version.
This [GUIDE] Flashing ROMs with TWRP black screen post seemed helpful and adb shell works.
But sending commands like twrp wipe cache results in:
TWRP does not appear to be running. Waiting for TWRP to start . . .
Code:
fastboot --set-active=b
fastboot flash boot_b twrp.img
fastboot --set-active=a
fastboot flash boot_a twrp.img
fastboot flashing unlock
fastboot flashing unlock_critical
fastboot oem unlock
fastboot boot twrp.img
adb shell
twrp wipe cache
Entering EDL mode via fastboot works without problems.
I installed the qualcomm 9008 drivers (windows 10 driver signature verification had to be disabled) and the phone in edl mode appears.
Downloaded the Mi A2 global fastboot rom
I tried all miflash versions (2015 to 2018 and beta) ... they had various bugs
XiaoMiFlash.Config --> rename to XiaoMiFlash.exe.Config
generate "Log" folder
place rom files inside miflash folder ... avoid any long/special path names
In the end they all start flashing and fail with "no Binary dump" or "ACK count don't match".
I also tried a different PC, different USB cable and fastboot on linux.
Is there anything else that could be done or is time to consider a hardware failure (broken emmc ...?) ?
#### update ###
fastboot format userdata
.... works and writes something without error
fastboot format cache / fastboot erase cache
... FAILED (remote: 'Error flashing partition : Write Protected')
I was able to get into stock recovery (hold VolUp+Power --> "no command" --> hold again).
wipe data / factory reset --> getting stuck forever on "wiping data..." screen
Apply Update from ADB --> adb sideload miui.zip also gets stuck forever
calling fastboot -w results in:
Spoiler: error code
Erasing 'userdata' OKAY [ 0.081s]
mke2fs 1.46.2 (28-Feb-2021)
Creating filesystem with 4652023 4k blocks and 1163264 inodes
Filesystem UUID: 969bf7be-a1e1-11ec-9ff1-f15f995f2a7c
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000
Allocating group tables: done
Writing inode tables: done
Creating journal (32768 blocks): done
Writing superblocks and filesystem accounting information: done
Sending 'userdata' (180 KB) OKAY [ 0.011s]
Writing 'userdata' OKAY [ 0.000s]
Erasing 'cache' OKAY [ 0.002s]
mke2fs 1.46.2 (28-Feb-2021)
Creating filesystem with 65536 4k blocks and 65536 inodes
Filesystem UUID: 96ab61ae-a1e1-11ec-aed9-d92ea3a1e9cc
Superblock backups stored on blocks:
32768
Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
Sending 'cache' (56 KB) FAILED (remote: 'Error: Last flash failed : Write Protected')
fastboot: error: Command failed
I have tried to mod my Nokia Lumia 930. My bootloader was already unlocked for side loading. Now I wanted to mod Astoria on it so that I can also use Android apps. However, Windows Phone Internals kept telling me that my phone is already unlocked. When starting the Mass Storage Mode and Enabled Toor Access, the message of the missing FFU appeared.
After trying to reflash, I entered the red bootloop and could no longer access the phone. The recovery tool also failed here.
When using the Thor2 tool manually, the following message appeared:
Bash:
PS C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool> .\thor2.exe -mode uefiflash -ffufile "..\..\..\Users\myUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu"
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
............
programming operation failed!
327681 Error: Unable to send or receive message.
Operation took about 8.00 seconds. Average transfer speed was 2.65 MB/s.
THOR2_ERROR_UNABLE_TO_SEND_OR_RECEIVE_MESSAGE_DURING_SFFU_PROGRAMMING
The phone went off and since then it is not responding. Also not on the power button or the combo power button + volume down.
Full Log:
Spoiler
Bash:
PS C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool> .\thor2.exe -mode uefiflash -ffufile "..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu"
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\thor2.exe -mode uefiflash -ffufile ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
Process started Thu Dec 29 21:58:12 2022
Logging to file C:\Users\MyUser\AppData\Local\Temp\thor2_win_20221229215812_ThreadId-51424.log
Debugging enabled for uefiflash
Initiating FFU flash operation
WinUSB in use.
isDeviceInNcsdMode
isDeviceInNcsdMode is false
Device mode 6 Uefi mode
[THOR2_flash_state] Pre-programming operations
Disable timeouts
Get flashing parameters
Lumia Flash detected
Protocol version 2.34 Implementation version 2.59
Size of one transfer is 2363392
MMOS RAM support: 1
Size of buffer is 2359296
Number of eMMC sectors: 61071360
Platform ID of device: Nokia.MSM8974.P6180.2.2
Async protocol version: 01
Security info:
Platform secure boot enabled
Secure FFU enabled
JTAG eFuse blown
RDC not found
Authentication not done
UEFI secure boot enabled
SHK enabled
Device supports FFU protocols: 0015
Subblock ID 32
[THOR2_flash_state] Device programming started
Using secure flash method
CoreProgrammer version 2015.06.10.001.
Start programming signed ffu file ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
FfuReader version is 2015061501
Send FlashApp write parameter: 0x4d544f00
Perform handshake with UEFI...
Flash app: Protocol Version 2.34 Implementation Version 2.59
Unknown sub block detected. Skip...
DevicePlatformInfo: Nokia.MSM8974.P6180.2.2
Unknown sub block detected. Skip...
Unknown sub block detected. Skip...
Supported protocol versions bitmap is 15
Secure FFU sync version 1 supported.
Secure FFU async version 1 supported.
Secure FFU sync version 2 supported.
Secure FFU async version 2 supported.
CRC header v. 1
CRC align bytes. 4
Get CID of the device...
Get EMMC size of the device...
Emmc size in sectors: 61071360
CID: Samsung, Size 29820 MB
Start charging...
Start charging... DONE. Status = 0
ConnSpeedEcho: Elapsed= 0.212000, EchoSpeed= 31.84, Transferred= 7077918 bytes
Get security Status...
Security Status:
Platform secure boot is enabled.
Secure eFUSE is enabled.
JTAG is disabled.
RDC is missing from the device.
Authentication is not done.
UEFI secure boot is enabled.
Secondary HW key exists.
Get RKH of the device...
RKH of the device is 800EEB508F7BBDF12A19262621FD837297A3B062FE2A7078C0F3167E57F21217
Get ISSW Version...
ISSW Version: 216
Mon Aug 11 15:16:52 EEST 2014;ISSW v0216; main; OS; DNE; KCI 1296; ASIC 8974;
Get system memory size...
Size of system mem: 2097152 KB
Read antitheft status...
Requested read param 0x41545250 is not supported by this flash app version.
Send backup to RAM req...
Clearing the backup GPT...SKIPPED!
Successfully parsed FFU file. Header size: 0x000e0000, Payload size: 0x000000006f400000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000e0000
RKH match between device and FFU file!
Option: Skip CRC32 check in use
Start sending header data...
Start sending payload data V2Sbl in async mode...
Percents: 0
Percents: 1
Exception during programming: 262160
Safe write descriptor index reached: false
Payload data transfer speed (16.88 MB/s) Elapsed time 1.33 sec
Payload data size 22.500305 MB
[IN] programSecureFfuFile. Closing ..\..\..\Users\MyUser\Downloads\windowsphone-deploy\Repository\RM-1045\RM1045_02540.00019.15234.50006_RETAIL_prod_signed_1012_02699D_000-DE.ffu
programming operation failed!
327681 Error: Unable to send or receive message.
Operation took about 8.00 seconds. Average transfer speed was 2.65 MB/s.
THOR2_ERROR_UNABLE_TO_SEND_OR_RECEIVE_MESSAGE_DURING_SFFU_PROGRAMMING
THOR2 1.8.2.18 exited with error code 262160 (0x40010)
This means your phone is hardbricked you should take it to the service center
Is der a solution without service center? Its out of support.
Huskynarr said:
Is der a solution without service center? Its out of support.
Click to expand...
Click to collapse
does jtag work?
Nope, doesnt work. Have send it now back to seller.