USB>task 32
Level = 0
USB>lnbs spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**ERROR: NO header matched
Cert Key Error
USB>
Thanks
jimmy69 said:
USB>task 32
Level = 0
USB>lnbs spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**ERROR: NO header matched
Cert Key Error
USB>
Thanks
Click to expand...
Click to collapse
Do not use lnbs-command, use lnb instead.
USB>lnb spl-1.04.nb 50020000
this will work!
An anohter error!
task 32
Level = 0
USB>lnb spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**Code entry point at 0x50040000
USB>
No, it's Ok, sorry
jimmy69 said:
task 32
Level = 0
USB>lnb spl-1.04.nb 50020000
:F=spl-1.04.nb
:A=50020000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 50020000 Length: 40000
**Code entry point at 0x50040000
USB>
Click to expand...
Click to collapse
Why? All works fine. Check your Bootloader Screen. Press Buttons: Ok + Power + WirelessManager hold it and soft reset with styles. You should see
IPL 1.01
SPL 1.01MFG
In this moment:
IPL-1.00
HERM200
SPL-1.04
but not its possible to change radio to 1.27.000
Error invalid 114
try it once again!
EDIT:
You should see
IPL 1.01
SPL 1.04
When flashing 1.01 MFG
You should see
IPL 1.01
SPL 1.01MFG
Related
Hi,
I was curious if anyone has an extracted imgfs from a WM6 install that they can point me over to? I would like to play with some WM6 to WM5 programs. I cannot for the life of me get any of the WM6 Roms to extract properly I keep getting errors.
Thanks,
Rich
have you tried "Rom Koch?" It in one of the stickies at the top of the page.
RichTJ99 said:
Hi,
I was curious if anyone has an extracted imgfs from a WM6 install that they can point me over to? I would like to play with some WM6 to WM5 programs. I cannot for the life of me get any of the WM6 Roms to extract properly I keep getting errors.
Thanks,
Rich
Click to expand...
Click to collapse
the correct procedure is as follows (manually)
NBHExtract (or use my NBHDump, it's faster!) --> aChef/aWaiter to generate imgfs from OS.nb --> Imgfs tools (imgfsview, addfile) etcetera --> aChef/aWaiter to rebuild OS.nb --> NBHGen to generate flashable NBH
I had been using, NNHextract to the ruu_signed.nbh file to generate an 02_OS.nb file, then I use the prepare_imgfs.exe 02_OS.NB, this generates imgfs_raw_data.bin
Then I use viewimgfs.exe imgfs_raw_data.bin ---- Did I miss a step somewhere?
Code:
Here was the output:
C:\imgfs_tools_182>viewimgfs.exe imgfs_raw_data.bin
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8 4F 31 DC
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 0001D317
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: 00003100
dwNextHeaderBlock: FFFBFFFF (size: FFFBFDFF)
Header type: 2F5314CE, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 00000400, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 000004C0, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
Address: FFFBFFFF, dwBlockSignature: 00000000
dwNextHeaderBlock: 00000000 (size: 00040001)
Header type: 00000000, Addr: FFFC0007
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC003B
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC006F
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC00A3
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC00D7
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC010B
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC013F
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC0173
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: FFFC01A7
Unknown header type, FS_DATA_TABLE??
do not use prepareimgfs.exe, use aChef.
So I was able to use the Achef to get the imgfs_raw_data.bin file out of the 02_OS.nb. How do I extract all the files / directories from the imgfs_raw_data.bin to a sub directory?
BTW, my goal is to fully extract the WM6 onto windows to play with the OS itself.
use viewimgfs now on the new bin file.
I used the command:
Code:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\aChef-v_0_2_1>viewimgfs.exe imgfs_raw_data.bin
C:\aChef-v_0_2_1>
Nothing happens?
No errors, just nothing at all...
Any ideas, I think I am pretty close to where I need to be.
Sorry to come accross as a newb but I am really confused on what I might be doing wrong to dump this rom. Any suggestions?
Thanks,
Rich
I have a Rom http://www.dopodasia.com/download/RUU_1.32.707.0_DOPODWWE_Ship.exe
I use WinRAR open the RUU_1.32.707.0_DOPODWWE_Ship.exe,I find the nksigned.nbh. Rename to nk.nbh.
1. cmd
D:\tt2>NBHextract.exe nk.nbh -v
=== NBHextract v1.0
=== Extract contents from HTC NBH files
=== (c)2007 xda-developers.com
=== by: pof & TheBlasphemer based on itsme perl scripts
Device: StarTrek
CID: DOPOD001
Version: 1.32.707.0
Language: WWE
Extracting: 00_G3IPL.nb
Extracting: 01_G4IPL.nb
Extracting: 02_SPL.nb
Extracting: 03_GSM.nb
Extracting: 04_ExtROM.nb
Extracting: 05_MainSplash.nb
Encoding: 05_MainSplash.bmp
Extracting: 06_OS.nb
rename 06_OS.nb to OS.nb
2.
D:\tt2>NBSplit -hermes OS.nb
NBSplit 2.0 RC 2
Done.
3.
D:\tt2>ImgfsFromNb OS.nb.payload imgfs.bin
ImgfsFromNb 2.0 RC 2
Searching for IMGFS start...
Found IMGFS at 0045e860.
Dumping IMGFS at offset 0045e860 (size 02217a08)
Done!
4.
D:\tt2>ImgfsToDump imgfs.bin
ImgfsToDump 2.0 RC 2
guidBootSignature: F8 AC 2C 9D E3 D4 2B 4D BD 30 91 6E D8
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: LZX
dwFreeSectorCount: 00002B22
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
Address: 00000200, dwBlockSignature: FFFFFEFE
dwNextHeaderBlock: 00000000 (size: FFFFFE00)
Header type: 00000270, Addr: 00000208
Unknown header type, FS_DATA_TABLE??
Header type: 00760070, Addr: 0000023C
Unknown header type, FS_DATA_TABLE??
Header type: 000002A4, Addr: 00000270
Unknown header type, FS_DATA_TABLE??
Header type: 000002D8, Addr: 000002A4
Unknown header type, FS_DATA_TABLE??
Header type: 0000030C, Addr: 000002D8
Unknown header type, FS_DATA_TABLE??
Header type: 00000000, Addr: 0000030C
Unknown header type, FS_DATA_TABLE??
Header type: 000003A8, Addr: 00000340
Unknown header type, FS_DATA_TABLE??
Header type: 0072006F, Addr: 00000374
Unknown header type, FS_DATA_TABLE??
Header type: 00300053, Addr: 000003A8
Unknown header type, FS_DATA_TABLE??
It's defeated .What can I do??
Please Help me! Thanks!!!
um, i'd try posting in the general tech area... more chance for a reply
Hello,
I have a question for all coockers about file structure.
I've managed to edit my OS.nb for removing the first partition how is unusable on our Prophet.
My problem is now with RomMaster : I can't extract my XIP anymore, I test to Fix my XIP start and end address but don't work (Make_XIP from hypercore don't work too).
Some informations :
My error with RomMaster :
[Info] It is a common ROM.
[Error] File struct error, xip end offset is 0x77b82448, but file length is 0x035f0000.
Click to expand...
Click to collapse
What I test to resolve my problem, so it don't work too
D:\ROMEDIT> RomMaster.exe -s 0x00000400 -e 0x0030FFF0 -w 5 OS.nb
[Info] It is a common ROM.
[Error] File struct error, xip end offset is 0x77b82448, but file length is 0x035f0000.
Click to expand...
Click to collapse
My OS.nb info (make with NBInfo.exe)
NBInfo 2.1rc2
'OS.nb' has valid boot sector
Partition table:
Partition 0
-----------
File System: 0x23 (XIP RAM)
Start Sector: 0x00000002
Total Sectors: 0x00001800
Boot indicator: 0x00
First Head: 0x02
First Sector: 0x01
First Track: 0x00
Last Head: 0x7f
Last Sector: 0x01
Last Track: 0x30
Partition 1
-----------
File System: 0x25 (imgfs)
Start Sector: 0x00001880
Total Sectors: 0x00019700
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x01
First Track: 0x31
Last Head: 0xff
Last Sector: 0x01
Last Track: 0x1c7
Partition 2
-----------
File System: 0x00 (unknown)
Start Sector: 0x00000000
Total Sectors: 0x00000000
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x00
First Track: 0x00
Last Head: 0x00
Last Sector: 0x00
Last Track: 0x00
Partition 3
-----------
File System: 0x00 (unknown)
Start Sector: 0x00000000
Total Sectors: 0x00000000
Boot indicator: 0x00
First Head: 0x00
First Sector: 0x00
First Track: 0x00
Last Head: 0x00
Last Sector: 0x00
Last Track: 0x00
Geometry: flash has 128 virtual heads
MSFLSH50 header found at offset 0x200
(0 Reserved Entries, 2 Flash Region Entries)
Flash Region Entry 0:
---------------------
Region type: XIP
Start phys. block: 0x00000000
Size in phys. blocks: 0x00000000
Size in log. blocks: 0x00000061 -> Size in sectors: 0x00003080
Sectors per block: 0x00000080
Bytes per block: 0x00010000
Compact blocks: 0x00000000
-> Bytes per sector: 0x00000200
Flash Region Entry 1:
---------------------
Region type: READONLY_FILESYS
Start phys. block: 0x00000000
Size in phys. blocks: 0x00000000
Size in log. blocks: 0x0000032e -> Size in sectors: 0x00019700
Sectors per block: 0x00000080
Bytes per block: 0x00010000
Compact blocks: 0x00000000
-> Bytes per sector: 0x00000200
Searching for IMGFS signature...
Found IMGFS at byte 0x00310000 (sector 0x00001880).
dwFSVersion: 00000001
dwSectorsPerHeaderBlock: 00000001
dwRunsPerFileHeader: 00000001
dwBytesPerHeader: 00000034
dwChunksPerSector: 00000008
dwFirstHeaderBlockOffset: 00000200
dwDataBlockSize: 00001000
szCompressionType: XPR
dwFreeSectorCount: 00000000
dwHiddenSectorCount: 00000100
dwUpdateModeFlag: 00000000
---
Click to expand...
Click to collapse
So, if anyone can explain to me how to fix my XIP addresses to extract and modify it... Or without fixing an another method to extract XIP from my ROM (RomMaster and Make_XIP don't work with it)
Thanks in advance for your responses.
ps : sorry for my English for my problem explain but it's not my native language
Have you tried msflshtool to extract your xip partition ?!
hma4 said:
Have you tried msflshtool to extract your xip partition ?!
Click to expand...
Click to collapse
Thanks for your response, when I dump my ROM with this tool I've two files OS.nb.part0 and OS.nb.part1, so what is the real format of those files ? it's nb or bin extension (real) cause I want a bin file to edit with XipPort how request a xip.bin file.
I havn't tried to rename it cause don't say if it's the good format.
Just need that
Another question : for XIP can I add/remove some "FF FF" at the end to change the size? (for offset definition msflh50 header) ?
Thank for your hard work, perfect ROM and your help
xvx45 said:
Thanks for your response, when I dump my ROM with this tool I've two files OS.nb.part0 and OS.nb.part1, so what is the real format of those files ? it's nb or bin extension (real) cause I want a bin file to edit with XipPort how request a xip.bin file.
I havn't tried to rename it cause don't say if it's the good format.
Just need that
Another question : for XIP can I add/remove some "FF FF" at the end to change the size? (for offset definition msflh50 header) ?
Thank for your hard work, perfect ROM and your help
Click to expand...
Click to collapse
it's bin format. just rename it to xip.bin
you don't have to touch those FF in xip
Thank hma4 for your quick responses !
I'll test it !
So addinf FF at the end of XIP can make it unusable or anything else ?
hma4 said:
Have you tried msflshtool to extract your xip partition ?!
Click to expand...
Click to collapse
hma4
how to use this tool ( command, or Syntax )
Thank so much
Hello,
I am losing my mind while building ipset binary to android, i am worked on it at least two hours, i have successfully builded kernel module for ipset, it is working fine but i cannot run ipset binary on my device. (nexus 5)
Code:
PKG_CONFIG_PATH=/storage/android/lib/pkgconfig CC=/storage/arm-linux-gnueabi-linaro_4.9.1-2014.06/bin/arm-eabi-cc ./configure --with-kmod=no --enable-shared=no --host=arm-linux-gnueabi --prefix=/storage/android
With this configuration command, ipset builds fine, but when i push it to /system/bin/ipset, i can not execute it from here.
Code:
/system/bin # ./ipset
/sbin/sh: ./ipset: not found
readelf -hd ipset output
Code:
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: ARM
Version: 0x1
Entry point address: 0x92a1
Start of program headers: 52 (bytes into file)
Start of section headers: 365580 (bytes into file)
Flags: 0x5000202, has entry point, Version5 EABI, soft-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 38
Section header string table index: 35
Dynamic section at offset 0x171e0 contains 25 entries:
Tag Type Name/Value
0x00000001 (NEEDED) Shared library: [libdl.so.2]
0x00000001 (NEEDED) Shared library: [libc.so.6]
0x0000000c (INIT) 0x8b98
0x0000000d (FINI) 0x1038c
0x00000019 (INIT_ARRAY) 0x271d4
0x0000001b (INIT_ARRAYSZ) 4 (bytes)
0x0000001a (FINI_ARRAY) 0x271d8
0x0000001c (FINI_ARRAYSZ) 4 (bytes)
0x00000004 (HASH) 0x818c
0x00000005 (STRTAB) 0x86ec
0x00000006 (SYMTAB) 0x831c
0x0000000a (STRSZ) 576 (bytes)
0x0000000b (SYMENT) 16 (bytes)
0x00000015 (DEBUG) 0x0
0x00000003 (PLTGOT) 0x272d0
0x00000002 (PLTRELSZ) 440 (bytes)
0x00000014 (PLTREL) REL
0x00000017 (JMPREL) 0x89e0
0x00000011 (REL) 0x89c8
0x00000012 (RELSZ) 24 (bytes)
0x00000013 (RELENT) 8 (bytes)
0x6ffffffe (VERNEED) 0x89a8
0x6fffffff (VERNEEDNUM) 1
0x6ffffff0 (VERSYM) 0x892c
0x00000000 (NULL) 0x0
readelf -hd iptables output (the one that comes with android, works fine)
Code:
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: DYN (Shared object file)
Machine: ARM
Version: 0x1
Entry point address: 0x5348
Start of program headers: 52 (bytes into file)
Start of section headers: 223636 (bytes into file)
Flags: 0x5000000, Version5 EABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 27
Section header string table index: 26
Dynamic section at offset 0x32cec contains 26 entries:
Tag Type Name/Value
0x00000003 (PLTGOT) 0x33e44
0x00000002 (PLTRELSZ) 864 (bytes)
0x00000017 (JMPREL) 0x4a00
0x00000014 (PLTREL) REL
0x00000011 (REL) 0x1080
0x00000012 (RELSZ) 14720 (bytes)
0x00000013 (RELENT) 8 (bytes)
0x6ffffffa (RELCOUNT) 1835
0x00000015 (DEBUG) 0x0
0x00000006 (SYMTAB) 0x148
0x0000000b (SYMENT) 16 (bytes)
0x00000005 (STRTAB) 0x8c8
0x0000000a (STRSZ) 1098 (bytes)
0x00000004 (HASH) 0xd14
0x00000001 (NEEDED) Shared library: [libc.so]
0x00000001 (NEEDED) Shared library: [libm.so]
0x00000001 (NEEDED) Shared library: [libstdc++.so]
0x00000020 (PREINIT_ARRAY) 0x33c6c
0x00000021 (PREINIT_ARRAYSZ) 0x8
0x00000019 (INIT_ARRAY) 0x33c74
0x0000001b (INIT_ARRAYSZ) 8 (bytes)
0x0000001a (FINI_ARRAY) 0x33c7c
0x0000001c (FINI_ARRAYSZ) 8 (bytes)
0x0000001e (FLAGS) BIND_NOW
0x6ffffffb (FLAGS_1) Flags: NOW
0x00000000 (NULL) 0x0
I think the problem is libraries, i also pushed the libc.so.6 and libdl to /system/lib with no success.
Could someone point out where i am doing the mistake?
Thanks.
Hi All
I recently purchased the Mediapad 10 Link LTE model.
As is my usual habit I am posting my research into the device here. This info is not useful to the day to day user but is ment as a resource of information for developers.
CPU: Hi3620 K3v2 (K3V200)
BaseBand: balong710 (not proven exactly, could be x-gold , needs confirming)
Here i've posted the initial parition data
Parition Information
i rooted early on using Framaroot and Pippin exploit,
I backed up all the partitions and have been running reversing on many
although the cache parition showed no files i did run strings on it returning some usefull info from it's inital setup at factory(assumed)
==================update partition list=================
partition table changed, upgrading partition table...
============upgrade partition table =============
*******************GPT*************************
GptHeader.signatureX: E F I P A R T
GptHeader.revision: 0x00010000
GptHeader.header_size: 0x0000005c
GptHeader.header_crc32: 0x26d7c5cc
GptHeader.my_lba: 0x0000000000000001
GptHeader.alternate_lba: 0x0000000001d59fff
GptHeader.first_usable_lba:0x0000000000000022
GptHeader.last_usable_lba: 0x0000000001d59fff
GptHeader.partition_entry_array_crc32:0x40252416
GptHeader.partition_entry_lba: 0x0000000000000002
GptHeader.num_partition_entries: 0x00000080
GptHeader.sizeof_partition_entry: 0x00000080
partition first_lba last_lba size
xloader 0x100 0x2ff 0M
round 0x300 0x1fff 3M
nvme 0x2000 0x3fff 4M
misc 0x4000 0x5fff 4M
splash 0x6000 0x9fff 8M
oeminfo 0xa000 0x19fff 32M
logo 0x1a000 0x1ffff 12M
vrcb 0x20000 0x21fff 4M
recovery2 0x22000 0x29fff 16M
recovery 0x2a000 0x31fff 16M
boot 0x32000 0x35fff 8M
modemimage 0x36000 0x55fff 64M
modemnv 0x56000 0x59fff 8M
modemnv2 0x5a000 0x5dfff 8M
cache 0x5e000 0xddfff 256M
system 0xde000 0x1ddfff 512M
cust 0x1de000 0x2ddfff 512M
userdata 0x2de000 0x2e5fff 16M
reserve1 0x2e6000 0x2edfff 16M
reserve2 0x2ee000 0x2f5fff 16M
lowpower 0x2f6000 0x2fdfff 16M
data 0x2fe000 0x1d59fff 13496M
=========================================
completing update partition list...
complete_update_partition_list mod boot :first_lba=204800,last_lba=221183
complete_update_partition_list mod recovery :first_lba=172032,last_lba=204799
complete_update_partition_list mod modemimage :first_lba=221184,last_lba=352255
complete_update_partition_list mod modemnv :first_lba=352256,last_lba=368639
complete_update_partition_list mod logo :first_lba=106496,last_lba=131071
complete_update_partition_list mod lowpower :first_lba=3104768,last_lba=3137535
complete_update_partition_list mod vrcb :first_lba=131072,last_lba=139263
complete_update_partition_list mod round :first_lba=768,last_lba=8191
complete_update_partition_list mod userdata :first_lba=3006464,last_lba=3039231
complete_update_partition_list mod system :first_lba=909312,last_lba=1957887
complete_update_partition_list mod cust :first_lba=1957888,last_lba=3006463
complete_update_partition_list mod cache :first_lba=385024,last_lba=909311
==================update partition list=================
partition start_offset dwDataLen first_lba last_lba compress
fastboot 0x13318 0x4610c 0 0 0
boot 0x59dbe 0x49b800 0x32000 0x35fff 0
recovery 0x4f6212 0x5f7800 0x2a000 0x31fff 0
modemimage 0xaf47ac 0x369a094 0x36000 0x55fff 0
modemnv 0x418f5d8 0x69a094 0x56000 0x59fff 0
logo 0x4829e9e 0x3e8000 0x1a000 0x1ffff 0
lowpower 0x4c12f3a 0x81b1ba 0x2f6000 0x2fdfff 0
vrcb 0x542e158 0x200 0x20000 0x21fff 0
round 0x542e3bc 0x200 0x300 0x1fff 0
userdata 0x542eeba 0x44d088 0x2de000 0x2e5fff 0
system 0x58ba8ee 0x1f4a3c28 0xde000 0x1ddfff 0
cust 0x24d89d8c 0x15c08a54 0x1de000 0x2ddfff 0
cache 0x3a993476 0x6190c4 0x5e000 0xddfff 0
sd_blacklist 0x3afac5a0 0x8 0 0 0
sensors 0x3afac708 0x7e796 0 0 0
=================================================
writing partitions...
[firmware_update]:write_partition fastboot
[write_partition_fastboot]:img_file_sizes=286988
[write_partition_fastboot]:success write fastboot_need_write_size(0x10800) to boot0 emmc
[write_partition_fastboot]:write_partition_xloader start.size=3590c
[write_partition_xloader]:success write image to emmc
[firmware_update]:write_partition bootsd_offset = 0x59dbe
vrlhead.MegicNumber:SecVRLTableV1.1
Don't copy boot's vrl header into partition
list_entry.dwDataLen = 0x0049b000
list_entry.start_offset = 0x5a5be
vrlhead.VrlItemTab.Address = 0x05200100
vrl_addr = 0x5200000
tmp_entry->name:sec_token
Click to expand...
Click to collapse
and
Find update package success path:/mnt/sdcard2/dload/update.app
update_package_exist,total upgrade file size=990031520
read_power_supply_info, success to open power supply file /sys/class/power_supply/ChargerAC/online
read_power_supply_info, power supply info is 1
check_charger_online, charger_ac online
low_power_check, charger is online
huawei_sd_update:update_threshold_check success...
coulometer_firmware_upgrade ret = 0
update coulmeter successfully
umount /system error=-1
update coulmeter:unmount system fail
update_threshold_check, boot.status=
get_specified_mbn, fopen /mnt/sdcard2/dload/update.app success!
first module: old_off = 92
first module: dwHeaderlen = 100
first module: dwHeaderVer = 1
first module: dwDataStarAdd = 0xffffffff
first module: dwDatalen = 128
first module: date = 2013.08.21
first module: time = 14.49.21
first module: name = MD5RSA
get_specified_mbn , success to find first module head MD5RSA
first module is not CRC module
mod_head szDispName = CRC:
dwHeaderLen = 128, dwDataStarAdd = 0xffffffff,dwDataLen = 60412,date = 2013.08.21,time = 14.49.21
get_specified_mbn Read module to memory success
get_crc_mbn success...
Create tmp file for integrity check success
Get crclist module raw data success :60412 byte
first module: old_off = 92
first module: dwHeaderlen = 100
first module: dwHeaderVer = 1
first module: dwDataStarAdd = 0xffffffff
first module: dwDatalen = 128
first module: date = 2013.08.21
first module: time = 14.49.21
first module: name = MD5RSA
Begin circulate crc check each module...
sacan first module over
mod_head szDispName = CRC:
dwHeaderLen = 128, dwDataStarAdd = 0xffffffff,dwDataLen = 60412,date = 2013.08.21,time = 14.49.21
mod_head szDispName = PTABLE:
dwHeaderLen = 108, dwDataStarAdd = 0xffffffff,dwDataLen = 17408,date = 2013.08.21,time = 14.49.22
module PTABLE is not compressed
module PTABLE crc check success..................
parsing ptable from update package...
============ partition table =============
partition first_lba last_lba size
xloader 0x100 0x2ff 0M
round 0x300 0x1fff 3M
nvme 0x2000 0x3fff 4M
misc 0x4000 0x5fff 4M
splash 0x6000 0x9fff 8M
oeminfo 0xa000 0x19fff 32M
logo 0x1a000 0x1ffff 12M
vrcb 0x20000 0x21fff 4M
recovery2 0x22000 0x29fff 16M
recovery 0x2a000 0x31fff 16M
boot 0x32000 0x35fff 8M
modemimage 0x36000 0x55fff 64M
modemnv 0x56000 0x59fff 8M
modemnv2 0x5a000 0x5dfff 8M
cache 0x5e000 0xddfff 256M
system 0xde000 0x1ddfff 512M
cust 0x1de000 0x2ddfff 512M
userdata 0x2de000 0x2e5fff 16M
reserve1 0x2e6000 0x2edfff 16M
reserve2 0x2ee000 0x2f5fff 16M
lowpower 0x2f6000 0x2fdfff 16M
data 0x2fe000 0xd8ffff 5412M
=========================================
mod_head szDispName = FASTBOOT:
dwHeaderLen = 240, dwDataStarAdd = 0xffffffff,dwDataLen = 286988,date = 2013.08.21,time = 14.49.22
module FASTBOOT is not compressed
module FASTBOOT crc check success..................
mod_head szDispName = BOOT:
dwHeaderLen = 2458, dwDataStarAdd = 0xffffffff,dwDataLen = 4831232,date = 2013.08.21,time = 14.49.22
module BOOT is not compressed
module BOOT crc check success..................
mod_head szDispName = RECOVERY:
dwHeaderLen = 3154, dwDataStarAdd = 0xffffffff,dwDataLen = 6256640,date = 2013.08.21,time = 14.49.22
module RECOVERY is not compressed
module RECOVERY crc check success..................
mod_head szDispName = MODEMIMAGE:
dwHeaderLen = 28056, dwDataStarAdd = 0xffffffff,dwDataLen = 57254036,date = 2013.08.21,time = 14.49.22
module MODEMIMAGE is not compressed
module MODEMIMAGE crc check success..................
mod_head szDispName = MODEMNV:
dwHeaderLen = 3480, dwDataStarAdd = 0xffffffff,dwDataLen = 6922388,date = 2013.08.21,time = 14.49.24
module MODEMNV is not compressed
module MODEMNV crc check success..................
mod_head szDispName = LOGO:
dwHeaderLen = 2098, dwDataStarAdd = 0xffffffff,dwDataLen = 4096000,date = 2013.08.21,time = 14.49.24
module LOGO is not compressed
module LOGO crc check success..................
mod_head szDispName = LOWPOWER:
dwHeaderLen = 4250, dwDataStarAdd = 0xffffffff,dwDataLen = 8499642,date = 2013.08.21,time = 14.49.24
module LOWPOWER is not compressed
module LOWPOWER crc check success..................
mod_head szDispName = VRCB:
dwHeaderLen = 100, dwDataStarAdd = 0xffffffff,dwDataLen = 512,date = 2013.08.21,time = 14.49.24
module VRCB is not compressed
module VRCB crc check success..................
mod_head szDispName = ROUND:
dwHeaderLen = 100, dwDataStarAdd = 0xffffffff,dwDataLen = 512,date = 2013.08.21,time = 14.49.24
module ROUND is not compressed
module ROUND crc check success..................
mod_head szDispName = USERDATA:
dwHeaderLen = 2302, dwDataStarAdd = 0xffffffff,dwDataLen = 4509832,date = 2013.08.21,time = 14.49.24
module USERDATA is not compressed
module USERDATA crc check success..................
mod_head szDispName = SYSTEM:
dwHeaderLen = 256426, dwDataStarAdd = 0xffffffff,dwDataLen = 524958760,date = 2013.08.21,time = 14.49.24
module SYSTEM is not compressed
module SYSTEM crc check success..................
mod_head szDispName = CUST:
dwHeaderLen = 178292, dwDataStarAdd = 0xffffffff,dwDataLen = 364939860,date = 2013.08.21,time = 14.49.37
module CUST is not compressed
module CUST crc check success..................
mod_head szDispName = CACHE:
dwHeaderLen = 3222, dwDataStarAdd = 0xffffffff,dwDataLen = 6394052,date = 2013.08.21,time = 14.49.46
module CACHE is not compressed
module CACHE crc check success..................
mod_head szDispName = SD_BLACKLIST:
dwHeaderLen = 100, dwDataStarAdd = 0xffffffff,dwDataLen = 8,date = 2013.08.21,time = 14.49.46
module SD_BLACKLIST is not compressed
module SD_BLACKLIST crc check success..................
mod_head szDispName = SENSORS:
dwHeaderLen = 352, dwDataStarAdd = 0xffffffff,dwDataLen = 518038,date = 2013.08.21,time = 14.49.46
module SENSORS is not compressed
module SENSORS crc check success..................
Has scaned the entire module
Integrity check all success!
==================update partition list=================
partition start_offset dwDataLen first_lba last_lba compress
fastboot 0x13318 0x4610c 0 0 0
boot 0x59dbe 0x49b800 0 0 0
recovery 0x4f6212 0x5f7800 0 0 0
modemimage 0xaf47ac 0x369a094 0 0 0
modemnv 0x418f5d8 0x69a094 0 0 0
logo 0x4829e9e 0x3e8000 0 0 0
lowpower 0x4c12f3a 0x81b1ba 0 0 0
vrcb 0x542e158 0x200 0 0 0
round 0x542e3bc 0x200 0 0 0
userdata 0x542eeba 0x44d088 0 0 0
system 0x58ba8ee 0x1f4a3c28 0 0 0
cust 0x24d89d8c 0x15c08a54 0 0 0
cache 0x3a993476 0x6190c4 0 0 0
sd_blacklist 0x3afac5a0 0x8 0 0 0
sensors 0x3afac708 0x7e796 0 0 0
=================================================
recovery: upgrade_package_integrity_check success...
parsing current system ptable......
============ partition table =============
partition first_lba last_lba size
xloader 0x100 0x2ff 0M
round 0x300 0x1fff 3M
nvme 0x2000 0x3fff 4M
misc 0x4000 0x5fff 4M
splash 0x6000 0x9fff 8M
oeminfo 0xa000 0x19fff 32M
logo 0x1a000 0x1ffff 12M
vrcb 0x20000 0x21fff 4M
recovery2 0x22000 0x28fff 14M
recovery 0x2a000 0x31fff 16M
boot 0x32000 0x35fff 8M
modemimage 0x36000 0x55fff 64M
modemnv 0x56000 0x59fff 8M
modemnv2 0x5a000 0x5dfff 8M
cache 0x5e000 0xddfff 256M
system 0xde000 0x1ddfff 512M
cust 0x1de000 0x2ddfff 512M
userdata 0x2de000 0x2e5fff 16M
reserve1 0x2e6000 0x2edfff 16M
reserve2 0x2ee000 0x2f5fff 16M
reserve3 0x2f6000 0x2fdfff 16M
data 0x2fe000 0x1d59fff 13496M
=========================================
parse_ptable_from_file old_ptale success...
fixed_partition_changed_check success...
zhanting:cmdline = size=1G k3v2_lcd_density=1080p [email protected] console=ttyAMA0,115200 k3v2_pmem=1 vmalloc=512M androidboot.hardware=hws10201l
mmcparts=mmcblk01(xloader),p3(nvme),p4(misc),p5(splash),p6(oeminfo),p7(logo),p8(vrcb),p9(recovechecking img fastboot
sizeof(vrlhead) is 2048
sum = 2048
fastboot img has signed
checking img boot
sizeof(vrlhead) is 2048
sum = 2048
boot img has signed
checking img recovery
sizeof(vrlhead) is 2048
sum = 2048
recovery img has signed
[secure_boot_check]:success read fastboot's vrl header from boot0 emmc
boot's vrl addr is 0x05200000
recovery's vrl addr is 0x05208000
huawei_sd_update:integrity_validity_check success...
sd_upgrade_spare_space_check,cust.zip exist...
spare_space_check, the free space of /data is 13052854272
spare_space_check, free space is 13052854272,the size of total files in cust.zip is 0
spare_space_check, space is enough!
sensors_upgrade,sensors path /mnt/sdcard2/dload/sensors.zip
sensors_upgrade, open zip package fail......
partition table changed checking...
data block device path =/dev/block/mmcblk0p22
blk_sec: 30777344.
mmc partition num =22
sum_sec: 3133184
data_sec: 27639808
fs_sec:27639808
partition table changed
Click to expand...
Click to collapse
and
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /mnt/sdcard2 vfat /dev/block/platform/hi_mci.0/mmcblk1p1 (null) 0
2 /system ext4 /dev/block/mmcblk0p16 (null) 0
3 /cache ext4 /dev/block/mmcblk0p15 (null) 0
4 /tmpdata ext4 /dev/block/mmcblk0p18 (null) 0
5 /misc emmc /dev/block/mmcblk0p4 (null) 0
6 /boot emmc /dev/block/mmcblk0p11 (null) 0
7 /recovery emmc /dev/block/mmcblk0p10 (null) 0
8 /data ext4 /dev/block/mmcblk0p22 (null) 0
9 /cust ext4 /dev/block/mmcblk0p17 (null) 0
10 /vrcb emmc /dev/block/mmcblk0p8 (null) 0
I:Boot command: RESET:FACTORY
I:Got arguments from boot message
Command: "recovery" "--part_of_data_format"
ro.runmode=normal
Click to expand...
Click to collapse
I still have more research to format/layout and post. I need to also remove imei/serials from the postings but stay tuned.
DEVS, feel free to post your data.
Please avoid posting questions/recoveries/problems here, keep this thread to known facts needed for development.
Kernel-Device trees
Here is a list of other devices with same cpu, devices marked in red are LTE devices.
Code:
Hi3620 devices
[COLOR="red"]Huawei Ascend D2-6070 TD-LTE
Huawei MediaPad 10 Link LTE-A S10-201L 16GB
Huawei MediaPad 10 Link LTE-A S10-201L 32GB
Huawei MediaPad 10 FHD LTE S10-101L 64GB[/COLOR]
Huawei MediaPad 10 FHD S10-101u 64GB
Huawei MediaPad 10 FHD WiFi S10-101w
Huawei MediaPad 10 FHD S10-101u 16GB
Huawei MediaPad 7 Vogue
Huawei MediaPad 10 Link 3G S10-201u 16GB
Huawei MediaPad 10 Link WiFi S10-201w 16GB
NTT DoCoMo Huawei MediaPad 10 Link / dtab S10-201wd
Huawei STREAM X GL07S
Huawei Honor 3 HN3-U01
Huawei Honor 2 / Honor Quad (Huawei U9508)
Huawei Ascend D2-5000 TD
Huawei Ascend D2-0082 HSPA
Huawei Ascend G615
Huawei Ascend D2-2010 CDMA
Huawei Ascend D1 Quad / Ascend D quad (Huawei U9510)
Huawei Ascend D1 Quad XL (Huawei T9510E)
Huawei Ascend D1 Quad XL / Ascend D quad XL (Huawei U9510E)
[COLOR="red"]Huawei Ascend P2-6011 LTE- src-avalilable[/COLOR]
Huawei Ascend P2
Huawei Ascend Mate MT1-T00
Huawei A199
Huawei Ascend D2 HW-03E (Huawei U9701L)
Huawei Ascend Mate MT1-U06
Device(s) on list above with kernel sources links for comparision/possible ports
Huawei Ascend P2-6011 LTE
Huawei Ascend Mate MT1-U06
Huawei Ascend D2-0082 HSPA
Huawei Ascend G615
Additional info,
Going over Huawei kernel list it seems like the devices with MSM based chips for cpu have newer kernels 3.4 etc and it's own chips are still on 3.0.8
it would be nice if they updated that part. oh well.
A comparison of the two kernels for P2-6011 and Ascend D2-0082 shows no difference apart from make files for android, they both used the same defconfig/.config file, that gives hope for a quick kernel port but could also have changes deeper in the make/.mk files that are introduced with build directives so first I want to build the kernels and then start looking deeper into the sources.
I've found quite a few once I fixed my search parameters. Further work continues.
Full Kernel source found, please note that althought these sources compile , Ive yet too test due to the tablet having a locked bootloader,
Forked kernel sources -Not fully tested
Device specific info - LCD - Touch etc
Kernel Command Line
mem_size=1G k3v2_lcd_density=1080p [email protected] console=ttyS0 k3v2_pmem=1 vmalloc=512M androidboot.hardware=hws10201l mmcparts=mmcblk01(xloader),p3(nvme),p4(misc),p5(splash),p6(oeminfo),p7(logo),p8(vrcb),p9(recovery2),p10(recovery),p11(boot),p12(modemimage),p13(modemnv),p14(modemnvm2),p15(cache),p16(system),p17(cust),p18(userdata),p19(reserve1),p20(reserve2),p21(lowpower),p22(data);mmcblk11(sdcard2) boardid=0x36200110,0x00000025,0x00000082 hw_version=0x0000031f,0x00000623,0x00000000,0x00000001 pd_charge=0 androidboot.serialno=Z3PXXXXXXXXXXX androidboot.swtype=normal fastboot_version=S10-20XlV100R002C001B008SP03_FASTBOOT hpm_value=67 normal_reset_type=ColdReset, cpu_maxfreq=0
Click to expand...
Click to collapse
/proc/bus/devices
Code:
[email protected]:/proc # cat bus/input/devices
I: Bus=0019 Vendor=0000 Product=0000 Version=0000
N: Name="k3v2_power_key"
P: Phys=
S: Sysfs=/devices/platform/k3v2_power_key/input/input0
U: Uniq=
H: Handlers=event0
B: PROP=0
B: EV=3
B: KEY=100000 0 0 0
I: Bus=0019 Vendor=0000 Product=0000 Version=0000
N: Name="k3v2_gpio_key"
P: Phys=
S: Sysfs=/devices/platform/s10_gpio_key/input/input1
U: Uniq=
H: Handlers=event1
B: PROP=0
B: EV=3
B: KEY=c0000 0 0 0
I: Bus=0000 Vendor=0000 Product=0000 Version=0000
N: Name="sensor00fn11"
P: Phys=sensor00fn11/input0
S: Sysfs=/devices/sensor00/input/input2
U: Uniq=
H: Handlers=event2
B: PROP=2
B: EV=b
B: KEY=0
B: ABS=6730000 0
I: Bus=0018 Vendor=0000 Product=0000 Version=0000
N: Name="acc_input"
P: Phys=
S: Sysfs=/devices/platform/dw-i2c.0/i2c-0/0-0018/input/input3
U: Uniq=
H: Handlers=event3
B: PROP=0
B: EV=9
B: ABS=100 107
I: Bus=0000 Vendor=0000 Product=0000 Version=0000
N: Name="yamaha_orientation"
P: Phys=
S: Sysfs=/devices/platform/yamaha_orientation.0/input/input4
U: Uniq=
H: Handlers=event4
B: PROP=0
B: EV=9
B: ABS=100 4c7
I: Bus=0000 Vendor=0000 Product=0000 Version=0000
N: Name="HI3620_HI6421_CARD Headset Jack"
P: Phys=ALSA
S: Sysfs=/devices/platform/soc-audio/sound/card0/input5
U: Uniq=
H: Handlers=event5
B: PROP=0
B: EV=23
B: KEY=4 0 0 0 0 0 0 0
B: SW=14
I: Bus=0000 Vendor=0000 Product=0000 Version=0000
N: Name="lightsensor"
P: Phys=
S: Sysfs=/devices/virtual/input/input6
U: Uniq=
H: Handlers=event6
B: PROP=0
B: EV=9
B: ABS=100 0
[email protected]:/proc #
Sensors:-
LIS303DLHC 3-axis Accelerometer (STMicroelectronics)
AK8963 3-axis Magnetic field sensor (Asahi Kasei Microdevices)
iNemo Orientation sensor (STMicroelectronics)
Light sensor (sensor is 1inch to left of camera) (Taos)
Touch screen synaptics product: TM2662-006 (rmi generic 4)
yamaha orientation (unknown detail yet)
**Pages will be updated as info is sorted**