hello everyone,
I am using a Motorola device XT390(based on MTK 6573),it is nice except for the limited roms and several useless appliciations in the stock rom.I really want to get it rooted and get those appliciations deleted.I have tried many diffierent kinds of ways I found via google,but none is working for me so far.Is anybody else here using this device or XT389,has anybody succeeded rooting it?
I have read some technical topic here regarding the MTK 6573 platform,does that necesarilly mean,if I can install CWMR mean I will be able to root it?How is the system partition mounted during starting,via boot.img? A mess in my mind now.
Any information will be highly appricated,
Thanks
are you successed in XT390 rooting?
i've tried methods from chinese forums (zergRush root vio MT6513_MT6573_ROOT.exe files) - no success.
also i've tried to get bootloader unlock code (info on motosite: hhtp:/ /motorola-global-portal.custhelp.com/ app/ standalone/ bootloader/ unlock-your-device-a/), but fastboot returns nothing (no attached devices in fasboot, but 1 attached in adb).
i dont try to install CWMR through CWMR Touch Installer.
if you have any news about root access on XT390, please let me know!
You can boot in recovery with MTKdroid.
I need root too. Whith root this device can performe much better.
lenzexe said:
You can boot in recovery with MTKdroid.
I need root too. Whith root this device can performe much better.
Click to expand...
Click to collapse
I've found ssomething on redigua.com/how-to-root-motorola-motosmart.html but I'm a noob and I don´t know if makes sense. Can someone with more background take a look?
Thanks
This is an updated method on how to root your Motorola MotoSmart.
First, you need the file hboot_2.xx_soff-V8.9.zip, download it.
Unzip it into c:evoroot on your pc.
Second, put your Motorola MotoSmart into development mode by going to Settings->Applications->Development and turn USB debugging on.
Third, connect your Motorola MotoSmart to your computer and set your USB to Just charge.
Fourth, if you get errors with drivers, install their HTC drivers. (You can also install HTC Sync, but it is bulky!)
Fifth, open up a command prompt by typing cmd.
Sixth, type the following commands: (Or copy and paste, easier!)
cd evoroot
adb push root/unrevoked-forever.zip /sdcard/
adb push root/mtd-eng.img /sdcard/
adb push pc36img/PC36IMG-ENG.zip /sdcard/PC36IMG.zip
adb push pc36img/PC36IMG-MR.zip /sdcard/PC36IMG-MR.zip
adb push root/flash_image /data/local/
adb -d install -r root/z4root.apk
Seventh, go to your phone and launch Z4Root app. Then select temp root and wait until its done.
Eighth,go back to command prompt and type:
adb shell
su
If you get a pound(#) sign, that means you have temp root, which just gives you temporary root so we can now install permanent root.
Ninth, lets backup our WiMax 4G RSA just in case we lose it during installation of new ROMs.
Type:
Mkdir /sdcard/nandroid/RSA-PR-BACKUP
Cat /dev/mtd/mtd0 > /sdcard/nandroid/RSA-PR-BACKUP/wimax.img
busybox sed -n /BEGIN CERTIFICATE/,$p /dev/mtd/mtd0 > /sdcard/rsa_OEM.key
Tenth, go back to command prompt and type the following:
chmod 0755 /data/local/flash_image
./data/local/flash_image misc /sdcard/mtd-eng.img
sync
And reboot to bootloader mode by typing:
reboot bootloader
When bootloader mode starts up, it will look for PC36IMG.zip and after about 3 minutes ask you if you want to install PC36IMG.zip.
Say Yes by hitting the volume up button, it should now install the new zip file, should take about 10 minutes. Go grabs some coffee and come back.
Eleventh, reboot when its done by hitting the volume up button.
It will reboot into the OS and we dont want that so takes the battery out and puts it back in it. Then go back to the bootloader by hitting the power button while holding down the volume down button.
Choose Bootloader and wait until you get the triangle sign and type:
adb push recovery /
adb shell busybox Cinstall /sbin
adb shell nohup /sbin/recovery &
Go back to your Motorola MotoSmart and you should see green menus.
Choose install zip from sd card and choose unrevoked-forever.zip
After that installs, Choose MS-USB
Go to your computer and delete PC36IMG.zip, then rename PC36IMG-MR.zip to PC36IMG.zip.
Then power off your Motorola MotoSmart, power back on by pressing Power Button while holding down the Volume Down button, this should get you back into bootloader mode.
Simply wait and when it asks to install the update, hit the Volume Up button.
then reboot your Motorola MotoSmart, your device should now be rooted with Recovery menu then you can flash new ROMs for Motorola MotoSmart.
Click to expand...
Click to collapse
Cris RF said:
I've found ssomething on redigua.com/how-to-root-motorola-motosmart.html but I'm a noob and I don´t know if makes sense. Can someone with more background take a look?
Thanks
Click to expand...
Click to collapse
any success?
mobiclip said:
any success?
Click to expand...
Click to collapse
We will only succeed when we can unlock the bootloader. For that so we need access to the fastboot protocol, witch is bloked (at least in my rom version).
erlyneto said:
We will only succeed when we can unlock the bootloader. For that so we need access to the fastboot protocol, witch is bloked (at least in my rom version).
Click to expand...
Click to collapse
It's good to know it,although it is rather disappointing.Is that possible to modify the binary rom?To do something with the bootloader,or even only to remove the applications not used often to make larger inner storage space,then flash.
Thanks a lot!
mobiclip said:
any success?
Click to expand...
Click to collapse
I failed on step 9,"Seventh, go to your phone and launch Z4Root app. Then select temp root and wait until its done.
Eighth,go back to command prompt and type:
adb shell
su
If you get a pound(#) sign, that means you have temp root, which just gives you temporary root so we can now install permanent root."
When I launch Z4Root app to get temp. root,it never finish.:crying:However, I continued and tried "su" to get temp. root access from adb shell,it is said "permission denied"
Rooted finally,can be one key rooted by a software,but no english version,it is a pity.
Tried on XT390,should be OK for her sister XT 389.:laugh:
http://www.gsmfans.com.br/index.php?topic=313996.0
this method works
lenzexe said:
http://www.gsmfans.com.br/index.php?topic=313996.0
this method works
Click to expand...
Click to collapse
It worked on my XT389 :good:
In order to reader the article i have to registrate on the forum can someone post the method? thank
TheProspi said:
In order to reader the article i have to registrate on the forum can someone post the method? thank
Click to expand...
Click to collapse
Register with a fake email, no activation is needed to login
Sent from my GT-S5830L using xda-developers app
This method works for my XT390
This method works for my XT390. Now I'm rooted
But the question is - i've removed all stock-chinese apps, but internal storage still full (Root Uninstaller free app used).
SOLVED: clear stock-chinese apps data from /data/dalvik-cache.
In order to reader the article i have to registrate on the forum can someone post the method
Click to expand...
Click to collapse
The method is quite simple:
1) install moto drivers for XT390 (i've used official app from motosite - motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481/~/drivers)
2) connect phone, active USB debugging. Windows will show your phone at traybar as "android phone".
3) install AppLocale (microsoft utility for launch chinese apps on windows - download.microsoft.com/download/5/6/8/568a8caf-29c4-43ec-a10f-97730f26977e/apploc.msi)
WARNING - here's the video of installaton procees, some tricks detected: youtube.com/watch?v=9t9iZJBwNA0
4) install chinese app for rooting (simple): products.mgyun.com/api/downjump?productcode=romasterlab
5) after installation, you got 2 shortcuts on your desktop (1 - blue, 2 - blue with yellow), rename them to latin names (root1, root2);
6) launch AppLocale, click next, choose root1 shortcut (blue icon) in the dialog, click NEXT, appLocale detects language, NEXT, FINISH.
7) chinese app starts & tries to detect your phone. If everithing ok - it will show XT390 & sync some data (bars in bottom):
shot is here - imgfans.com.br/NR/Abr13/05/02.png
8) click root
shot is here - imgfans.com.br/NR/Abr13/05/03.png
9) process on, phone will reboot 2-3 times, when it boot finally - you're root
10) Try progs, that use root rights.
WARNING - Do not disconnect usb cable while phone is rooting.
work under root on XT390
Hi, guys!
I've made full backup of my phone. Used this tut - http://forum.xda-developers.com/showthread.php?p=26802588. Works great!
Also i've unpacked boot.img & recovery.img, that was saved during backup look this tut for details: http://forum.xda-developers.com/showthread.php?t=1587411
Now i try to flash my phone via preloader. First of all, how i've entered in preloader mode - install moto drivers, switch off phone, push VOLDOWN button, connect USB. Windows will activate Preloader VCOM driver (check at Control Panel, COM port branch).
I'm using this tut: http://forum.xda-developers.com/showthread.php?t=1982587
To use SP Flash you need scatter file. I've created it with this tut: bm-smartphone-reviews.blogspot.pt/2012/04/creating-rom-dump-of-your-mt65x3-device.html
First problem. Cannot to enter in stock recovery utility PWR+VOLUP - no result, PWR+VOLUP+VOLDOWN - no result.
SOLVED:
1) Power UP phone;
2) when china-logo/moto-logo will apear (or after 1-2 secs) press VOLUP+VOLDOWN
3) recovery will launch & u see standard android recovery img (droidtune.com/wp-content/uploads/2012/07/20684-nexus_one_android_hard_reset_3-150x150.jpg)
4) use VOLUP & VOLDOWN to browse recovery menu, PWR for choise.
5) here's the video, that helps me to enter recovery: www.youtube.com/watch?v=cwHWILMlctI
Second problem - SP Flash Utility couldnot connect to device. I try to run memory tests & save some roms from phone - no result. Tried 2 versions: v2.1134.00 & v3.1224.01
I'm planning to flash CWMR.
My flash map is:
$ su
# cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00040000 "preloader"
mtd1: 00180000 00040000 "dsp_bl"
mtd2: 00300000 00040000 "nvram"
mtd3: 00040000 00040000 "seccnfg"
mtd4: 00080000 00040000 "uboot"
mtd5: 00600000 00040000 "boot"
mtd6: 00600000 00040000 "recovery"
mtd7: 00140000 00040000 "secstatic"
mtd8: 00080000 00040000 "misc"
mtd9: 00040000 00040000 "logo"
mtd10: 00a00000 00040000 "flex"
mtd11: 000c0000 00040000 "expdb"
mtd12: 00280000 00040000 "nrstdata"
mtd13: 101c0000 00040000 "system"
mtd14: 03c00000 00040000 "cache"
mtd15: 096c0000 00040000 "userdata"
in Terminal Emulator:
$ su
dd if=/sdcard/recovery.img of=/dev/mtd/mtd6
I'm planning to flash repacked CWMR for mtk6573 (port CWMR for any mtk6573 - http://forum.xda-developers.com/showthread.php?t=1825722), there is link to: mediafire.com/view/?1zc473vx18g69bn
So final question - could i brick my phone via recovery flashing (flash through TE)?
UPDATE. dd fails with "Invalid argument".
Any ideas?
cenzored said:
Hi, guys!
I've made full backup of my phone. Used this tut - http://forum.xda-developers.com/showthread.php?p=26802588. Works great!
Also i've unpacked boot.img & recovery.img, that was saved during backup look this tut for details: http://forum.xda-developers.com/showthread.php?t=1587411
Now i try to flash my phone via preloader. First of all, how i've entered in preloader mode - install moto drivers, switch off phone, push VOLDOWN button, connect USB. Windows will activate Preloader VCOM driver (check at Control Panel, COM port branch).
I'm using this tut: http://forum.xda-developers.com/showthread.php?t=1982587
To use SP Flash you need scatter file. I've created it with this tut: bm-smartphone-reviews.blogspot.pt/2012/04/creating-rom-dump-of-your-mt65x3-device.html
First problem. Cannot to enter in stock recovery utility PWR+VOLUP - no result, PWR+VOLUP+VOLDOWN - no result.
SOLVED:
1) Power UP phone;
2) when china-logo/moto-logo will apear (or after 1-2 secs) press VOLUP+VOLDOWN
3) recovery will launch & u see standard android recovery img (droidtune.com/wp-content/uploads/2012/07/20684-nexus_one_android_hard_reset_3-150x150.jpg)
4) use VOLUP & VOLDOWN to browse recovery menu, PWR for choise.
5) here's the video, that helps me to enter recovery: www.youtube.com/watch?v=cwHWILMlctI
Second problem - SP Flash Utility couldnot connect to device. I try to run memory tests & save some roms from phone - no result. Tried 2 versions: v2.1134.00 & v3.1224.01
I'm planning to flash CWMR.
My flash map is:
$ su
# cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00040000 "preloader"
mtd1: 00180000 00040000 "dsp_bl"
mtd2: 00300000 00040000 "nvram"
mtd3: 00040000 00040000 "seccnfg"
mtd4: 00080000 00040000 "uboot"
mtd5: 00600000 00040000 "boot"
mtd6: 00600000 00040000 "recovery"
mtd7: 00140000 00040000 "secstatic"
mtd8: 00080000 00040000 "misc"
mtd9: 00040000 00040000 "logo"
mtd10: 00a00000 00040000 "flex"
mtd11: 000c0000 00040000 "expdb"
mtd12: 00280000 00040000 "nrstdata"
mtd13: 101c0000 00040000 "system"
mtd14: 03c00000 00040000 "cache"
mtd15: 096c0000 00040000 "userdata"
in Terminal Emulator:
$ su
dd if=/sdcard/recovery.img of=/dev/mtd/mtd6
I'm planning to flash repacked CWMR for mtk6573 (port CWMR for any mtk6573 - http://forum.xda-developers.com/showthread.php?t=1825722), there is link to: mediafire.com/view/?1zc473vx18g69bn
So final question - could i brick my phone via recovery flashing (flash through TE)?
UPDATE. dd fails with "Invalid argument".
Any ideas?
Click to expand...
Click to collapse
The chinese method works just fine.Just follow the steps described above> Ive rooted the xt389, factory reset, then always on for the developer option.Apps in root can be uninstaled, but do this before the full reset, or you can encounter some errors when you install some apps.
The Romaster Lab program also works in a Spreadtrum SP6820 :victory:
Related
So, there hasn't been any solution to unlock bootloaders of 3rd party certificates, other than multiunlock, seetool2 and semc.
I'm pretty new to this thing... but I'll give it a chance, as nobody did anything in several months.
the_laser posted his solution
His script roots the device, exploits qualcom bug to disable MPU, loads mapper.ko, then excecutes his bootloader patch, then flashes his custom loader.sin
what we lack is the bootloader patch
the_laser left this comment:
the_laser said:
ps.
all that other 3rd-pary unlock tool authors need to do -
- sniff my patched s1boot
- replace S1_SL_Root_xxxx with own
- proudly release new version with words "world first user friendly REAL TRUE TOTALLY SAFE ULTIMATE bootloader unlock blablablablabla"
Click to expand...
Click to collapse
So, insterting mapper.ko maps the next devices
Code:
< /dev/mtd/mtd5ro
< /dev/mtd/mtd5
< /dev/mtd/mtd4ro
< /dev/mtd/mtd4
< /dev/block/mtdblock5
< /dev/block/mtdblock4
Code:
adb shell cat /proc/mtd
dev: size erasesize name
mtd0: 0ce00000 00020000 "system"
mtd1: 03200000 00020000 "cache"
mtd2: 00040000 00020000 "appslog"
mtd3: 0d3c0000 00020000 "userdata"
mtd4: 80000000 00020000 "msm_nand"
mtd5: 00040000 00020000 "userdate"
I wasn't able to read "msm_nand".
I don't know what "userdate" contains, but inside is this "S1_SL_Root_xxxx" that repeats two times. Is this partition the S1boot?
respect to the "my7227bootwrite_*SL" of the laser...
Does anybody has its sources?
Androxyde flashtool plugin comes with a third my7227bootwrite_omniusSL. This one restores the bootloader lock of omnius unlocked phones... Who made this one and how did (s)he made it?
Finaly, i tried disassembling "my7227bootwrite_*SL". I wasn't able to find the patch or the nand image inside. the debug/error messeges, state that it sets some mtd partition in raw mode.
So, I'll start comparing the images after and before the_laser patches...
Questions:
Does anybody have a compiled mtd_utils for this device?
How do I enable raw mode nandread for a partition/block?
What is inside mtd5 and mtd4?
Am I near of a mini brick?
skirhir said:
What is inside mtd5 and mtd4?
Am I near of a mini brick?
Click to expand...
Click to collapse
a: Yes...
I was unable to access to de oob area...
And I was unable to find the image inside the patcher binary, so:
Unlocked with my7227bootwrite_setool2
made a "nandump -o" with busibox(I was unable to access de oob area).
edited the dump and replaced S1_SL_Root_xxxx with omnius one...
made a (flash_erase 0 0) with mtd_utils
made a nandwrite (no flags) with mtd_utils (failed to write with the busybox one).
checked that the image was correctly patched. No difference with the original dump.
Reboot...
No boot, no flashmode, no nothing...
If anyone can point the mistake in the flashing process...
Now I'm trying to resurrect my shiny brick (any Ideas to make a test point matrix connector, or the name of that connector?)
Conclussion: do not try this at home.
unlock bootloader
I know this is not the answer that this thread was meant to find, but omnius has updated its omnius for SE, and now supports bl unlock for the mini, they still will ask for a license to do this, but the good news is that right now its free for a promo that lasts till the 9th i think, anyways i unlocked my bootloader free a few minutes ago without purchasing a license and wanted to share with anyone in the same problem of sim unlocked with omnius that couldnt unlock their bl
Hi All,
I have this rather exotic MediaTeK MT6575 device, called the 尼彩 epade S7, running android 2.3.6.
Specs are:
Hardware : MT6575
Model : epade S7
Build number : X300_N09_T08
Build date UTC : 20120905-031644
Android v : 2.3.6
Baseband v: MAUI.11AMD.W11.50.SP.V14.P2, 2012/07/14 11:46
Kernel v : 2.6.35.7 ([email protected]) (gcc version 4.4.3 (GCC) )
I have three issues with this device
1. To root this device I would like to do an update, using an update.zip file which I install through the recovery mode. The strangest thing is that in recovery mode. I can't select update from sdcard. I can enter recovery mode by holding volume up and the power button. In the recovery mode I can let the menu appear and disappear with the home button, I can navigate the menu with volume up and volume down, but I cannot select any options. The only way out is to remove the battery. Do any other phones suffer from this issue with the recovery mode?
2. I have extracted my whole ROM using SP flash tool, which looks like:
dev: size erasesize name
mtd0: 00040000 00020000 "preloader"
mtd1: 000c0000 00020000 "dsp_bl"
mtd2: 00300000 00020000 "nvram"
mtd3: 00020000 00020000 "seccnfg"
mtd4: 00060000 00020000 "uboot"
mtd5: 00500000 00020000 "boot"
mtd6: 00500000 00020000 "recovery"
mtd7: 00120000 00020000 "secstatic"
mtd8: 00060000 00020000 "misc"
mtd9: 00300000 00020000 "logo"
mtd10: 000a0000 00020000 "expdb"
mtd11: 0d000000 00020000 "system"
mtd12: 03c00000 00020000 "cache"
mtd13: 0d620000 00020000 "userdata"
This is different from the GooPhone Y5 and the Thunderbird 4S phones. I tried to flash a custom recovery for a Goophone Y5 through the SP flash tool, but that failed and resulted in the error:
BROM ERROR:S_DL_GET_DRAM_SETTING_FAIL(5054)
[EMI]obtain DRAM Failed!
[HINT]lease check your load matches to your target which is to be download.
I guess the GooPhone recovery is smaller (4836 kB) than my recovery and that is why this error pops up. Does anybody have experience with this kind of errors? The strange thing is that even when I try to flash my own recovery.img (5120kB) I get this error.
3. Is it possible to flash a CWM or any custom recovery image on this MT6575 phone? I have no experience with android kitchen, but other threads report success.
I have included my recovery.img in this post.
Any help is appreciated.
Try this...
www[dot]droidextra[dot]org/2012/10/17/install-clockworkmod-on-micromax-a52-aisha[dot]html
I own a Micromax A52 with the same config... This worked for me. Also remember to use the scatter file of your phone... Search around you'll get it. Or try the attachment!
u can select an option in recovery by using the menu key
sunny624 said:
u can select an option in recovery by using the menu key
Click to expand...
Click to collapse
Nope, I cannot select with the menu key. No physical key seems to work.
ash1794 said:
Try this...
www[dot]droidextra[dot]org/2012/10/17/install-clockworkmod-on-micromax-a52-aisha[dot]html
I own a Micromax A52 with the same config... This worked for me. Also remember to use the scatter file of your phone... Search around you'll get it. Or try the attachment!
Click to expand...
Click to collapse
Thanks, I have tried this, but my phone won't flash anything. After I start the download with F9, the process starts (red bar) but then it stops and replies BROM ERROR:S_DL_GET_DRAM_SETTING_FAIL(5054). I tried holding the download start (volume down) button all the way, but that won't work either.
Has anyone seen this error before?
e-lime said:
Thanks, I have tried this, but my phone won't flash anything. After I start the download with F9, the process starts (red bar) but then it stops and replies BROM ERROR:S_DL_GET_DRAM_SETTING_FAIL(5054). I tried holding the download start (volume down) button all the way, but that won't work either.
Has anyone seen this error before?
Click to expand...
Click to collapse
yes. the phone is probably locked.
google for engineering points, for example for the candy mt6575 phone.
You either need to prep a cable, or open up the phone and connect two points to get it to switch to flashable mode.
I did not find a cable mod, I opened my Daxian G20 up and soldered wires to the 6 points under the battery.
Check china-phone.ru if your model is there. It might be added any time with instructions.
If you do find a way, please post back and hit thanks if it helped .
Hi there, long time reader, first time contributor.
[Edit: Sorry I just read this should go in Q&A and I do apologise. Can a moderator please move if appropriate?]
I'm hoping some of you on this forum can help me with a Rockchip 3066 TV Box I am working with. The situation is thus:
I have a number of these boxes, 12 in my possession currently with more on the way
I have successfully rooted the boxes through ADB, none of the one click or other methods worked, but rooting through ADB did.
I have tried using rkdump but unfortunately it cannot find the update.img which I assume to mean it doesn't have one.
What I would like to do is setup a box exactly how I want and then image this off and copy the image to the others
As I mentioned, even though it's a Rockhip based chipset, there's no way I can identify to extract any kind of update.img from it. I have seen through other postings that some of the 3066 based boards no longer use the same cramfs file header/structure the previous 2xxx chipset used so this is probably why.
The big thing is, I just want to mirror the setup to other hardware of exactly the same pedigree.
Here is the MTD/partition map:
Code:
1|[email protected]:/dev # cat /proc/mtd
dev: size erasesize name
mtd0: 00400000 00004000 "misc"
mtd1: 00800000 00004000 "kernel"
mtd2: 01000000 00004000 "boot"
mtd3: 01000000 00004000 "recovery"
mtd4: 18000000 00004000 "backup"
mtd5: 08000000 00004000 "cache"
mtd6: 40000000 00004000 "userdata"
mtd7: 00400000 00004000 "kpanic"
mtd8: 20000000 00004000 "system"
mtd9: 6ac00000 00004000 "user"
My thoughts are I could just dd off the partition to the sd card, and dd this back onto the other devices. I could write a shell script easy enough that could do all this, but obviously trial and error could be an expensive process if I start bricking boxes.
So a couple of questions:
Would the DD thing work?
If so which MTD partition(s) should I dd off
any ideas on what the precise format of the copy to and from commands should be assuming this is the way to go about it?
Is this the wrong way to go about it? Are there better suggestions / ways of achieving this i.e. mirroring devices?
There's a number of applications that ship on the box by default too I need to remove as root, and I'd like to automate everything, hence the idea of imaging as opposed to stepping through all the tasks manually.
Use rkdump to dump kernel, boot and recovery (use /dev/block/mtdblock# as an argument), dd'ing system partition should work, but i wouldn't suggest it because it can be modified during creating dump, and this may corrupts image , so its better to copy all files from system using adb and then create ext4 image using make_ext4fs.
After you done use RKAndroidTool to flash dumped images to your device
lolet said:
Use rkdump to dump kernel, boot and recovery (use /dev/block/mtdblock# as an argument), dd'ing system partition should work, but i wouldn't suggest it because it can be modified during creating dump, and this may corrupts image , so its better to copy all files from system using adb and then create ext4 image using make_ext4fs.
After you done use RKAndroidTool to flash dumped images to your device
Click to expand...
Click to collapse
Thanks very much for your reply, unfortunately rkdump cannot find the boot and recovery.img in any of the mtdblocks, only kernel.img. I had read this is because of the FS Rk3066 uses for some images.
Hence the DD route.... but as you said, there is a possibility of corruption.
DoctorDbx said:
Thanks very much for your reply, unfortunately rkdump cannot find the boot and recovery.img in any of the mtdblocks, only kernel.img. I had read this is because of the FS Rk3066 uses for some images.
Hence the DD route.... but as you said, there is a possibility of corruption.
Click to expand...
Click to collapse
You can dd boot & recovery image safely, then strip 0xFF in hex editor from end if you need lower size of images. Try my tool I attached.Type:
"dump.bat info", to get partition structure you will need later to flash the images, then
"dump.bat recovery o",
"dump.bat kernel",
"dump.bat boot o",
"dump.bat system"
Good luck.
Hi,
I'm sorry if these details get too long, but I want to explain the stage and the problem currently I have.
I'm having a Broadcom 21552g device (Alcatel OT-983), which is hard bricked. The OTU of the device say that it already has the greatest version as I had made upgrade once before. I don't want to go to service or repair center because of my credentials.
As for the record, currently the phone is hard-bricked, because I've erased the modem partition only (which is the first partition starts 0x0 and have length 1000000) with fastboot. There is no fastboot any more. The phone shows only black screen and nothing happens on it. The phone was recognized as Alcatel One Touch Device COM5 after OTU install, but I found these 2 good articles:
http://forum.xda-developers.com/showthread.php?t=2322414 and http://forum.gsmhosting.com/vbb/f606/celkon-a19-factory-tool-flash-file-my-birthday-gift-1600605/
I took the Broadcom drivers, so currently the phone is visible in device manager as Broadcom USB to Serial (COM5). I have Broadcom Multiple Flash Tool (FLASHLOADER) version 2.0.7.0, and I've read everything that I managed to find online (Flashtool.chm, BRCM_FlashLoader_ReadMe_V1.5.pdf, FlashLoader.log/s …) I got some understanding of this tool. I have full CWM recovery (made from Rom manager), and additional another live phone, just in case I need some file/partition that I didn't have in backup.
I will post some information that I've got for my phone:
mtd partitions are:
dev: size erasesize name
mtd0: 01000000 00020000 "modem"
mtd1: 00100000 00020000 "sysparm_ind"
mtd2: 00a00000 00020000 "comms"
mtd3: 000c0000 00020000 "dsp_pram"
mtd4: 00300000 00020000 "dsp_dram"
mtd5: 00100000 00020000 "bootloader"
mtd6: 00080000 00020000 "systemdata"
mtd7: 00040000 00020000 "deviceinfo"
mtd8: 00040000 00020000 "ckdatablock"
mtd9: 00100000 00020000 "bootloader2"
mtd10: 00080000 00020000 "FOTAFLAG"
mtd11: 00500000 00020000 "boot"
mtd12: 00500000 00020000 "recovery"
mtd13: 00040000 00020000 "misc"
mtd14: 00080000 00020000 "boot2icon"
mtd15: 07600000 00020000 "system"
mtd16: 03c00000 00020000 "cache"
mtd17: 00100000 00020000 "kpanic"
mtd18: 08300000 00020000 "custpack"
mtd19: 0a000000 00020000 "userdata"
I have this scatter file, generated to get the start addresses:
modem 0x0
{
}
comms 0x1000000
{
}
…
…
As there is no Firmware for my phone, I need to take some structure from some other phone and alter is for mine. I'm using the A51_R10_MMX_DS_NSL_0422 as structure rom (found here: http://micromaxa51development.blogspot.com/), but I also found another firmware, which only compared with A51 one for getting the diff. between them and get the picture what should change to work for mine.
Here I would like to say that I took A51 firmware, replaced all the files in AP directory and the file sysparm_ind.img in the COMMs … folder. Then recreated the bin file that is flashed into the phone by setting, and flashed. The results are absolutely same as my following more specific settings.
I did the following with clean firmware from A51:
1. Put only modem.img (taken with dd if=/dev/mtd/mtd0 of=/sdcard/modem.img) inside AP directory. There is no other file there
2. I copy sysparm_ind.img (taken with dd if=/dev/mtd/mtd1 of=/sdcard/sysparm_ind.img).
3. Alter the xml file: pctools\android_flash_acar_gingerbread.xml to look like this:
<?xml version='1.0' encoding='iso-8859-1' ?>
<usbDownloader>
<!-- creating partition table command -->
<command name="create">
<partInfo>
<name>modem</name>
<length>0x1000000</length>
<attribute>w</attribute>
<address>0x0</address>
</partInfo>
</command>
<command name="flash">
<partInfo>
<name>modem</name>
<file>.\\AP\\modem.img</file>
</partInfo>
</command>
</usbDownloader>
The idea is to flash only the modem.img file inside start address 0x0 and length 0x1000000, also the attribute flag should be w for write (found from one of the manuals what options are available). I'm even giving Read-only flag on that file as original archive have this flag also.
4. Alter the files: pctools\cp_image_all.txt and pctools\cp_image_ind.txt to look like this:
#image file name and path Address (in hex format)
#========================================================== ==========================
#nand preboot image
.\AP\modem.img 0x0000
These files are used when the flash image is generated.
5. After generating the image file, and setting the port setting I'm done. I plug the phone into the USB and with these settings, it is recognized, and Dloading 0% is shown, but after this I got error messages. Will show 3 different settings with 3 different errors (same errors if I use all the .img files in AP folder)
I case: Config file visible in Screenshot1.png, give Ready, then Dloading 0% and then Screenshot1error.png. I'm also attaching log in FlashLoader Screenshot1.log
II case: Config file visible in Screenshot2.png, give Ready, then Dloading 0% and then Screenshot2error.png. I'm also attaching log in FlashLoader Screenshot2.log
II case: Config file visible in Screenshot3.png, give Ready, then Dloading 0% stars increasing up to Dloading 118% (Screenshot3error1.png)and then Screenshot3error2.png, and nothing happens. I can only unplug the phone then Screenshot3error3.png happens. I'm also attaching log in FlashLoader Screenshot3.log
(All these files are in the attached zip file)
I found how should look like FlashLoader.log: http://pastebin.com/MnsRkRMi
According to BRCM_FlashLoader_ReadMe_V1.5.pdf manual, ERROR messages:
#define ERROR_LOAD_PRELOADER_FAILED 0x1000
#define ERROR_LOAD_SCRAMLOADER_FAILED ERROR_LOAD_PRELOADER_FAILED + 0x100
#define ERROR_LOAD_DOWNLOADER_FAILED ERROR_LOAD_PRELOADER_FAILED + 0x200
I go to conclusion that I have problem with PRELOADER.
Thanks to superusr there are similar problems in russian forum:
quick google for "broadcom" "port1" "f0001" and it comes up with a couple of pages in Russian. I didn't found anything that can help.
Thanks to gokur20, We've been in contact (sorry that coudn't reply in time because of urgent problem).
My further investigations lead to nothing useful. I found Alcatel OT-991 which seem to have the first partition called preloader, and in this model is possible to get accurate preloader.img. There is no such partition in my phone, and I can't find what exactly have to setup/download/touch in order to skip these errors and to flash my missing modem partition.
I hope if someone of you have this knowledge to share it with me! Any ideas are also welcome. Thank you!
Thanks also for reading this. Hope it wasn't boring.
Kind and Best Regards
did you repair your phone? I have same problem with voafone smart II a.k.a. alcatel v860 deleted bootloader. I dont have the file sysparm_ind.img for my phone. It would be nice if you can send me your sysparm_ind.imgfile because they have the same structure. thnx
I picked up an AT&T HTC one X with original 4.0.3 ICS and version 1.85 software.
I successfully rooted and unlocked the bootloader. I've installed ROM Manger, TWRP, Flashify etc and flashed various recoveries to the device using all the tools listed. I also tried fastboot flash from the command line when the device is in fastboot mode. All the flashes report image successfully flashed but when I try to boot into recovery mode (again using above tools, adb, fastboot), the device restarts, I get the HTC boot screen (2nd image attached) and the device vibrates once and reboots back into Android.
Any help is appreciated... Thanks.
Inn0vative1 said:
I picked up an AT&T HTC one X with original 4.0.3 ICS and version 1.85 software.
I successfully rooted and unlocked the bootloader. I've installed ROM Manger, TWRP, Flashify etc and flashed various recoveries to the device using all the tools listed. I also tried fastboot flash from the command line when the device is in fastboot mode. All the flashes report image successfully flashed but when I try to boot into recovery mode (again using above tools, adb, fastboot), the device restarts, I get the HTC boot screen (2nd image attached) and the device vibrates once and reboots back into Android.
Any help is appreciated... Thanks.
Click to expand...
Click to collapse
You sure you're installing the correct recoveries? The ATT is very different from the international version and if you had installed one of those, that could explain the trouble. Please post which recovery you last tried. You might just want to update to JB and try again. ICS is so 2011-2012. lol
es0tericcha0s said:
You sure you're installing the correct recoveries? The ATT is very different from the international version and if you had installed one of those, that could explain the trouble. Please post which recovery you last tried. You might just want to update to JB and try again. ICS is so 2011-2012. lol
Click to expand...
Click to collapse
I'm new user so can't post links here. I downloaded the images from the TWRP and ClockworkMod sites, selected for Evita AT&T, which I believe is the correct version for my device.
So far they all have the same result: the device just reboots when I try to go into recovery mode.
Was finally able to boot into recovery several failed attempts with TWRP and ROM manager. If others have this problem you can try this:
So writing to recovery from Android doesn't work well on One X devices, like mine and yours. The device just rebooted whenever I tried to boot to recovery. The only thing that worked for me was writing to the recovery block directly using dd. Try this:
Copy the recovery image to your SD card, then write to the recovery device directly using dd, reboot to bootloader then select recovery:
First get your correct recovery device:
Code:
[email protected]:/ # cat /proc/emmc
dev: size erasesize name
mmcblk0p23: 000ffa00 00000200 "misc"
mmcblk0p22: 00fffe00 00000200 "recovery"
mmcblk0p21: 01000000 00000200 "boot"
mmcblk0p33: 67fffc00 00000200 "system"
mmcblk0p30: 00140200 00000200 "local"
mmcblk0p34: 0ffffe00 00000200 "cache"
mmcblk0p35: 97fffe00 00000200 "userdata"
mmcblk0p26: 01400000 00000200 "devlog"
mmcblk0p28: 00040000 00000200 "pdata"
mmcblk0p36: 27be00000 00000200 "fat"
mmcblk0p31: 00010000 00000200 "extra"
mmcblk0p17: 02d00000 00000200 "radio"
mmcblk0p18: 00a00000 00000200 "adsp"
mmcblk0p16: 00100000 00000200 "dsps"
mmcblk0p19: 00500000 00000200 "wcnss"
mmcblk0p20: 007ffa00 00000200 "radio_config"
mmcblk0p24: 00400000 00000200 "modem_st1"
mmcblk0p25: 00400000 00000200 "modem_st2"
Look for the one labeled "recovery" (mmcblk0p22 in my case)
Then write your recovery image to that device:
Code:
[email protected]:/ # dd if=/sdcard/openrecovery-twrp-2.6.3.0-evita.img of=/dev/block/mmcblk0p22
[email protected]:/ # reboot
You should be able to reboot to the bootloader from adb or TWRP. Don't install a new recovery from TWRP.
Most likely the issue was caused from Rom Manager. So much better to install manually.