Database Develop

Trinity bootloader

i'm using the hermes/artemis reference to see what works and not
first: almost every other commands give the "Command Error"
the wdata exists and gives: Command is Locked!
The first thing will be to get into the radio bootloader - seems that the password is fixed. As far as the bootloader I hope that it can be downgraded.
---
info 2:
HTCSHTC__102Ã;¿HTCE
info 3:
HTCST
info 4:
IsAllBytesTheSame-: dwLength=8, bResult=0
HTCSHTC__102Ã;¿HTCE
info 6:
HTCST ÚÈÒHTCE
info 7:
HTC Integrated Re-Flash Utility, Common Base Version : 1.51b
Device Name: TRIN100, Bootloader Version : 1.06.0000
Built at: Oct 19 2006 20:31:29
Copyright (c) 1998-2006 High Tech Computer Corporation
CPU ID=0x41129200
Main CPLD version=0xA
Main Board version=0x5
info 8:
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x18700
Partition[3], type=0x4, start=0x1B700, total=0x1F100
CE Total Length(with sector info) = 0x37BB800
CE CheckSum Length(without sector info) = 0x36E0000
-----
task 32 : Level FF
-----
checkimage
IPL CRC checksum = 0x96BE3C47
SPL CRC checksum = 0xBA45D40C
CE CRC checksum = 0xE86D6EC6
ExtROM CRC checksum = 0x3FBE8D13
Radio Image CRC checksum = 0xAB599ED8
-----
progress - shows bar

SD Upgrade
I tried the SD upgrade method.
I placed an nbh file on it called TRINIMG.nbh but after cheking gaves me "NOT ALLOW" 00028002
Any ideea ?

As your seclevel is FF, the CID on the NBH should be the same on your device. info 2 shows your CID = HTC__102 (HTC Germany), so you need to put an HTC german rom in the TRINIMG.nbh file or CID unlock your device.
Nice work on the bootloader

I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
getdevinfo
ResetDevice
progress
ruustart
rbmc
password
info
task
emapi
btrouter
wdata
lnbs
erase
checkimage
checksum
wdata
wdatah
Click to expand...
Click to collapse
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?

pof said:
I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?
Click to expand...
Click to collapse
excellent. i'm in office only with my trusted Universal (i'll fill up all the info tonight).

from artemis Wiki:
Artemis Bootloader Password
Seems that artemis bootloader password is static: BsaD5SeoA
If you enter this password in mtty terminal, you may not be able to boot device into Windows, only in bootloader. Be carefull.
It's meaning that Artemis has the same bootloader (or similar) with trinity.
The question: why it cannot get out from the bootloader ??

decebal said:
It's meaning that Artemis has the same bootloader (or similar) with trinity.
Click to expand...
Click to collapse
No, if you compare SPL they are very different one from the other.
Trinity's SPL is more similar to Hermes SPL, but Artemis SPL is different.
decebal said:
The question: why it cannot get out from the bootloader ??
Click to expand...
Click to collapse
probably you just need to 'set 14 0' or hard reset to go back to OS, I don't know... the wiki edit was done by fdp24, he can probably explain

pof said:
I've just decoded Trinity radio, it is very very similar to Hermes radio (Same Qualcomm JNAND Identification block), so radio bootloader commands should be the same in Trinity as on Hermes (and radio patch for SIM/CID unlock too!).
Normal bootloader commands should be quite similar too, but not necessarily the same, this is what I found on Trinity's SPL:
There's also the static password: BsaD5SeoA
Can you add all this info to the wiki?
Click to expand...
Click to collapse
Cmd>getdevinfo
GetDevInfo: Get CID OK
HTCSTRIN100HTCE
--
Reset Device - works
--
Progress - works
--
ruustart - blocked - hard reset needed
--
rbmc - not working
--
password works with the password BsaD5SeoA
--
info - works as in wiki
--
task - works as in wiki
--
emapi and btrouter - blocks the device
--
wdata - works with the password provided
--
lnbs - not working
--
erase - working
HTCST ÚÈÒHTCE
--
checkimage - working as in wiki
--
checksum - seems working
--
wdatah - not working

seems that the 1.06 is somehow limited as bootloader. how can we get the 1.04 or other upgrade solution ??
thanks

Nice work on the wiki decebal
Answers to your comments:
rbmc and lnbs - probably only work on SuperCID devices.
emapi and btrouter - I think it switches to wlan or bluetooth and disables USB connection.
wdata and wdatah - In hermes wdatah is for flash NBH and wdata for flash NBF in preproduction devices. Have you captured a full ROM upgrade using USB monitor?? which one it uses the RUU? Probably it has a dynamic password which enables wdatah for NBH files. Does 'info 3' works as in Hermes (you need to watch usb monitor output, can't see in mtty generally).
decebal said:
seems that the 1.06 is somehow limited as bootloader. how can we get the 1.04 or other upgrade solution ??
Click to expand...
Click to collapse
Generally by flashing a ROM matching your CID with bootloader 1.04.

rbmc is not in spl in Artemis device. On Trinity probably too.
These are some commands for Artemis:
Could be similarity for Trinity
CASE SENSITIVE!
Cmd>fm
Wrong parameters of FM Command!!
Usage:
fm [command] [frequency]
where:
if[command] = i Initialize FM.
if[command] = o Power on FM.
if[command] = f Power off FM.
if[command] = t Tune FM channel to [frequency].
if[command] = a FM auto seek test.
if[command] = m Mono(1) or Stereo(0).
if[command] = v Volume (0x00 - 0x0F).
if[command] = u Mute(0)
if[command] = g AGC(1)
if[command] = h Set seek threshold (0x00 - 0xFF).
if[command] = s Seek Up(1) or Down(0).
if[command] = r Get RSSI (0x00 - 0xFF).
if[command] = c Get current channel [frequency].
if[command] = d Get RDS data (1 - 10 groups of data).
*****************************************************************************************************
Cmd>cpldver
xsvfExecute - CpldType=1
SUCCESS - Completed XSVF execution.
CPLD Ver[0]=1
CPLD Ver[1]=FC
CPLD Ver[2]=26
CPLD Ver[3]=5
SetDsbDBGMSGT
Unknown yet.
*****************************************************************************************************
Cmd>ReadExtROM
Dump Ext ROM to MTTY terminal
*****************************************************************************************************
Cmd>WLANReset
Usage:
WLANReset 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>WLANReset 0
WLANReset(FALSE)
Cmd>WLANReset 1
WLANReset(TRUE)
*****************************************************************************************************
Cmd>SDSelect
Usage:
SDSelect 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>SDSelect 1
Select SD Card
*****************************************************************************************************
Cmd>emapiWlanMac
Notice: This MAC address takes effect only when your platform is EEPRON-less configuration. Please use (emapiTest) to verify it !
Copying GSM DATA image to SDRAM:00004000
Wlan data header ++++++++++++++++++++
Signature : 0xEE1250
UpdateStatus : 0x2
UpdateCount : 0xA
BodyLength : 0x1A1
BodyCRC : 0x4349311B
Wlan data header --------------------------
0x00000000
0x00000009
0x0000002D
0x000000D2
0x000000D5
0x000000FB
*****************************************************************************************************
Cmd>emapiTest
+emapiTest
1. Power on WLAN
2. Reset WLAN
3. Switch MUX to WLAN
4. Enable WLAN clock
5. Init WLAN SDIO interface
6. DeviceID Test
DeviceID = 4030xxx
EEPROMless configuration!
-emapiTest
*****************************************************************************************************
Cmd>emapiPwrDwn
*****************************************************************************************************
Cmd>emapiRead
Parameter Wrong!!
*****************************************************************************************************
Cmd>getdevinfo
Need password!
*****************************************************************************************************
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
*****************************************************************************************************
Cmd>password
Usage:
password [String]
Enter the password string to enable wdata, erase and rbmc functions.
*****************************************************************************************************
Cmd>set
Usage:
set [Type Value]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Current flag settings:
Type 1(Operation mode flag): g_cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_dwFColor24bit=(0x0).
Type 5(Background color): g_dwBColor24bit=(0xFFFFFF).
Type 6(Set color of screen): None.
Type 32: Unlock Flash Command
Set control flags.
*****************************************************************************************************
Cmd>SetDebugMethod
Copying GSM DATA image to SDRAM:00004000
Default DebugTransport Value =00000000
Current Usage:
0 No Debug
A UART MTTY Output Debug Message
B USB MTTY Output Debug Message
*****************************************************************************************************
Cmd>checksum
Usage:
checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*****************************************************************************************************
Cmd>ResetDevice
no comments
*****************************************************************************************************
**When CID is locked.
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
**When CID is locked.
*****************************************************************************************************
**When CID unlocked
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==
**When CID unlocked
*****************************************************************************************************
Cmd>GPSRouting
Dump code to mtty console.
*****************************************************************************************************
Cmd>BTRouting
Dump code to mtty console.
*****************************************************************************************************
Cmd>BTRouting
+GSM_Modem_Init : include DAGON
Copying GSM DATA image to SDRAM:00004000
GSM - dwSize = 3479D
GSM Page0
GSM - dwSize = 45457
GSM Page1
GSM - dwSize = 4B768
GSM Page2
GSM - dwSize = 4E0A9
GSM Page3
GSM - dwSize = 4B4C4
GSM Page4
GSM - dwSize = 4C71F
GSM Page5
GSM - dwSize = 2958E
GSM Page6
GSM - dwSize = E8D8
GSM Page7
Copying GSM CODE image to SDRAM:00000000
ARMBOOT = 1 --> boot from CS3
Reset ARM 7 -- ok
Please close MTTY USB connection and open BT Testing program...
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
*****************************************************************************************************
password BsaD5SeoA - this is static password used during flashing device. (USB sniffer)
battery seems to be charging during bootloader.
If you stuck at bootloader during manipulations with commands, try this:
password BsaD5SeoA
ruurun 0
Alternatively, you can run rom flasher even on CID locked device. It will give you error message about Device ID or something, but your device will be back to normal and boot normally.

[Q] Where can I find fsck.vfat for I9000?

Hi,
I can't find fsck.vfat in order to repair a corrupt internal SD card.
How come it's not that popular (if it exists at all)?
Thanks,
Yaron.

I found there is a build in one patched by samsung, if it was not added by custom firmware.
# /system/bin/fsck_msdos -ny /dev/block/vold/179:1
/system/bin/fsck_msdos -ny /dev/block/vold/179:1
patched by [email protected] 2011/01/21
** /dev/block/vold/179:1
Boot sector contents:
bytes per sector:.............512
sectors per cluster:..........64
number of reserved sectors:...32
number of FATs:...............2
number of sectors are in FAT:.3440 (1720 KB)
cluster mask (bit):...........32
FAT entries:..................440320
first cluster offset..........6784
cluster size(bytes):..........32768
number of sectors:............28180416
hidden sectors:...............0
number of clusters:...........440213
oem name:.....................android { 0x61 0x6e 0x64 0x72 0x6f 0x69 0x64 0x20}
volume serial number:.........466b-16f7
volume label:.................NO NAME { 0x4f 0x20 0x4e 0x41 0x4d 0x45 0x20 0x20 0x20 0x20 0x46}
file system string id:........FAT32 { 0x41 0x54 0x33 0x32 0x20 0x20 0x20 0xfa}
** Phase 1 - Read and Compare FATs
Attempting to allocate 1720 KB for FAT
Attempting to allocate 1720 KB for FAT
** Phase 2 - Check Cluster Chains
** Phase 3 - Checking Directories
** Phase 4 - Checking for Lost Files
FSNext block (3) is correct, NumClusters (440213)
11950 files, 4180320 free (130635 clusters)

[how to..] Unbrick nokia x2 readed as [RELINK HS-USB QD-LOADER 9008]

=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2- QPST_2.7.422 or here
3- QDLoader HS-USB Driver or here
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
sry for bad english

Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip

thinhx2 said:
Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip
Click to expand...
Click to collapse
you're welcome
this also works with all Snapdragon devices

thinhx2 said:
Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip
Click to expand...
Click to collapse
this does not work forr me. i am getting this error.
Failed using Sahara protocol
Exception:
Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownloadException: Failed using Sahara protocol ---> Nokia.Delta.Gemini.EmergencyDownload.SaharaException: Image transfer ended with failure: InvalidImageTypeReceived
at Nokia.Delta.Gemini.EmergencyDownload.Sahara.Download(String filePath)
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
--- End of inner exception stack trace ---
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__15(Object state)
---------- Post added at 11:17 AM ---------- Previous post was at 11:09 AM ----------
Ramy3r said:
=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2-QPST_2.7.422
3- QDLoader HS-USB Driver
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
**Note**
Works with all snapdragon devices
so if u have another device all u need to change is the firmware files
sry for bad english
Click to expand...
Click to collapse
download links for drivers not working.

jkenic said:
download links for drivers not working.
Click to expand...
Click to collapse
broken links updated
thx for informing me

jkenic said:
this does not work forr me. i am getting this error.
Failed using Sahara protocol
Exception:
Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownloadException: Failed using Sahara protocol ---> Nokia.Delta.Gemini.EmergencyDownload.SaharaException: Image transfer ended with failure: InvalidImageTypeReceived
at Nokia.Delta.Gemini.EmergencyDownload.Sahara.Download(String filePath)
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
--- End of inner exception stack trace ---
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__15(Object state)
---------- Post added at 11:17 AM ---------- Previous post was at 11:09 AM ----------
download links for drivers not working.
Click to expand...
Click to collapse
bro has install nokia care suite?

thinhx2 said:
bro has install nokia care suite?
Click to expand...
Click to collapse
it is the ncs that is giving me the error. i have done everything needed to be done to get my x2 back....
---------- Post added at 02:54 PM ---------- Previous post was at 02:39 PM ----------
Ramy3r said:
broken links updated
thx for informing me
Click to expand...
Click to collapse
u re welcome but number 2 download link still not working.......

jkenic said:
it is the ncs that is giving me the error. i have done everything needed to be done to get my x2 back....
---------- Post added at 02:54 PM ---------- Previous post was at 02:39 PM ----------
u re welcome but number 2 download link still not working.......
Click to expand...
Click to collapse
sry fixed and add links from google drive

Ramy3r said:
=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2- QPST_2.7.422 or here
3- QDLoader HS-USB Driver or here
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
**Note**
Works with all snapdragon devices
so if u have another device all u need to change is the firmware files
sry for bad english
Click to expand...
Click to collapse
i go an error
Start Download
Program Path:C:\Users\EJINI\Desktop\New folder\RM-1013-1\rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:0
Start Sending Programmer
Download Fail:System.Exception: Unable to download Flash Programmer using Sahara Protocol
at QC.QMSLPhone.Phone.QPHONEMS_SaharaArmPrgDownload(String sFileName)
at QC.SwDownloadDLL.SwDownload.QPHONEMSSaharaDownloadArmPrg(UInt64& version, String armPrgPath)
Download Fail:Sahara FailSahara Fail
Finish Download
almost same with the nokia care suite.

jkenic said:
i go an error
Start Download
Program Path:C:\Users\EJINI\Desktop\New folder\RM-1013-1\rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:0
Start Sending Programmer
Download Fail:System.Exception: Unable to download Flash Programmer using Sahara Protocol
at QC.QMSLPhone.Phone.QPHONEMS_SaharaArmPrgDownload(String sFileName)
at QC.SwDownloadDLL.SwDownload.QPHONEMSSaharaDownloadArmPrg(UInt64& version, String armPrgPath)
Download Fail:Sahara FailSahara Fail
Finish Download
almost same with the nokia care suite.
Click to expand...
Click to collapse
Do u have any problems with ur operating system maybe its not running very well or u have some program that interferes with the download/flashing process
Sent from my Nokia_X2 using XDA Labs

There's nothing wrong with the OS that I know of.... Maybe it's the phone...did not work with windows 10

jkenic said:
There's nothing wrong with the OS that I know of.... Maybe it's the phone...did not work with windows 10
Click to expand...
Click to collapse
Sry for late comment .. Win 10 has a lot of support issues like the error 0x000007 with some games and programs ... I recommend win 7 for best results
Sent from my Nokia_X2 using XDA Labs

Work with lumia devices?

thinhx2 said:
Work with lumia devices?
Click to expand...
Click to collapse
i tested this only on android devices i'm not sure about windows phone tbh
but if it has same files "firehose , rawprogram and label layout" included in firmware files then its possible

error
Hi guys. Please help me with an error. If the firmware gets up in the middle of it.

Hoоdlum said:
Hi guys. Please help me with an error. If the firmware gets up in the middle of it.
Click to expand...
Click to collapse
First of all have you downloaded the full firmware files ? "66 files, 902 MB"
Sent from my Nokia X2 using XDA Labs

Ramy3r said:
First of all have you downloaded the full firmware files ? "66 files, 902 MB"
Sent from my Nokia X2 using XDA Labs
Click to expand...
Click to collapse
66 Yes 902mb file, but it does not end here from another site. Here's why not swing.

Hoоdlum said:
66 Yes 902mb file, but it does not end here from another site. Here's why not swing.
Click to expand...
Click to collapse
Try again using the version I posted of qpst
Sent from my Nokia ara using XDA Labs

Ramy3r said:
Try again using the version I posted of qpst
Sent from my Nokia ara using XDA Labs
Click to expand...
Click to collapse
I downloaded from your site on the links firmware driver program. Error exact same stands in the middle.

That log
Code:
[FONT="Verdana"][B]Validating Application Configuration
Load APP Configuration
COM:-1
SAHARA:True
SAHARA:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
SEARCHPATH:C:\RM-1013
RAWPROGRAM:
rm1013_2.1.0.12_059V786_001_rawprogram_unsparse_ui.xml
PATCH:
P12026702dpi600_label_layout.xml
ACKRAWDATAEVERYNUMPACKETS:True
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:True
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
READBACKMODE:0
RESETAFTERDOWNLOAD:True
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Process Index:0
Validating Download Configuration
Image Search Path: C:\RM-1013
RAWPROGRAM file path: C:\RM-1013\rm1013_2.1.0.12_059V786_001_rawprogram_unsparse_ui.xml
PATCH file path:C:\RM-1013\P12026702dpi600_label_layout.xml
Programmer Path:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
Start Download
Program Path:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Enable Ack Raw Data Every 100Packets
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:9
Sending NOP
FireHose NOP sent successfully
Sending Configuration
Device Type:eMMC
Platform:8x26
Set TxBuffer 0xc000, RxBuffer 0x4000
Firehose configure packet sent successfully!
ReadBackMode:No_Readback
Disable read back
Total Bytes To Program 0x37226800
Download Image
PROGRAM: Replace the partition sectors number 0x20000 to file size in sector 0x125c3
PROGRAM: Partition 0, Sector: 16384, Length: 75203 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_NON-HLOS.bin
FireHose Log: start 16384, num 75203
FireHose Log: Write failed Sector 16480, Errno 2
FireHose Log: Finished sector address 16480
PROGRAM: Written Bytes 0x24b8600 (64)
Program Size: 36.72 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1ec
PROGRAM: Partition 0, Sector: 147456, Length: 492 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sbl1.mbn
FireHose Log: start 147456, num 492
FireHose Log: Write failed Sector 147456, Errno 2
FireHose Log: Finished sector address 147456
PROGRAM: Written Bytes 0x3d800 (64)
Program Size: 0.24 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1ec
PROGRAM: Partition 0, Sector: 148480, Length: 492 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sbl1.mbn
FireHose Log: start 148480, num 492
FireHose Log: Write failed Sector 148480, Errno 2
FireHose Log: Finished sector address 148480
PROGRAM: Written Bytes 0x3d800 (64)
Program Size: 0.24 MB
PROGRAM: Replace the partition sectors number 0x100 to file size in sector 0x2d
PROGRAM: Partition 0, Sector: 149504, Length: 45 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sdi.mbn
FireHose Log: start 149504, num 45
FireHose Log: Write failed Sector 149504, Errno 2
FireHose Log: Finished sector address 149504
PROGRAM: Written Bytes 0x5a00 (64)
Program Size: 0.02 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x3aa
PROGRAM: Partition 0, Sector: 180224, Length: 938 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_emmc_appsboot.mbn
FireHose Log: start 180224, num 938
FireHose Log: Write failed Sector 180224, Errno 2
FireHose Log: Finished sector address 180224
PROGRAM: Written Bytes 0x75400 (64)
Program Size: 0.46 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x3aa
PROGRAM: Partition 0, Sector: 181248, Length: 938 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_emmc_appsboot.mbn
FireHose Log: start 181248, num 938
FireHose Log: Write failed Sector 181248, Errno 2
FireHose Log: Finished sector address 181248
PROGRAM: Written Bytes 0x75400 (64)
Program Size: 0.46 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x128
PROGRAM: Partition 0, Sector: 182272, Length: 296 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_rpm.mbn
FireHose Log: start 182272, num 296
FireHose Log: Write failed Sector 182272, Errno 2
FireHose Log: Finished sector address 182272
PROGRAM: Written Bytes 0x25000 (64)
Program Size: 0.14 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x128
PROGRAM: Partition 0, Sector: 183272, Length: 296 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_rpm.mbn
FireHose Log: start 183272, num 296
FireHose Log: Write failed Sector 183272, Errno 2
FireHose Log: Finished sector address 183272
PROGRAM: Written Bytes 0x25000 (64)
Program Size: 0.14 MB
PROGRAM: Replace the partition sectors number 0x5000 to file size in sector 0x38d5
PROGRAM: Partition 0, Sector: 196608, Length: 14549 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_boot.img
FireHose Log: start 196608, num 14549
FireHose Log: Write failed Sector 196608, Errno 2
FireHose Log: Finished sector address 196608
PROGRAM: Written Bytes 0x71aa00 (64)
Program Size: 7.10 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x297
PROGRAM: Partition 0, Sector: 229376, Length: 663 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_tz.mbn
FireHose Log: start 229376, num 663
FireHose Log: Write failed Sector 229376, Errno 2
FireHose Log: Finished sector address 229376
PROGRAM: Written Bytes 0x52e00 (64)
Program Size: 0.32 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x297
PROGRAM: Partition 0, Sector: 230376, Length: 663 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_tz.mbn
FireHose Log: start 230376, num 663
FireHose Log: Write failed Sector 230376, Errno 2
FireHose Log: Finished sector address 230376
PROGRAM: Written Bytes 0x52e00 (64)
Program Size: 0.32 MB
PROGRAM: Partition 0, Sector: 344064, Length: 262160 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_1.img
FireHose Log: start 344064, num 262160
FireHose Log: Write failed Sector 344064, Errno 2
FireHose Log: Finished sector address 344064
PROGRAM: Written Bytes 0x8002000 (64)
Program Size: 128.01 MB
PROGRAM: Partition 0, Sector: 606600, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_2.img
FireHose Log: start 606600, num 16
FireHose Log: Write failed Sector 606600, Errno 29
FireHose Log: Finished sector address 606600
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 610352, Length: 257992 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_3.img
FireHose Log: start 610352, num 257992
FireHose Log: Write failed Sector 610352, Errno 2
FireHose Log: Finished sector address 610352
PROGRAM: Written Bytes 0x7df9000 (64)
Program Size: 125.97 MB
PROGRAM: Partition 0, Sector: 868352, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_4.img
FireHose Log: start 868352, num 16
FireHose Log: Write failed Sector 868352, Errno 2
FireHose Log: Finished sector address 868352
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 872104, Length: 258384 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_5.img
FireHose Log: start 872104, num 258384
FireHose Log: Write failed Sector 872104, Errno 2
FireHose Log: Finished sector address 872104
PROGRAM: Written Bytes 0x7e2a000 (64)
Program Size: 126.16 MB
PROGRAM: Partition 0, Sector: 1130496, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_6.img
FireHose Log: start 1130496, num 16
FireHose Log: Write failed Sector 1130496, Errno 2
FireHose Log: Finished sector address 1130496
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1130888, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_7.img
FireHose Log: start 1130888, num 16
FireHose Log: Write failed Sector 1130888, Errno 2
FireHose Log: Finished sector address 1130888
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1134640, Length: 95712 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_8.img
FireHose Log: start 1134640, num 95712
FireHose Log: Write failed Sector 1134640, Errno 2
FireHose Log: Finished sector address 1134640
PROGRAM: Written Bytes 0x2ebc000 (64)
Program Size: 46.73 MB
PROGRAM: Partition 0, Sector: 1392640, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_9.img
FireHose Log: start 1392640, num 16
FireHose Log: Write failed Sector 1392640, Errno 2
FireHose Log: Finished sector address 1392640
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1654784, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_10.img
FireHose Log: start 1654784, num 16
FireHose Log: Write failed Sector 1654784, Errno 29
FireHose Log: Finished sector address 1654784
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1655176, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_11.img
FireHose Log: start 1655176, num 16
FireHose Log: Write failed Sector 1655176, Errno 29
FireHose Log: Finished sector address 1655176
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1777664, Length: 11376 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_cache_1.img
FireHose Log: start 1777664, num 11376
FireHose Log: Write failed Sector 1777664, Errno 2
FireHose Log: Finished sector address 1777664
PROGRAM: Written Bytes 0x58e000 (64)
Program Size: 5.55 MB
PROGRAM: Replace the partition sectors number 0x5000 to file size in sector 0x3ca9
PROGRAM: Partition 0, Sector: 1974272, Length: 15529 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_recovery.img
FireHose Log: start 1974272, num 15529
FireHose Log: Write failed Sector 1974272, Errno 2
FireHose Log: Finished sector address 1974272
PROGRAM: Written Bytes 0x795200 (64)
Program Size: 7.58 MB
PROGRAM: Replace the partition sectors number 0x800 to file size in sector 0x1
PROGRAM: Partition 0, Sector: 1998848, Length: 1 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_misc_erase.img
FireHose Log: start 1998848, num 1
ReadFile last error: 0
PROGRAM: Written Bytes 0x200 (64)
Program Size: 0.00 MB
PROGRAM: Partition 0, Sector: 2015232, Length: 262136 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_059V786_001.custom_1.img
WriteFile last error: 0
PROGRAM: Send XML command fail code: 9
Failed to write C:\RM-1013\rm1013_2.1.0.12_059V786_001.custom_1.img to the device
Download Fail:FireHose Fail Failed to Upload the emmc images to the phone using Firehose.
Finish Download[/B][/FONT]

Development creation of vbmeta dependencies for current images [WHEN UNLOCK BOOTLOADER AVAILABLE]

vbmeta GDPR variant for RMX3081.
Since GDPR rom don't have unlocked bootloader, no flashing of vbmeta dependent partitions boot, dtbo and recovery possible.
avbtool.py available at :
avbtool.py - platform/external/avb - Git at Google
Info :
vbmeta.img
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>python avbtool.py info_image --image vbmeta.img
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 6400 bytes
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: boot
Rollback Index Location: 4
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: dtbo
Rollback Index Location: 3
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: recovery
Rollback Index Location: 1
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: vbmeta_system
Rollback Index Location: 2
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Chain Partition descriptor:
Partition Name: vbmeta_vendor
Rollback Index Location: 5
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Prop: com.android.build.boot.os_version -> '11'
Prop: com.android.build.boot.security_patch -> '2021-11-05'
Prop: com.android.build.boot.security_patch -> '2021-11-05'
Prop: com.android.build.odm.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.odm.os_version -> '11'
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 65974272 bytes
Tree Offset: 65974272
Tree Size: 520192 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 66494464
FEC size: 532480 bytes
Hash Algorithm: sha1
Partition Name: odm
Salt: cd17909e55ad176f67af4b4ebdf73edaf9bf48a7
Root Digest: ac824b50e11b4753d4f007a93530a3bbca470b38
Flags: 0
vbmeta_system.img
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>python avbtool.py info_image --image vbmeta_system.img
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 320 bytes
Auxiliary Block: 3392 bytes
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Algorithm: SHA256_RSA2048
Rollback Index: 1636070400
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Prop: com.android.build.system.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.system.os_version -> '11'
Prop: com.android.build.system.security_patch -> '2021-11-05'
Prop: com.android.build.system.security_patch -> '2021-11-05'
Prop: com.android.build.product.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.product.os_version -> '11'
Prop: com.android.build.product.security_patch -> '2021-11-05'
Prop: com.android.build.product.security_patch -> '2021-11-05'
Prop: com.android.build.system_ext.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.system_ext.os_version -> '11'
Prop: com.android.build.system_ext.security_patch -> '2021-11-05'
Prop: com.android.build.system.fingerprint -> 'qti/qssi/qssi:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.system.os_version -> '11'
Prop: com.android.build.system.security_patch -> '2021-11-05'
Prop: com.android.build.system.security_patch -> '2021-11-05'
Prop: com.android.build.product.fingerprint -> 'qti/qssi/qssi:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.product.os_version -> '11'
Prop: com.android.build.product.security_patch -> '2021-11-05'
Prop: com.android.build.product.security_patch -> '2021-11-05'
Prop: com.android.build.system_ext.fingerprint -> 'qti/qssi/qssi:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.system_ext.os_version -> '11'
Prop: com.android.build.system_ext.security_patch -> '2021-11-05'
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 4018176 bytes
Tree Offset: 4018176
Tree Size: 36864 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 4055040
FEC size: 32768 bytes
Hash Algorithm: sha1
Partition Name: product
Salt: ea90cf3d978f9b3dd57ae086e7e8ff3a3f83cda9
Root Digest: 0a753c4708bfa3521f27324265a5d32663340868
Flags: 0
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 1024299008 bytes
Tree Offset: 1024299008
Tree Size: 8073216 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 1032372224
FEC size: 8167424 bytes
Hash Algorithm: sha1
Partition Name: system
Salt: 4a5e0c61837ed051993c8b8003e3f0b3cc04e9e6
Root Digest: bb03f13b0e827bb6c911a8fbda5043361bd454fc
Flags: 0
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 1258614784 bytes
Tree Offset: 1258614784
Tree Size: 9916416 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 1268531200
FEC size: 10035200 bytes
Hash Algorithm: sha1
Partition Name: system_ext
Salt: 0b7343a5bb191ca1d07b831fdb75518029854ff4
Root Digest: cd83991a3cf1ef068e1b208a22c5ca4ab3eba2c5
Flags: 0
vbmeta_vendor.img
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>python avbtool.py info_image --image vbmeta_vendor.img
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 320 bytes
Auxiliary Block: 1536 bytes
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Algorithm: SHA256_RSA2048
Rollback Index: 1636070400
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Prop: com.android.build.vendor.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.vendor.os_version -> '11'
Prop: com.android.build.vendor.security_patch -> '2021-11-05'
Prop: com.android.build.vendor.security_patch -> '2021-11-05'
Prop: com.android.build.vendor.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.vendor.os_version -> '11'
Prop: com.android.build.vendor.security_patch -> '2021-11-05'
Prop: com.android.build.vendor.security_patch -> '2021-11-05'
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 593604608 bytes
Tree Offset: 593604608
Tree Size: 4681728 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 598286336
FEC size: 4734976 bytes
Hash Algorithm: sha1
Partition Name: vendor
Salt: e868cf7fced08126a87913c9f79f8a07609ed5c1
Root Digest: 0be5f0290f1702550d417cd7eea6017ec7bb9594
Flags: 0

For .44 ROM
vbmeta.img 8 kb (8.192 B)
vbmeta_system.img 4 kb(4096 B)
vbmeta_vendor.img 4 kb(4096 B)
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 6400 bytes
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: boot
Rollback Index Location: 4
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: dtbo
Rollback Index Location: 3
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: recovery
Rollback Index Location: 1
Public key (sha1): 1a38638478d682b11e32cdb80c6a78b6eacbce91
Chain Partition descriptor:
Partition Name: vbmeta_system
Rollback Index Location: 2
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Chain Partition descriptor:
Partition Name: vbmeta_vendor
Rollback Index Location: 5
Public key (sha1): 1a130f9ac8720d5c66e8b62c92505173633166f6
Prop: com.android.build.boot.os_version -> '11'
Prop: com.android.build.boot.security_patch -> '2021-11-05'
Prop: com.android.build.boot.security_patch -> '2021-11-05'
Prop: com.android.build.odm.fingerprint -> 'qti/atoll/atoll:11/RKQ1.201112.002/root05281023:user/release-keys'
Prop: com.android.build.odm.os_version -> '11'
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 65974272 bytes
Tree Offset: 65974272
Tree Size: 520192 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 66494464
FEC size: 532480 bytes
Hash Algorithm: sha1
Partition Name: odm
Salt: cd17909e55ad176f67af4b4ebdf73edaf9bf48a7
Root Digest: ac824b50e11b4753d4f007a93530a3bbca470b38
Flags: 0
Chainded descriptor for vbmeta check also for boot, dtbo, recovery, vbmeta of system and vendor and odm.
Blocks :
odm -> /dev/block/dm-3
odm-verity -> /dev/block/dm-18
product -> /dev/block/dm-2
product-verity -> /dev/block/dm-16
system -> /dev/block/dm-1
system-verity -> /dev/block/dm-14
system_ext -> /dev/block/dm-6
system_ext-verity -> /dev/block/dm-15
vendor -> /dev/block/dm-0
vendor-verity -> /dev/block/dm-17
dtbo -> /dev/block/sde19
C:\Program Files (x86)\Minimal ADB and Fastboot>py avbtool.py print_partition_digests --image vbmeta.img
boot: 07448596b526b4eef8cdc9455aebe1b27568db2491469876a18cc97e860a4f81
dtbo: 2bec465c55e6d326fc4f79d9a1bdc81a55bd3d5c18198ba2847a467b22fb6330
recovery: f7c3dd185db49a6af8432af658029b47d27b8a48b83be83d5d478f096e84aee8
product: 0a753c4708bfa3521f27324265a5d32663340868
system: bb03f13b0e827bb6c911a8fbda5043361bd454fc
system_ext: cd83991a3cf1ef068e1b208a22c5ca4ab3eba2c5
vendor: 0be5f0290f1702550d417cd7eea6017ec7bb9594
odm: ac824b50e11b4753d4f007a93530a3bbca470b38
More to come when the bootloader can be unlocked and we can flash custom images via fastboot.
.... And private key is also needed ....... !

DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes

I have a Xiaomi Redmi 9 (cattail) device
I am trying to use mtkclient to unbrick my device but i am getting this error:
Code:
DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes
Here is the entire output:
Code:
MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
Port - Device detected :)
Preloader - CPU: MT6765/MT8768t(Helio P35/G35)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x766
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: BEA9E2CD55FC2EB3794A2835E280608C
Preloader - SOC_ID: 27976D1C1A81DBCDB0FC5383E67CB00ADF62A75E37C7066C28E877FFDB8AC544
PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/kyeboard/MIUI_FIX/mtkclient/mtkclient/payloads/mt6765_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 150100434a544434
DAXFlash - Sending emi data ...
DAXFlash
DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes

Hey @LiaFourté, can you please help me?

here with the same problem

If the devices isnt powering on you will have to dissamble so that you can remove the battery and put it back on it will power on.
Next write a boot partition using the devices preloader on your computer like like
Code:
mtk w boot_a boot.img --preloader=preloader_ki7_v7510.bin

bretjoseph said:
If the devices isnt powering on you will have to dissamble so that you can remove the battery and put it back on it will power on.
Next write a boot partition using the devices preloader on your computer like like
Code:
mtk w boot_a boot.img --preloader=preloader_ki7_v7510.bin
Click to expand...
Click to collapse
didnt work

maybe write partition to boot_b or boot if you dont have a/b device

kuubichan said:
I have a Xiaomi Redmi 9 (cattail) device
I am trying to use mtkclient to unbrick my device but i am getting this error:
Code:
DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes
Here is the entire output:
Code:
MTK Flash/Exploit Client V1.6.0 (c) B.Kerler 2018-2022
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Hint:
Power off the phone before connecting.
For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.
For preloader mode, don't press any hw button and connect usb.
If it is already connected and on, hold power for 10 seconds to reset.
Port - Device detected :)
Preloader - CPU: MT6765/MT8768t(Helio P35/G35)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x25
Preloader - Disabling Watchdog...
Preloader - HW code: 0x766
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: BEA9E2CD55FC2EB3794A2835E280608C
Preloader - SOC_ID: 27976D1C1A81DBCDB0FC5383E67CB00ADF62A75E37C7066C28E877FFDB8AC544
PLTools - Loading payload from mt6765_payload.bin, 0x264 bytes
PLTools - Kamakiri / DA Run
Kamakiri - Trying kamakiri2..
Kamakiri - Done sending payload...
PLTools - Successfully sent payload: /home/kyeboard/MIUI_FIX/mtkclient/mtkclient/payloads/mt6765_payload.bin
Port - Device detected :)
DA_handler - Device is protected.
DA_handler - Device is in BROM mode. Trying to dump preloader.
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2136.bin
xflashext - Patching da1 ...
Mtk - Patched "Patched loader msg" in preloader
xflashext
xflashext - [LIB]: Error on patching da1 version check...
Mtk - Patched "Patched loader msg" in preloader
Mtk - Patched "get_vfy_policy" in preloader
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - DRAM config needed for : 150100434a544434
DAXFlash - Sending emi data ...
DAXFlash
DAXFlash - [LIB]: Error on sending emi: unpack requires a buffer of 12 bytes
Click to expand...
Click to collapse
I can flash your device if you want to.
Let me know.

bretjoseph said:
If the devices isnt powering on you will have to dissamble so that you can remove the battery and put it back on it will power on.
Next write a boot partition using the devices preloader on your computer like like
Code:
mtk w boot_a boot.img --preloader=preloader_ki7_v7510.bin
Click to expand...
Click to collapse
From where do you get this, the one for R9a is preloader_k62v1_64_bsp

mvikrant97 said:
I can flash your device if you want to.
Let me know.
Click to expand...
Click to collapse
How? if the issue is with drivers or tool.

SubwayChamp said:
How? if the issue is with drivers or tool.
Click to expand...
Click to collapse
I'll use a paid software to flash the device.
Don't worry you don't need to pay for it.

mvikrant97 said:
I'll use a paid software to flash the device.
Don't worry you don't need to pay for it.
Click to expand...
Click to collapse
Good, and how we can do?, I have all the firmware for Redmi 9a, but I can´t get it to work as of now.

SubwayChamp said:
From where do you get this, the one for R9a is preloader_k62v1_64_bsp
Click to expand...
Click to collapse
try doing a boot.img dump it should also download the preloader when it fetches the boot.img in the folder where you dump

bretjoseph said:
try doing a boot.img dump it should also download the preloader when it fetches the boot.img in the folder where you dump
Click to expand...
Click to collapse
Thanks for replying, I´m not getting to work the mtk-client, it´s keeping throwing errors like DAXFlash - [LIB]: Error on sending DA, so I thought that the other way around could solve it, I could flash nor read any partition. It worked perfectly for my previous devices though.

SubwayChamp said:
Thanks for replying, I´m not getting to work the mtk-client, it´s keeping throwing errors like DAXFlash - [LIB]: Error on sending DA, so I thought that the other way around could solve it, flash nor read any partition. It worked perfectly for my previous devices though.
Click to expand...
Click to collapse
I reached that in mtk client when my device went through smack down!
&& Sp flash tool couldn't get through sending DA, I went to shop , they couldn't do anything.. told me motherboard is dead
Have tried the battery removing part. No use.

Maybe GitHub has a solution , people are talking about passing the preloader , idk if it works..

Ank Sak said:
I reached that in mtk client when my device went through smack down!
&& Sp flash tool couldn't get through sending DA, I went to shop , they couldn't do anything.. told me motherboard is dead
Have tried the battery removing part. No use.
Click to expand...
Click to collapse
Ank Sak said:
Maybe GitHub has a solution , people are talking about passing the preloader , idk if it works..
Click to expand...
Click to collapse
which phone is it?

mvikrant97 said:
which phone is it?
Click to expand...
Click to collapse
Lenevo K8 note , mtk6797 mediatek cpu

Ank Sak said:
I reached that in mtk client when my device went through smack down!
&& Sp flash tool couldn't get through sending DA, I went to shop , they couldn't do anything.. told me motherboard is dead
Have tried the battery removing part. No use.
Click to expand...
Click to collapse
Thanks, in SPFT it throws "EXT_RAM_EXCEPTION" error.
Ank Sak said:
Maybe GitHub has a solution , people are talking about passing the preloader , idk if it works..
Click to expand...
Click to collapse
Maybe, It´s possible that the preloader is the culprit, probably the preloader is corrupt.
But the funniest is that some days ago, with those errors, I taken to a service center, with Unlock tool, without the need to do nothing more than pressing both volume buttons (device off) it started to flash, and solved it, I re-bricked it by flashing the firmware (the latest), it´s suppose to not cause damage but it bricked. So the eMMC is not damaged.

SubwayChamp said:
Thanks, in SPFT it throws "EXT_RAM_EXCEPTION" error.
Maybe, It´s possible that the preloader is the culprit, probably the preloader is corrupt.
But the funniest is that some days ago, with those errors, I taken to a service center, with Unlock tool, without the need to do nothing more than pressing both volume buttons (device off) it started to flash, and solved it, I re-bricked it by flashing the firmware (the latest), it´s suppose to not cause damage but it bricked. So the eMMC is not damaged.
Click to expand...
Click to collapse
service center don't use unlock tool but third party repair shop does

mvikrant97 said:
service center don't use unlock tool but third party repair shop does
Click to expand...
Click to collapse
A Service Center can be authorized or non authorized. Specialization and/or segmentation in the matter/product is what the Marketing inclines this or that name to give as proper, and client consider correct both. Where I live, there are a lot of Official Repair Shops along the country, they´re called too, Service Center/Repair Center, same way, there are a lot of Service Center of a specific product, this is where plays a role the segmentation and specialization. Just to add, that some large enterprises have both department in the hierarchy.