[HELP] "OLD" Xiaomi A2 Stuck in Bootloop after UPDATE - Xiaomi Mi A2 / 6X Questions & Answers

! CLOSE PLS !
Hi Guys,
a friend had his bricked A2 lying arround (for a year now i guess) and he gave it to me with the premise: If i can fix it i can keep it.
So now after reading a lot of Threads and Tutorials installing the USB Drivers and ADB Tools i came to the point where i cant find other solutions except the solution where I need to disamble the Phone and do the recovery by the "EDL Method".
I know this topic seems kinda unsolvable and there is a lot of Threads for it, i just wanted to be sure that i didnt miss a thing.
So I appreciate any Help and since i am new to the topic dont be too harsh with me
Device:
-USB Debugging is disabled
-I cant boot in recovery mode (vol-UP+Power) just boots to the white androidOne Screen and there it hangs
- I can enter fastboot(VOL-Down+power) mode
- My bootloader is locked.
I tried to unlock it but since no PC would recognize the Phone there is really no Deal to do anything with it via ADB and or similiar tools (MI FLASH, several deblocking tools)
I installed all necessary Drivers followed several Tutorials. Everything under WIN 10.
My Laptop (and other PCs) wouldnt recognize the Phone at any circumstances (Changed cables and USB Ports).
So i hope that answers some questions upfront.
Thanks for your Help!:fingers-crossed::good:

Did you solved it? i have the same problem too

cesarguaro said:
Did you solved it? i have the same problem too
Click to expand...
Click to collapse
No not really. My PC is recognizing the Phone but still not abled to flash a ROM or anything in this direction. All the commands over ADB are "locked". So i will try the EDL Mode next week and tell you if it worked.

lono.O said:
No not really. My PC is recognizing the Phone but still not abled to flash a ROM or anything in this direction. All the commands over ADB are "locked". So i will try the EDL Mode next week and tell you if it worked.
Click to expand...
Click to collapse
Hi bro, i fixed it my phone, i did a edl flash with the latest global rom stable android 10 and its working, remember on miflash set the option to clean all only...
After that the phone boot up with no issues...

I'm trying to enter EDL mode right now by shorting the two pin, but all I get is either:
"Flashing is not allowed in Lock State"
or "Missmatching image and device"
I'm using jasmine_global_images_V11.0.11.0.QDIMIXM_10.0 with Xiaomi Mi A2.

cnxsoft said:
I'm trying to enter EDL mode right now by shorting the two pin, but all I get is either:
"Flashing is not allowed in Lock State"
or "Missmatching image and device"
I'm using jasmine_global_images_V11.0.11.0.QDIMIXM_10.0 with Xiaomi Mi A2.
Click to expand...
Click to collapse
That`s happen because the edl mode is not detecting well the phone bro... in edl mode the phone must be detected like a port com device... you should check that...
I follow a tutorial on youtube, my device is lock too and with that tutorial i fixed it...
https://www.youtube.com/watch?v=5JaSIKoDDGg&t=107s

Yes, I think the problem is that I can't enter EDL mode. What should be the status of the phone when shorting the two pins? I can't turn it off, so I just put it in Fastboot mode, short the pins, and connect the USB-C from my PC. Is that supposed to work that way? In the video, he says the battery must be disconnected. If that a correct translation? Because I can see his battery is still in place.

cnxsoft said:
Yes, I think the problem is that I can't enter EDL mode. What should be the status of the phone when shorting the two pins? I can't turn it off, so I just put it in Fastboot mode, short the pins, and connect the USB-C from my PC. Is that supposed to work that way? In the video, he says the battery must be disconnected. If that a correct translation? Because I can see his battery is still in place.
Click to expand...
Click to collapse
OK. So the reason was I did not disconnect the battery... Maybe of the instructions on the web forget to mention this little detail...
I can see the Qualcomm COM port, and I can start flashing, but it quickly fails:
Code:
[12:09:44 AM]:3 COM3 12.0139016s resdump:<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: SDCC Error 29 (3)"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Write Failed sector 512, size 97"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to write 1 slot 0, partition 512, start_sector 97 num_sectors 0, error 3"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Finished programming start_sector 609 and TotalSectorsToProgram 97"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" />
</data>
Based on what I can see on the web, it looks like an hardware error (flash related). Not really surprised as the phone started to get fairly slow recently, and almost always full.
I've bought a new phone, since Xiaomi Mi A2 looks dead. I haven't had very good experience so far with Xiaomi. A1 lasted about a year due to eMMC flash failire, and A2 for about 20 months.

Related

Changing CSC?

I've not found a single I9000XEE* CSC among the leaked firmwares, so I'm thinking something rather different here.
Can't we just fake the CSC-region/version to get a phone back to the original Kies update path?
I've tried to extract the rfs-image in a csc-file to see what files it contains, but I have failed. No matter what I do it just doesn't want to mount the image anywhere, probably some silly noob-thing on my side.
But seriously, if we can just edit the apropriate files, shouldn't we be able to trick Kies into thinking any phone is from any region?
In worst case, it should be possible to copy the CSC-files from a phone with original firmware and just put them into an update.zip and get onto the "right" update path instantly... (assuming Kies updates by looking at CSC only, which is what I believe)
Anything I don't know that might prevent this from being possible?
I'm also looking for a way to get mine back to a XEE CSC with hopes to trigger a official Kies update. I was thinking to start trying out various firmware versions to see if I could find one with the XEE available in the Sales Code menu, do you think that would be enough?
If you want to get an official upgrade from Kies just fake the communication with the Kies server in order to download the official firmware, then flash it onto the phone with Odin (or Heimdall in the future).
I've posted this once before but here it is again for reference:
HTML:
Code:
POST /MS_TEST/msfus.php HTTP/1.1
Content-Type: appliction/x-www-form-urlencoded
User-Agent: SAMSUNG_KIES
Host: fus.samsungmobile.com
Content-Length: 1146
Expect: 100-continue
Connection: Keep-Alive
<?xml version="1.0" encoding="UTF-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>0</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Put>
<CmdID>1</CmdID>
<UPGRADE_MODE>
<Data>0</Data>
</UPGRADE_MODE>
<CLIENT_LANGUAGE>
<Type>String</Type>
<Type>ISO 3166-1-alpha-3</Type>
<Data>0809</Data>
</CLIENT_LANGUAGE>
<CLIENT_PRODUCT>
<Data>Kies</Data>
</CLIENT_PRODUCT>
<CLIENT_VERSION>
<Data>1.5.1.10071.32</Data>
</CLIENT_VERSION>
<DEVICE_ANDROID_PDA_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_PDA_VERSION>
<DEVICE_ANDROID_CSC_VERSION>
<Data>I9000OXXJM1</Data>
</DEVICE_ANDROID_CSC_VERSION>
<DEVICE_ANDROID_PHONE_VERSION>
<Data>I9000XXJM1</Data>
</DEVICE_ANDROID_PHONE_VERSION>
<DEVICE_ANDROID_CONTENTS_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_CONTENTS_VERSION>
<DEVICE_PLATFORM>
<Data>AndroidGSM</Data>
</DEVICE_PLATFORM>
<DEVICE_MODEL_NAME>
<Data>GT-I9000</Data>
</DEVICE_MODEL_NAME>
<DEVICE_FW_VERSION>
<Data>I9000XWJM2/I9000OXXJM1/I9000XXJM1/I9000XWJM2</Data>
</DEVICE_FW_VERSION>
<DEVICE_BUYER_CODE>
<Data>XW</Data>
</DEVICE_BUYER_CODE>
<DEVICE_PRODUCT_CODE>
<Data>XEU</Data>
</DEVICE_PRODUCT_CODE>
</Put>
<Get>
<CmdID>2</CmdID>
<LATEST_FW_VERSION/>
</Get>
</FUSBody>
</FUSMsg>
HTML:
Code:
X-Cache-Result : -
Connection: close
<?xml version="1.0" encoding="utf-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>354156</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Results>
<CmdRef>2</CmdRef>
<Status>400</Status>
<LATEST_FW_VERSION>
<Data></Data>
</LATEST_FW_VERSION>
</Results>
<Put>
<CmdID>1</CmdID>
</Put>
</FUSBody>
</FUSMsg>
Here's modified JM2 XEE-CSC for JM5. I just corrected file permissions inside the tar file. Flash as CSC file with Odin with JM5 files.
It also removes all the Russian crap that comes with JM5.
http://www.multiupload.com/491XB93U5T
Benjamin Dobell said:
If you want to get an official upgrade from Kies just fake the communication with the Kies server in order to download the official firmware, then flash it onto the phone with Odin (or Heimdall in the future).
I've posted this once before but here it is again for reference:
HTML:
Code:
POST /MS_TEST/msfus.php HTTP/1.1
Content-Type: appliction/x-www-form-urlencoded
User-Agent: SAMSUNG_KIES
Host: fus.samsungmobile.com
Content-Length: 1146
Expect: 100-continue
Connection: Keep-Alive
<?xml version="1.0" encoding="UTF-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>0</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Put>
<CmdID>1</CmdID>
<UPGRADE_MODE>
<Data>0</Data>
</UPGRADE_MODE>
<CLIENT_LANGUAGE>
<Type>String</Type>
<Type>ISO 3166-1-alpha-3</Type>
<Data>0809</Data>
</CLIENT_LANGUAGE>
<CLIENT_PRODUCT>
<Data>Kies</Data>
</CLIENT_PRODUCT>
<CLIENT_VERSION>
<Data>1.5.1.10071.32</Data>
</CLIENT_VERSION>
<DEVICE_ANDROID_PDA_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_PDA_VERSION>
<DEVICE_ANDROID_CSC_VERSION>
<Data>I9000OXXJM1</Data>
</DEVICE_ANDROID_CSC_VERSION>
<DEVICE_ANDROID_PHONE_VERSION>
<Data>I9000XXJM1</Data>
</DEVICE_ANDROID_PHONE_VERSION>
<DEVICE_ANDROID_CONTENTS_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_CONTENTS_VERSION>
<DEVICE_PLATFORM>
<Data>AndroidGSM</Data>
</DEVICE_PLATFORM>
<DEVICE_MODEL_NAME>
<Data>GT-I9000</Data>
</DEVICE_MODEL_NAME>
<DEVICE_FW_VERSION>
<Data>I9000XWJM2/I9000OXXJM1/I9000XXJM1/I9000XWJM2</Data>
</DEVICE_FW_VERSION>
<DEVICE_BUYER_CODE>
<Data>XW</Data>
</DEVICE_BUYER_CODE>
<DEVICE_PRODUCT_CODE>
<Data>XEU</Data>
</DEVICE_PRODUCT_CODE>
</Put>
<Get>
<CmdID>2</CmdID>
<LATEST_FW_VERSION/>
</Get>
</FUSBody>
</FUSMsg>
HTML:
Code:
X-Cache-Result : -
Connection: close
<?xml version="1.0" encoding="utf-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>354156</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Results>
<CmdRef>2</CmdRef>
<Status>400</Status>
<LATEST_FW_VERSION>
<Data></Data>
</LATEST_FW_VERSION>
</Results>
<Put>
<CmdID>1</CmdID>
</Put>
</FUSBody>
</FUSMsg>
Click to expand...
Click to collapse
before realizing this, i almost tell him to copy the old csc to the new one
Benjamin Dobell said:
If you want to get an official upgrade from Kies just fake the communication with the Kies server in order to download the official firmware, then flash it onto the phone with Odin (or Heimdall in the future).
Click to expand...
Click to collapse
I tried playing around a little bit with this. I made a request with the version data from a friends phone which is running official firmware and does show an available update in Kies. However, the reply is does not contain any firmware information. I'll attempt to get access to his phone again and fire up Wireshark and see what's going on.
terje.tel said:
I tried playing around a little bit with this. I made a request with the version data from a friends phone which is running official firmware and does show an available update in Kies. However, the reply is does not contain any firmware information. I'll attempt to get access to his phone again and fire up Wireshark and see what's going on.
Click to expand...
Click to collapse
Yeah, you'll need to run Wireshark and observe a Kies update (or at least the download of the update). I would do so myself however my phone is off being repaired. Please share your findings though.
Laum said:
Here's modified JM2 XEE-CSC for JM5. I just corrected file permissions inside the tar file. Flash as CSC file with Odin with JM5 files.
It also removes all the Russian crap that comes with JM5.
Click to expand...
Click to collapse
So what'll this mean exactly? Will it trigger an official Kies update when a new Nordic FW comes up? You also mentioned that this was a modified version. Where did you find the original? I'm still new to this, so I'm a bit confused.
Benjamin Dobell said:
If you want to get an official upgrade from Kies just fake the communication with the Kies server in order to download the official firmware, then flash it onto the phone with Odin (or Heimdall in the future).
I've posted this once before but here it is again for reference:
HTML:
Code:
POST /MS_TEST/msfus.php HTTP/1.1
Content-Type: appliction/x-www-form-urlencoded
User-Agent: SAMSUNG_KIES
Host: fus.samsungmobile.com
Content-Length: 1146
Expect: 100-continue
Connection: Keep-Alive
<?xml version="1.0" encoding="UTF-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>0</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Put>
<CmdID>1</CmdID>
<UPGRADE_MODE>
<Data>0</Data>
</UPGRADE_MODE>
<CLIENT_LANGUAGE>
<Type>String</Type>
<Type>ISO 3166-1-alpha-3</Type>
<Data>0809</Data>
</CLIENT_LANGUAGE>
<CLIENT_PRODUCT>
<Data>Kies</Data>
</CLIENT_PRODUCT>
<CLIENT_VERSION>
<Data>1.5.1.10071.32</Data>
</CLIENT_VERSION>
<DEVICE_ANDROID_PDA_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_PDA_VERSION>
<DEVICE_ANDROID_CSC_VERSION>
<Data>I9000OXXJM1</Data>
</DEVICE_ANDROID_CSC_VERSION>
<DEVICE_ANDROID_PHONE_VERSION>
<Data>I9000XXJM1</Data>
</DEVICE_ANDROID_PHONE_VERSION>
<DEVICE_ANDROID_CONTENTS_VERSION>
<Data>I9000XWJM2</Data>
</DEVICE_ANDROID_CONTENTS_VERSION>
<DEVICE_PLATFORM>
<Data>AndroidGSM</Data>
</DEVICE_PLATFORM>
<DEVICE_MODEL_NAME>
<Data>GT-I9000</Data>
</DEVICE_MODEL_NAME>
<DEVICE_FW_VERSION>
<Data>I9000XWJM2/I9000OXXJM1/I9000XXJM1/I9000XWJM2</Data>
</DEVICE_FW_VERSION>
<DEVICE_BUYER_CODE>
<Data>XW</Data>
</DEVICE_BUYER_CODE>
<DEVICE_PRODUCT_CODE>
<Data>XEU</Data>
</DEVICE_PRODUCT_CODE>
</Put>
<Get>
<CmdID>2</CmdID>
<LATEST_FW_VERSION/>
</Get>
</FUSBody>
</FUSMsg>
HTML:
Code:
X-Cache-Result : -
Connection: close
<?xml version="1.0" encoding="utf-8"?>
<FUSMsg>
<FUSHdr>
<ProtoVer>1.0</ProtoVer>
<SessionID>354156</SessionID>
<MsgID>1</MsgID>
</FUSHdr>
<FUSBody>
<Results>
<CmdRef>2</CmdRef>
<Status>400</Status>
<LATEST_FW_VERSION>
<Data></Data>
</LATEST_FW_VERSION>
</Results>
<Put>
<CmdID>1</CmdID>
</Put>
</FUSBody>
</FUSMsg>
Click to expand...
Click to collapse
Where these 2 scripts are located..under Kies folder ? or inside phone?
Benjamin Dobell said:
If you want to get an official upgrade from Kies just fake the communication with the Kies server in order to download the official firmware, then flash it onto the phone with Odin (or Heimdall in the future).
I've posted this once before but here it is again for reference:
Click to expand...
Click to collapse
Hi Ben,
Can you post some information about how we could use this HTML code to download an official firmware directly from the samsung servers? I'm not too good with HTML unfortunately. I'd like to get the official UK firmware if that is possible. I heard that JM3 and even JM6 is out there.
Thanks!
bub181 said:
Can you post some information about how we could use this HTML code to download an official firmware directly from the samsung servers? I'm not too good with HTML unfortunately. I'd like to get the official UK firmware if that is possible. I heard that JM3 and even JM6 is out there.
Click to expand...
Click to collapse
After my latest success in flashing back to stock (JM2/JM1 for me here in Norway) just now, I would guess that doing the edit trick in Registry will allow any firmware to be downloaded as long as the right codes that are allowed to upgrade to that firmware is found. So, I expect there to be no need to fake the communication with the FUS servers.
Hi all,
I'm working on a tool to do precisely this: intercept and modify the communication between Kies and the update server while Kies is running, to allow you to upgrade. Please look forward to a separate topic. Help from people who get an upgrade offered by Kies or know how to get it to do so is very welcome!
miki4242 said:
I'm working on a tool to do precisely this: intercept and modify the communication between Kies and the update server while Kies is running, to allow you to upgrade. Please look forward to a separate topic. Help from people who get an upgrade offered by Kies or know how to get it to do so is very welcome!
Click to expand...
Click to collapse
Please see my post linked below about tricking Kies using the registry:
http://forum.xda-developers.com/showpost.php?p=7806120&postcount=183
Thanks a lot for the info

Completely stuck..possibly broken legend..

Hi guys, had a perfectly working legend running CM7, been helping a mate root his phone so I downloaded a rom onto my phone (we had no sd card readers), swapped out my sd card into his and all was well.
Placed the card back in my legend and now:
Cant see the sdcard/phone on my computer when attached through USB.
The phone cant see ANY SDcard I place inside it (tried 2).
Phone cant seem to USB charge either on or off.
When I connect to the computer when its on, the charge icon appears and a minute later disappears no longer seems to register charging whilst on. But whilst off the phone displays the usual red led light for a minute, then starts flashing red and green led, wtf is going on?
Running adb I can get it to register with adb devices.
Running the R4-Legend recovery bat starts the process, then stops i cant see the error...
Cant get to cwm since i cant run the recovery program (above) i can get to the red triangle with exclamation mark screen..
WTF have I done? Have i physically broken it when i put the sd card back in?
Im not sure if this is usb bricked as I should be able to see the sd card on the phone right?
Try usb unbrick.
Sent from my Legend using XDA App
I had the same problem and this is definately usb brick
The solution is in the following thread
http://forum.xda-developers.com/showthread.php?t=751265
And if that doesn't work, hopefully you are able to flash back to a stock firmware? Mine started ****ing with me like that, and I got to restore it just before it fully started to reject all my SD-cards.. Shipped it in for service, got it back working perfectly. The reason was a faulty motherboard. I hope your phone is just USB-bricked, though! GL, mate!
pesaroso said:
And if that doesn't work, hopefully you are able to flash back to a stock firmware? Mine started ****ing with me like that, and I got to restore it just before it fully started to reject all my SD-cards.. Shipped it in for service, got it back working perfectly. The reason was a faulty motherboard. I hope your phone is just USB-bricked, though! GL, mate!
Click to expand...
Click to collapse
Language...
Thanks for the help guys, trying to do this on the sly at work...
So far ive managed to get the android 1 drivers installed, adb sdk, hoping it works as its my pride and joy I know which phone im getting next but id rather not have to buy a poor nokia brick to get me by..
TheGrammarFreak, cheers for helping remind me to keep my own language in check... although a nugget of help might of gone amiss..
Hope I can get this sorted, running out of battery quick..
You have the advice you need.
Right well, the plot thickens. Following the USB Unbrick guide I can get as far as having the 2 files I need on the sd card but they cannot be read.
The sdcard cannot be mounted/read.
Gone into fastboot usb mode on the phone.
Used the fastboot devices via windows cmd shell: gotten a serial so i know its working and connected and usb charging seems to of been alleviated (although no usb drive is available when connected in windows).
Used fastboot oem enableqxdm 0 in windows cmd shell (multiple times ive tried so theres no sp) it says it works, then fastboot reboot but alas Still no sd card present when the device loads..
Im at a loss now.. will continue pursuing this
How rude, I didnt include my logfile... getting quite worried now.
C:\android_sdk\android_windows\tools>fastboot devices
HT03KNX0XXXXX fastboot
C:\android_sdk\android_windows\tools>fastboot oem enableqxdm 0
... OKAY [ 0.018s]
finished. total time: 0.018s
C:\android_sdk\android_windows\tools>fastboot oem boot
... INFOsetup_tag addr=0x60000100 cmdline add=0x9D
078D14
INFOTAG:Ramdisk OK
INFOTAG:smi ok, size = 0
INFOTAG:hwid 0x0
INFOTAG:skuid 0x22F00
INFOTAG:hero panel = 0x0
INFOTAG:engineerid = 0x0
INFOMCP dual-die
INFOMCP dual-die
INFOTAG:mono-die = 0x0
INFODevice CID is not super CID
INFOCID is HTC__001
INFOsetting->cid::HTC__001
INFOserial number: HT03KNX01884
INFOcommandline from head: no_console_suspend=1 console=null
INFOcommand line length =439
INFOactive commandline: board_legend.disable_uart3=0 board_legen
INFOd.usb_h2w_sw=0 board_legend.disable_sdcard=0 diag.enabled=0
INFOboard_legend.debug_uart=0 smisize=0 userdata_sel=0 androidbo
INFOot.emmc=false androidboot.baseband=7.05.35.26L androidboot.
INFOcid=HTC__001 androidboot.carrier=HTC-WWE androidboot.mid=PB7
INFO610000 androidboot.keycaps=qwerty androidboot.mode=normal an
INFOdroidboot.serialno=HT03KNX01884 androidboot.bootloader=0.43.
INFO0001 no_console_suspend=1 console=null
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=cache
INFOaARM_Partion[5].name=userdata
INFOpartition number=6
INFOValid partition num=6
INFOmpu_nand_acpu_rw 8F2 1000
FAILED (status read failed (Too many links))
finished. total time: 0.911s
C:\android_sdk\android_windows\tools>

[Q] UMS/USB mass storage for external SD in TWRP or while booted?

I've searched the forum but for the first time RTFM-ing has failed me. Is there anyway to get the phone into UMS mode either in recovery or while booted?
I've already tried the
Code:
adb pull /system/framework/framework-res.apk........... android:allowMassStorage="true"
trick (which worked on my last phone but didn't work this time. Also in TWRP 2.6.1.0 the mount usb storage option isn't working.
Any help would be appreciated.
A bit more info...
Just a few more details; I'm running OliverG96's cm-10.1-20130825-UNOFFICIAL-golden ROM from this thread for the i8190n. And the framework mod i tried was this one but it had two line that looked like this
Code:
<storage android:mountPoint="/storage/sdcard0" android:storageDescription="@string/storage_internal" android:primary="true" android:emulated="true" android:mtpReserve="100" />
<storage android:mountPoint="/storage/sdcard1" android:storageDescription="@string/storage_sd_card" android:primary="false" android:removable="false" />
instead of just the one that i expected.

How To Unbricked A Hard Bricked Phone [ Moto X ]

How To UnBrick A Hard Bricked Moto X​
Hii , First of all I wanna thanks to this awesome scrpit by @s5610 who brought my phone from dead to alive , I think i am the first guy to unbricked the hardbricked phone using this script lol , My phone was hardbricked because i was testing my kernel and entered wrong path in partition due to which i got hard bricked i was worried for my phone , Service Center was asking for 7k in Indian Rupees , i was hopeless then i gave a try to this method , followed all steps written here and then finally i entered to fastboot menu of 30.B7 Kitkat As i was using 30.B7 Bootloader earlier and then i flashed My gpt.bin and S-partition and flashed my stock rom voilla !! and my phone booted the aim was to share this post was this method was on page 42 and only less guys have seen this post , so i created a new thread regarding this
All Credits Goes to - @s5610​
s5610 said:
Unbricking Guide for any Moto X Gen 1 (wire trick)​
Download, and unpack supplied zip to any disk, C: or D:, in root folder. Install driver by launching Qusb.drv.inst.msi, then open Windows' Device Manager, and see if you got "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
If yes, you see it, go to software part below. If it's not there, a full disassemble of the phone is needed to get close to back side of motherboard (google for "iFixit Teardown Moto X Guide" for step-by-step instruction).
So, when you are inside, disconnect the battery first. No need to pull it out, it's glued. Now get to back side of motherboard, and very very gently gain access to the lower left corner of ARM+DRAM shield (see picture). I've done it with Stanley knife. Also you can use miniature nippers - but very carefuly! Once you get access to inner space of shield, use tiny wire to short special pin to the ground (see picture), then connect USB cable, and in the moment when you see "QHSUSB_DLOAD" device (or "Qualcomm HS-USB QDLoader 9008" if driver is installed) pop out in Windows' Device Manager, quickly remove the wire. The goal is to have "Qualcomm HS-USB QDLoader 9008" in "COM & LPT ports" section of Device Manager. If it is achieved, we are done with hardware, and move on to soft part.
Now software part. Go to unzipped C:\Python27 folder, launch bat-file, and wait until finish:
RUN_blank_bootloader_flash.bat
(if you got error like "No data read from USB..." etc, just skip to next step)
Next launch either
- .Boot_KK_4.4.2_B4.exe,
or .Boot_KK_4.4.4_B7.exe,
or .Boot_LP_5.0.2_BC.exe,
or .Boot_LP_5.1.0_BD.exe,
or .Boot_LP_5.1.0_BE.exe
- depends on Android version your phone has last time. If you don't know what you need, begin with first one.
Wait 10 seconds, then launch next bat-file, and wait until finish:
RUN_moto_x_bootloader_flash.bat
Phone should go into fastboot mode! If it doesn't, repeat previous step trying higher version. But don't try to flash BC, BD, and BE, if you didn't install Lollipop on this phone!
OK. Disconnect the USB cable, connect the battery, connect again USB cable (fastboot don't work, if don't see battery). Launch next bat-file:
RUN_gpt.bin_flash.bat
The phone will get in fastboot, ready to be flashed by appropriate firmware. If it is official RSD (SBF), delete from xml strings consisting gpt.bin and motoboot.img for safe flashing.
...
Download link: http://www.mediafire.com/download/3e38rr3wy28s071/Moto.X.Unbrick.zip
This guide was brought to you by s5610
Links that this guide is based on (where I took files and general idea):
http://forum.xda-developers.com/droid-ultra/general/droid-ultra-maxx-brick-recovery-t2830806
http://forum.xda-developers.com/mot...-moto-x-t2629057[/url[/QUOTE][/QUOTE][/QUOTE]
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Not sure if additional thread is necessary )
UPDATED
The best resurrection method for Moto X is here.
Can Someone re-upload that file? Thanx!
Please upload the mediafire link...
Plz plz.. I have bricked my phone. It seems that this procedure will work for me. Please upload and save my life.
even i have bricked my moto x...need a working download link..please.
https://drive.google.com/file/d/0B3EDzuzDCakzdWxHa2RWVDJhRXc/view?usp=sharing
Cannot install qsub.drv.inst.msi on my windows 10...says failed to attribute and failed to delete qcusbser.sys.
Thanks
Can we write the full firmware through Qload 9008 mode ???
HI I have a question. I bricked my gf's phone while trying to unlock the bootloader and I am not able to turn the phone on. Only positive feedback is that when I plug it in to the computer, I can hear a notification on my computer. I followed your guide. I can see the "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
Then I followed your software instructions. When I run the RUN_blank_bootloader_flash.bat, I get the following
Code:
Starting qflash!
Executing command qflash.exe -com3 -ramload MPRG8960.hex -mbn 33 MSM8960_bootloa
der_singleimage.bin -v -o
Motorola qflash Utility version 1.3
qflash - com3 is an invalid port
Invalid COM port enteredBlank flashing successful
Device will now enumerate in fastboot mode
Then, I followed the rest of the instructions by trying each .Boot .exe and waitng 10 seconds and finally with RUN_moto_x_bootloader_flash
but I am getting the following error.
Code:
C:\Users\cxx\Desktop\Python27>python qdload.py MPRG8960.bin -ptf _boot\partiti
ons.txt -pt
QDLoad utility version 1.2 (c) VBlack 2014
Found TTY port: com3
Traceback (most recent call last):
File "qdload.py", line 815, in <module>
main()
File "qdload.py", line 762, in main
tty = openTTY(args.ttyPort)
File "qdload.py", line 174, in openTTY
tty = serial.Serial(port=tty_path, baudrate=115200)
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 38, in __init
__
SerialBase.__init__(self, *args, **kwargs)
File "C:\Python27\lib\site-packages\serial\serialutil.py", line 282, in __init
__
self.open()
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 66, in open
raise SerialException("could not open port %r: %r" % (self.portstr, ctypes.W
inError()))
serial.serialutil.SerialException: could not open port 'com3': WindowsError(2, '
The system cannot find the file specified.')
C:\Users\cxx\Desktop\Python27>pause
Press any key to continue . . .
please help.
Thanks.
Device Shows As USB Input
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks
shengslogar said:
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks
Click to expand...
Click to collapse
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.
liveroy said:
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.
Click to expand...
Click to collapse
Will do! I think I did try charging it awhile ago, but I'll give it another shot.
can my phone be unbricked?? here is the error log:
RAMLOADER VERSION: PBL_DloadVER2.0
------------------------------------------------------
DEVICE INFORMATION:
------------------------------------------------------
Version : 0x8
Min Version : 0x1
Max Write Size: 0x600
Model : 0x90
Device Size : 0
Description : Intel 28F400BX-TL or Intel 28F400BV-TL
------------------------------------------------------
Using passed in packet size, changing from 0x600 -> 0x600
EXTENDED_LINEAR_ADDRESS_REC @ 0x2a000000
Write 65536 bytes @ 0x2a000000
100EXTENDED_LINEAR_ADDRESS_REC @ 0x2a010000
Write 11840 bytes @ 0x2a010000
100START_LINEAR_ADDRESS_REC @ 0x2a000000
EOF_REC
Sleeping for 3s
sdl_hello() - Invalid response: 7e030003331b7e
sdl_hello() - This is a NAK response from ROM code, which means the device has
een reset back to blank flash mode. Usually this is caused by power supply issu
s. Please try again with battery eliminator if it persists
Unexpected target reset, bailing out after 2 retries
I am trying to install the drivers and it will show up as qhsusb_dload for about 5 seconds then reverts back to Relink HS USB QDloader 9008. Should i try the wire trick? It will say that the Qhsusb drivers are installed but always changes.

Reset or re-flash uefi after wrong modifications

Hi all!
I have an asus memo pad me176cx. I did some stuff with it and now it seems bricked, but not fully (as I hope...).
But I am not very experienced user with android, so I have a few adjacent questions to define myself in root concepts.
On general - I tried to install debian linux on my tablet. Looking ahead - i managed to run installer. But in order...
My actions before i got brick.
I got an issue similar to this one after updates. There i saw that tablet has a kind of uefi. And i decided to run debian. Prepared usb-installer, connected that one and keyboard via OTG by hub(i have one with led indicator). I pressed F2 and power button on tablet, and saw uefi. There did boot override -> UEFI jet flash. And debian installer ran succesfully.
But after about a minute on-hub led becomes dark, as did flash led. Kbd was not working. At that moment i was on network config step and decided to reboot tablet. Power button about 10sec - and all over again. But after a while - same issue. It would not be nice if flash comes down while packages copying - I thought. And... Of cause boot into uefi to search some otg-power-options (btw i got same behaviour with otg in uefi and was forced to make changes quickly or reboot).
I don`t remember what option exactly i changed, but i have only hw buttons on tablet working. No otg at all (led is always dark now, no flash none kbd works), no touchscreen (i have twrp installed and checked there).
Finally, what works.
I can press vol+ - vol- - pwr, then see "Fastboot startnig... #1 #2 #3" on display - and get into some mode, called DNX (as i googled).
Code:
fastboot devices
shows my tablet. But i can flash only osloader partition. Other way - error, unsupported operation. Also i can command
Code:
fastboot boot droidboot.img
and get into bootloader. This case at the bottom of screen shown "Waiting for fastboot cmd...". But
Code:
fastboot devices
shows notheng. Any other fastboot commands stuck on "wating for any device...". But with vol-buttons i can choose recovery mode, then press power and get into twrp and look on "Swipe to allow filesystem modification". But as far as touchscreen dows not work (as otg-keyboard) - i can`t do anything else. adbd seems not started yet, as
Code:
adb devices
shows nothing (or micro-usb plug simply disabled with uefi). And that is all, i can`t do anything else...
In fine, my questions are:
Mode started by "vol+ - vol- - pwr" - does it DNX or fastboot? How to find out what commnds i can run there? (At the moment I know 2 only: flash osloader and boot). Why flash ESP, erase, even get [some_var] does not work here? Is there a way to re-flash or reset uefi settings from this mode?
Or any other ways to reset uefi? (as possible without microwave...)
Also, what difference between osloader and bootloader? I suggest that osloader is a partition and bootloader is a program placed in that partition. But what exactly i do with command "fastboot flash osloader efilinux.efi"?
Sorry for lot of text, but I actualy don`t know how this modes called and got confused. Any help would be appriciated.
Anyway, thanks a lot!
mk3pq28 said:
I don`t remember what option exactly i changed, but i have only hw buttons on tablet working. No otg at all (led is always dark now, no flash none kbd works), no touchscreen (i have twrp installed and checked there).
Click to expand...
Click to collapse
I think I've seen some option that changes the way USB OTG is set up. By changing it you have probably disabled USB OTG entirely now... :/
mk3pq28 said:
Mode started by "vol+ - vol- - pwr" - does it DNX or fastboot?
Click to expand...
Click to collapse
DNX
mk3pq28 said:
How to find out what commnds i can run there? (At the moment I know 2 only: flash osloader and boot). Why flash ESP, erase, even get [some_var] does not work here?
Click to expand...
Click to collapse
DNX is not a full fastboot implementation. It runs in the firmware, somewhere during early UEFI initialization. It's mostly designed for recovery when the (Android) bootloader is no longer working. The two commands you know are the only ones I'm aware of, sorry :/
mk3pq28 said:
Is there a way to re-flash or reset uefi settings from this mode?
Or any other ways to reset uefi? (as possible without microwave...)
Click to expand...
Click to collapse
I can imagine that it is possible but I have to admit that I don't know how. For example there is Intel® Platform Flash Tool Lite that allows re-flashing pretty much all of the device, but I'm not sure where you'd get the factory files. At the moment, I don't have any suggestions how to solve your problem... :/
mk3pq28 said:
Also, what difference between osloader and bootloader? I suggest that osloader is a partition and bootloader is a program placed in that partition. But what exactly i do with command "fastboot flash osloader efilinux.efi"?
Click to expand...
Click to collapse
osloader refers to the EFI application that is started. efilinux.efi is an Android bootloader for UEFI. In this case it's not actually written persistently somewhere, it is just loaded into RAM and then executed.
lambdadroid,
first of all - thanks a lot for your participating!
So, after your clarification I made a few suggestions.
lambdadroid said:
I can imagine that it is possible but I have to admit that I don't know how. For example there is Intel® Platform Flash Tool Lite that allows re-flashing pretty much all of the device, but I'm not sure where you'd get the factory files.
Click to expand...
Click to collapse
First one. I installed it and downloaded service firmware. Flash tool found my tablet and showed some info:
Plaform: Intel Corporation
Hardware: Intel Android AD
Status: DNX_OS
Connected on port: 0/1 (number of usb port, i think)
DnX SN: Baytrail<some>
Then i selected service firmware and flash tool showed me flash.xml in "flash file" field. Everything looks normal at the moment, until i pressed flash)
The only one record appeared in log below: "Failed to reboot the device. Flash failed". And i don`t know someshing else i can make here.
I am new here and can`t post links to outside, but i googled some more meaningful examples of log by my error. And as i understood chain of commands - flash tool does exactly same as i did. I.e. flashes osloader in dnx mode, then boots in fastboot and flashes another partitions there. Correct me if i`m wrong but it does not seems for my case, unfortunately
And the second one, more complex.
I had googled a lot about uefi and it`s settings location. I found out that "settings" made in uefi are stored in memory called NVRAM. It is non-volatile and can not be reset by battery disconnected (yes, i tried that, ofc). But there should be a flag called NVRAM_IS_VALID. And once it gets disabled - uefi is forced to reset all the settings to defaults next boot time. I`m not sure, but looks like my solution!
And I can suggest two ways of setting this flag.
lambdadroid said:
osloader refers to the EFI application that is started. efilinux.efi is an Android bootloader for UEFI.
Click to expand...
Click to collapse
First one - uefi shell. If i can replace bootloader, may it be a shell? I downloaded one from github (a link should be here ) but have no success yet. It`s size about 930kb, but my working one bootloader - is 2mb. And when i make flash - nothing happens:
Code:
# fastboot flash osloader Shell.efi
target didn't report max-download-size
sending 'osloader' (929 KB)...
Nothing more. Maybe there should be some special kind of uefi-shell for android? Or I can`t flash nothing but bootloder into osloader partition at all? But even if i`m succeed - i`m not sure that uefi would not disable otg before shell get running.
So my second and the last sugesstion. It`s fully theoretical, but... I need to write a custom efi app (.efi files are kind of applications for uefi, written in c, right?) that would be flashed into osloader and should disable NVRAM_IS_VALID flag (ohh, does that flag exists at all?...). Does it possible?
Anyway, thanks a lot for any help!
mk3pq28 said:
I installed it and downloaded service firmware. Flash tool found my tablet and showed some info:
Plaform: Intel Corporation
Hardware: Intel Android AD
Status: DNX_OS
Connected on port: 0/1 (number of usb port, i think)
DnX SN: Baytrail<some>
Then i selected service firmware and flash tool showed me flash.xml in "flash file" field. Everything looks normal at the moment, until i pressed flash)
The only one record appeared in log below: "Failed to reboot the device. Flash failed". And i don`t know someshing else i can make here.
I am new here and can`t post links to outside, but i googled some more meaningful examples of log by my error. And as i understood chain of commands - flash tool does exactly same as i did. I.e. flashes osloader in dnx mode, then boots in fastboot and flashes another partitions there. Correct me if i`m wrong but it does not seems for my case, unfortunately
Click to expand...
Click to collapse
Okay, yeah, that's very well possible. I've never used that tool and don't know what it does.
mk3pq28 said:
I had googled a lot about uefi and it`s settings location. I found out that "settings" made in uefi are stored in memory called NVRAM. It is non-volatile and can not be reset by battery disconnected (yes, i tried that, ofc). But there should be a flag called NVRAM_IS_VALID. And once it gets disabled - uefi is forced to reset all the settings to defaults next boot time. I`m not sure, but looks like my solution!
Click to expand...
Click to collapse
It makes sense that the settings are stored in the NVRAM. But that's about all I can comment on; I'm not sure if that flag exists on this tablet or even if it will reset to the correct results.
mk3pq28 said:
uefi shell. If i can replace bootloader, may it be a shell? I downloaded one from github (a link should be here ) but have no success yet. It`s size about 930kb, but my working one bootloader - is 2mb. And when i make flash - nothing happens:
Code:
# fastboot flash osloader Shell.efi
target didn't report max-download-size
sending 'osloader' (929 KB)...
Nothing more. Maybe there should be some special kind of uefi-shell for android? Or I can`t flash nothing but bootloder into osloader partition at all? But even if i`m succeed - i`m not sure that uefi would not disable otg before shell get running.
Click to expand...
Click to collapse
You may need to run "fastboot boot droidboot.img" (or any other image) too to have Fastboot run the EFI application. The Shell application will then likely ignore the additional boot image. However, as you mention, I believe that OTG will get disabled before the shell is running. The UEFI shell application is no different from the UEFI Setup as far as OTG is concerned. So if you are unable to enter the setup with F2 then the UEFI shell will probably not work either. So even if the Shell starts, I doubt that you will be able to run commands.
And no, there is no special kind of UEFI Shell for Android. This is all unrelated to Android actually.
mk3pq28 said:
It`s fully theoretical, but... I need to write a custom efi app (.efi files are kind of applications for uefi, written in c, right?) that would be flashed into osloader and should disable NVRAM_IS_VALID flag (ohh, does that flag exists at all?...). Does it possible?
Click to expand...
Click to collapse
That's actually something I considered suggesting yesterday. I decided against it because it's obviously not trivial and I'm not sure if EFI applications can actually access that flag or BIOS settings in general... However, I can assist you with how to write EFI applications in general. They are usually written in C and then compiled using some funky compiler flags and tools to .efi.
An example for a very simple EFI application is "bootstrap.efi" that is used in me176c-boot. The source for it is available at https://github.com/me176c-dev/me176c-boot/tree/master/bootstrap
In me176c-boot it runs as first EFI application and checks if the tablet was booted due to charger insertion; if yes then it sets an EFI variable. I'm not sure if the flag you mention is exposed as an EFI variable. However, persistent EFI variables are also stored in the NVRAM, so that might be something to look at. It's built using Meson (see meson.build). The build script might be of help to you.
lambdadroid said:
That's actually something I considered suggesting yesterday. I decided against it because it's obviously not trivial and I'm not sure if EFI applications can actually access that flag or BIOS settings in general...
Click to expand...
Click to collapse
But I don`t see any other kind of solution.
lambdadroid said:
It makes sense that the settings are stored in the NVRAM. But that's about all I can comment on; I'm not sure if that flag exists on this tablet or even if it will reset to the correct results.
Click to expand...
Click to collapse
I think it won`t get worse anyway, so...
Thanks a lot for your general information about efi. I took that and was able to get started. I did some experiments and had interesting results. Little notice - i`m on debian.
At first
I had installed gnu-efi and mason. Also googled "Hello world" in efi-style. I still cant post links to outside but the code is below. Looking ahead - had no result with one Print because it was closed very fast so i added a loop.
Code:
#include <efi.h>
#include <efilib.h>
EFI_STATUS
EFIAPI
efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
InitializeLib(ImageHandle, SystemTable);
for (int i = 0; i < 5000; ++i)
{
Print(L"B It works!!!\r\n");
}
return EFI_SUCCESS;
}
Looks simple.
Also i took your meson.build and replaced file names with mine. But i got a few conpilation errors so i had removed some keys from target. Here it is:
Code:
project('tutorial', 'c')
arch = host_machine.cpu_family()
efi_include_dir = '/usr/include/efi'
efi_include = include_directories(
efi_include_dir,
join_paths(efi_include_dir, arch),
is_system: true
)
efi_lds = '/usr/lib/elf_' + arch + '_efi.lds'
efi_crt = '/usr/lib/crt0-efi-' + arch + '.o'
bootstrap_lib = shared_library('bootstrap',
'hello_efi.c',
include_directories: [efi_include],
objects: [efi_crt],
link_args: [
'-T', efi_lds,
'-nostdlib',
'-z', 'nocombreloc',
'-Wl,-Bsymbolic',
'-lefi', '-lgnuefi'
]
)
objcopy = find_program('objcopy')
custom_target('bootstrap.efi',
output: 'bootstrap.efi',
input: bootstrap_lib,
command: [objcopy,
'--target=efi-app-' + arch,
'-j', '.text',
'-j', '.sdata',
'-j', '.data',
'-j', '.dynamic',
'-j', '.dynsym',
'-j', '.rel',
'-j', '.rela',
'-j', '.reloc',
'@[email protected]', '@[email protected]'
],
install: true,
install_dir: ''
)
hello_efi.c contains source code from above.
This is my first meson build so if yoy see some obvious mistakes or excess options - i would be much appreciated if you point on them.
At second
I created builddir, commanded "meson" and "ninja" and got such output:
Code:
[1/3] Compiling c object '[email protected]/hello_efi.c.o'
../hello_efi.c: In function ‘efi_main’:
../hello_efi.c:13:9: warning: passing argument 1 of ‘Print’ from incompatible pointer type [-Wincompatible-pointer-types]
Print(L"B It works!!!\r\n");
^~~~~~~~~~~~~~~~~~~~
In file included from ../hello_efi.c:2:0:
/usr/include/efi/efilib.h:404:1: note: expected ‘CHAR16 * {aka short unsigned int *}’ but argument is of type ‘int *’
Print (
^~~~~
[3/3] 'Generating bootstrap.efi with a custom command.'
I am not very familiar with C and can`t get rid of warning to print my message properly. As far as Print requires CHAR16 pointer only first symbol is printed. How to properly get and array of CHAR16 from "a string"?
Anyway, it`s a bite of success.
And at third, final
I was very happy and connected tab (in DNX, ofc) with pc and commaned: "fastboot flash osloader bootstrap.efi".
Code:
target didn't report max-download-size
sending 'osloader' (44 KB)...
And nothing more. Command is still running untill tablet reboot. But!
I have another ont efilinux.efi was downloaded from somewhere. And it flashes correctly! The only difference is on size: 44KB vs 2MB.
I did some research with dd-util and found one interesting thing. It is allowed to flash osloader partition in dnx mode with completely any binary data within (nearly) 1MB .. 20MB. In this case "fastboot flash osloader ..." says OK twice and finishes properly.
So, my flow after compilation have a such look (2057216 - is a size of my working example efilinux.efi)
Code:
$ dd if=/dev/zero of=container.efi count=2057216 iflag=count_bytes
$ dd if=bootstrap.efi of=container.efi conv=nocreat,notrunc
# fastboot flash osloader container.efi
# fastboot boot droidboot.img
... and i have a char 'B' on screen printed 5000 times. I think it`s another one bite of success
But i can`t find any docs for efi.h (efilib.h). Which capabilities they provides? What is set of functinos?
There is another example with
Code:
uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, L"Hello World!\n");"
but it is not obvious how to work with uefi services in this way.
I googled that most of uefi settings are stored in "Setup" variable. I think it may be useful at least to print them. But don`t know how, yet.
I will google it further but in general i don`t know what is the next step should be.
Also i have an idea to use such trick to flash efi-shell. But didn`t tried yet.
mk3pq28 said:
At first
I had installed gnu-efi and mason. Also googled "Hello world" in efi-style. I still cant post links to outside but the code is below. Looking ahead - had no result with one Print because it was closed very fast so i added a loop.
Code:
#include <efi.h>
#include <efilib.h>
EFI_STATUS
EFIAPI
efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
InitializeLib(ImageHandle, SystemTable);
for (int i = 0; i < 5000; ++i)
{
Print(L"B It works!!!\r\n");
}
return EFI_SUCCESS;
}
Looks simple.
Also i took your meson.build and replaced file names with mine. But i got a few conpilation errors so i had removed some keys from target. Here it is:
Code:
project('tutorial', 'c')
arch = host_machine.cpu_family()
efi_include_dir = '/usr/include/efi'
efi_include = include_directories(
efi_include_dir,
join_paths(efi_include_dir, arch),
is_system: true
)
efi_lds = '/usr/lib/elf_' + arch + '_efi.lds'
efi_crt = '/usr/lib/crt0-efi-' + arch + '.o'
bootstrap_lib = shared_library('bootstrap',
'hello_efi.c',
include_directories: [efi_include],
objects: [efi_crt],
link_args: [
'-T', efi_lds,
'-nostdlib',
'-z', 'nocombreloc',
'-Wl,-Bsymbolic',
'-lefi', '-lgnuefi'
]
)
objcopy = find_program('objcopy')
custom_target('bootstrap.efi',
output: 'bootstrap.efi',
input: bootstrap_lib,
command: [objcopy,
'--target=efi-app-' + arch,
'-j', '.text',
'-j', '.sdata',
'-j', '.data',
'-j', '.dynamic',
'-j', '.dynsym',
'-j', '.rel',
'-j', '.rela',
'-j', '.reloc',
'@[email protected]', '@[email protected]'
],
install: true,
install_dir: ''
)
hello_efi.c contains source code from above.
This is my first meson build so if yoy see some obvious mistakes or excess options - i would be much appreciated if you point on them.
At second
I created builddir, commanded "meson" and "ninja" and got such output:
Code:
[1/3] Compiling c object '[email protected]/hello_efi.c.o'
../hello_efi.c: In function ‘efi_main’:
../hello_efi.c:13:9: warning: passing argument 1 of ‘Print’ from incompatible pointer type [-Wincompatible-pointer-types]
Print(L"B It works!!!\r\n");
^~~~~~~~~~~~~~~~~~~~
In file included from ../hello_efi.c:2:0:
/usr/include/efi/efilib.h:404:1: note: expected ‘CHAR16 * {aka short unsigned int *}’ but argument is of type ‘int *’
Print (
^~~~~
[3/3] 'Generating bootstrap.efi with a custom command.'
I am not very familiar with C and can`t get rid of warning to print my message properly. As far as Print requires CHAR16 pointer only first symbol is printed. How to properly get and array of CHAR16 from "a string"?
Anyway, it`s a bite of success.
Click to expand...
Click to collapse
I believe the compiler argument that avoids this error is -fshort-wchar, but you seem to have removed all c_args: https://github.com/me176c-dev/me176c-boot/blob/master/bootstrap/meson.build#L33 All of these compiler arguments have a purpose, can you check which one is causing errors exactly and post the error here?
mk3pq28 said:
And at third, final
I was very happy and connected tab (in DNX, ofc) with pc and commaned: "fastboot flash osloader bootstrap.efi".
Code:
target didn't report max-download-size
sending 'osloader' (44 KB)...
And nothing more. Command is still running untill tablet reboot. But!
I have another ont efilinux.efi was downloaded from somewhere. And it flashes correctly! The only difference is on size: 44KB vs 2MB.
I did some research with dd-util and found one interesting thing. It is allowed to flash osloader partition in dnx mode with completely any binary data within (nearly) 1MB .. 20MB. In this case "fastboot flash osloader ..." says OK twice and finishes properly.
So, my flow after compilation have a such look (2057216 - is a size of my working example efilinux.efi)
Code:
$ dd if=/dev/zero of=container.efi count=2057216 iflag=count_bytes
$ dd if=bootstrap.efi of=container.efi conv=nocreat,notrunc
# fastboot flash osloader container.efi
# fastboot boot droidboot.img
Click to expand...
Click to collapse
That's weird, the size shouldn't matter at all. But it doesn't really matter, as long as it works.
mk3pq28 said:
But i can`t find any docs for efi.h (efilib.h). Which capabilities they provides? What is set of functinos?
There is another example with
Code:
uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, L"Hello World!\n");"
but it is not obvious how to work with uefi services in this way.
I googled that most of uefi settings are stored in "Setup" variable. I think it may be useful at least to print them. But don`t know how, yet.
I will google it further but in general i don`t know what is the next step should be.
Click to expand...
Click to collapse
Generally, the interface exposed by gnu-efi is according to the UEFI specification: http://www.uefi.org/sites/default/files/resources/UEFI Spec 2_7_A Sept 6.pdf
In there you can find a list of protocols you can use, e.g. search for the "OutputString" method used above.
uefi_call_wrapper is an implementation detail of gnu-efi, but basically it's uefi_call_wrapper(<method>, <number of parameters>, <parameters...>).
The main remaining question, and the one I can't really help you with is how you can reset your BIOS settings using the UEFI application API. Maybe something to look at first would be the "Variable Services" (see UEFI specification). Maybe you can change one of the EFI variables to restore the default BIOS settings.
lambdadroid said:
I believe the compiler argument that avoids this error is -fshort-wchar, but you seem to have removed all c_args: https://github.com/me176c-dev/me176c-boot/blob/master/bootstrap/meson.build#L33 All of these compiler arguments have a purpose, can you check which one is causing errors exactly and post the error here?
Click to expand...
Click to collapse
Yes, this key removed warning. Thanks.
lambdadroid said:
Generally, the interface exposed by gnu-efi is according to the UEFI specification: http://www.uefi.org/sites/default/files/resources/UEFI Spec 2_7_A Sept 6.pdf
In there you can find a list of protocols you can use, e.g. search for the "OutputString" method used above.
Click to expand...
Click to collapse
Exactly one i`m looking for. Thanks again!
Unfortunately there is nothing about NVRAM_IS_VALID there.
But there is a function called "ResetSystem()" (p.269). It should reset the entire platform as written in doc.
My code:
Code:
#include <efi.h>
#include <efilib.h>
EFI_STATUS
EFIAPI
#define SLEEP 100
efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
InitializeLib(ImageHandle, SystemTable);
for (int i = 0; i < SLEEP; ++i)
{
Print(L"It works!!! #%d", i);
uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, L"\r\n");
}
int res = uefi_call_wrapper(RT->ResetSystem, 4, EfiResetCold, EFI_SUCCESS, 0, NULL);
for (int i = 0; i < SLEEP; ++i) Print(L"%d\r\n", res);
return EFI_SUCCESS;
}
}
Yes, i`d noticed that "The ResetSystem() function does not return".
But i`m not sure that i call it properly.
When i run the code above - it prints the message 100 times, then screen blinks and the next message appears: "EFILINUX ERROR [start_boot_logic:498] No valid target found.
Fallbacking to MOS" in about 3 sec. Looks like there no reboot in this case because of the intel logo is not shown. I have no system on my tablet, but it`s another story.
The main point is there is no black screen with intel logo for about 15-20 sec as in case of normal boot.
In addition i tried to change call with:
Code:
uefi_call_wrapper(RT->ResetSystem, 4, L"Wrong_argument", EFI_SUCCESS, 0, NULL)
and it prints "968832152" return code. Does it fail somewhere before ResetSystem() or exactly inside?
So am i calling this function correctly?
mk3pq28 said:
Yes, this key removed warning. Thanks.
Exactly one i`m looking for. Thanks again!
Unfortunately there is nothing about NVRAM_IS_VALID there.
But there is a function called "ResetSystem()" (p.269). It should reset the entire platform as written in doc.
My code:
Code:
#include <efi.h>
#include <efilib.h>
EFI_STATUS
EFIAPI
#define SLEEP 100
efi_main (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
InitializeLib(ImageHandle, SystemTable);
for (int i = 0; i < SLEEP; ++i)
{
Print(L"It works!!! #%d", i);
uefi_call_wrapper(ST->ConOut->OutputString, 2, ST->ConOut, L"\r\n");
}
int res = uefi_call_wrapper(RT->ResetSystem, 4, EfiResetCold, EFI_SUCCESS, 0, NULL);
for (int i = 0; i < SLEEP; ++i) Print(L"%d\r\n", res);
return EFI_SUCCESS;
}
}
Yes, i`d noticed that "The ResetSystem() function does not return".
But i`m not sure that i call it properly.
When i run the code above - it prints the message 100 times, then screen blinks and the next message appears: "EFILINUX ERROR [start_boot_logic:498] No valid target found.
Fallbacking to MOS" in about 3 sec. Looks like there no reboot in this case because of the intel logo is not shown. I have no system on my tablet, but it`s another story.
The main point is there is no black screen with intel logo for about 15-20 sec as in case of normal boot.
In addition i tried to change call with:
Code:
uefi_call_wrapper(RT->ResetSystem, 4, L"Wrong_argument", EFI_SUCCESS, 0, NULL)
and it prints "968832152" return code. Does it fail somewhere before ResetSystem() or exactly inside?
So am i calling this function correctly?
Click to expand...
Click to collapse
I'm afraid ResetSystem() is not what you are looking for: ResetSystem() is only used to reboot the system, it does not "reset" any settings. So the screen flashes and you see that message because the tablet is restarted normally. (The bootloader you are using displays an error if you reboot without setting a "reboot target").
So you need to find some other method, or entirely different solution unfortunately. I just did a bit of research myself, but unfortunately didn't find anything of help..

Categories

Resources