Unable to activate wifi - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

Hi,
I seem to have lost the ability to activate wifi. Neither the "Comm Manager" nor the 'Wireless LAN" applications are able to turn wifi on. Also, the wifi details are not shown under the "Wireless" Today panel.
The device has been flashed quite a lot recently. I have tried reflashing the original phones roms, the v3 unlock radio rom, and the 2.05 & 2.11 HTC roms; none of these seem to have solved the problem.
Also, possibly the cause, I ran an 'erase 80000000 d80000' & 'erase 0x80100000 0x20000' (radio(?) & radio bootloader(?) from wiki.
Would reflashing the data that was deleted by the above two erases help? (in case a normal re-flash doesn't touch these areas).
I have searched through the forums and the wiki but I'm unable to find a similar problem, so if anyone has any ideas that would be appreciated.
thanks
rob-ix
WHOOPS just saw http://forum.xda-developers.com/showthread.php?t=295211 so this post my not have been required. But, I gotta read it first, so put this on hold for a few mins

Booting using Platform Builder gives the following possible answer for the problem:
20161 PID:239ceb52 TID:23862ede CertVerify: TIACXWLN.dll trust = 2
20179 PID:2375059e TID:23862ede no EEPROM no WLAN!!
I've tried, changing via HTweakC, to allow non-trusted apps to be used but this hasn't changed things.
If anyone can answer these questions or point me in the right direction to answer/fix them it would be appreciated:
1, Is the 'no EEPROM no WLAN' error being caused by 'trust = 2' on the above dll or is in fact caused by having no wlan EEPROM?
2, Is this EEPROM a real one or one simulated via the flash/NAND?
3, Can this data be re-written/flashed?
thanks
Rob-ix

rob-ix said:
1, Is the 'no EEPROM no WLAN' are being caused by 'trust = 2' on the above dll or is in fact caused by having no wlan eeprom?
Click to expand...
Click to collapse
By having EEPROM erased or corrupted.
2, Is this EEPROM a real one or one simulated via the flash/NAND?
Click to expand...
Click to collapse
I think it is inside the MSM6275 chip.
3, Can this data be re-written/flashed?
Click to expand...
Click to collapse
No that i know of.

pof said:
By having EEPROM erased or corrupted.
Click to expand...
Click to collapse
I ran these commands via the BL at one point to try to clear the radio, could these have been responsibile?
erase 80000000 d80000
erase 80100000 20000
thanks
rob-ix

not sure, let me check if i can get a dump of that...
did you actually use 'erase' from bootloader, or 'rerase' from radio bootloader?
where you successfully authenticated to the bootloader/radio bootloader when you did that?

Pof,
pof said:
not sure, let me check if i can get a dump of that...
Click to expand...
Click to collapse
Great. Then I should be able to compare the two dumps.
did you actually use 'erase' from bootloader, or 'rerase' from radio bootloader? where you successfully authenticated to the bootloader/radio bootloader when you did that?
Click to expand...
Click to collapse
I used 'erase' from the bootloader, and I believe I was authenticated at the time.
thanks
Rob

rob-ix said:
Then I should be able to compare the two dumps.
Click to expand...
Click to collapse
bootloader command 'rbmc' dumps nothing on that addreses

go into bootloader, type these commands:
Code:
task 32
task 37 ff
tell me the output of the second

task 37 ff - output
pof said:
go into bootloader, type these commands:
Code:
task 32
task 37 ff
tell me the output of the second
Click to expand...
Click to collapse
Please see attached.
thanks
Rob

Seems that you have erased the EEPROM:
Code:
03/24/2007 23:53:25 [K :: KERNEL] HTC Nand Read!
03/24/2007 23:53:25 [K :: KERNEL] Kernel: EEPROM signature=FF FF FF FF FF
03/24/2007 23:53:25 [K :: KERNEL] HTC Nand Read!
03/24/2007 23:53:25 [K :: KERNEL] Kernel: EEPROM signature Old=FF FF FF FF FF
[...]
CertVerify: TIACXWLN.dll trust = 2
no EEPROM no WLAN!!
On a normal hermes this looks like this:
Code:
05/01/2006 00:00:00 [K :: KERNEL] HTC Nand Read!
05/01/2006 00:00:00 [K :: KERNEL] Kernel: EEPROM signature=50 12 EE 0 2
05/01/2006 00:00:00 [K :: KERNEL] Kernel: EEPROM1 Checksum=0xbd4ccc54
05/01/2006 00:00:00 [K :: KERNEL] HTC Nand Read!
05/01/2006 00:00:00 [K :: KERNEL] Kernel: EEPROM signature Old=50 12 EE 0 2
05/01/2006 00:00:00 [K :: KERNEL] Kernel: EEPROM2 Checksum=0xbd4ccc54
If I find anything for you to try I'll let you know.

Pof,
pof said:
Seems that you have erased the EEPROM:
Click to expand...
Click to collapse
That makes sense. Do you know if it's a real EEPROM or just some flash pretending to be EEPROM? Would GNU Haret be able to dump/reload the information?
thanks
Rob

would HTC have to replace the entire mainboard for this to be fixed, or do they have a tool that could reflash the EEPROM with a new mac adress and such

In theory, should be possible to reflash via bootloader EMAPI commands, but we don't know how to use them, sure HTC knows... but in service centre they most probably will replace the mainboard for that.

pof said:
In theory, should be possible to reflash via bootloader EMAPI commands, but we don't know how to use them, sure HTC knows... but in service centre they most probably will replace the mainboard for that.
Click to expand...
Click to collapse
... thats not good, how much do you think that would cost? over $300?

is there anyway to emulate the EEPROM or put the MAC address in the registry?

task 37 ff output
Output of task 37 ff scrolls way too much overflowing the screen buffer. I don't see a log option in the mtty I downloaded from wiki pages. What's the method to capture large output like that?
TIA

@cjchriscj: no
@aarman: type "task 37 ff" and pull out the USB cable before the buffer grows too big.

Is it possible that people having this problem have flashed _too big_ a OS.nb file using MFG bootloader before having the problem?
I have the feeling that WLAN EEPROM is read from NAND flash, if we manage to find the right offset we can probably rbmc to read it and reflash it with lnb.

I have the same problem
05/23/2006 23:57:46 [K :: KERNEL] HTC Nand Read!
05/23/2006 23:57:46 [K :: KERNEL] Kernel: EEPROM signature=FF FF FF FF FF
05/23/2006 23:57:46 [K :: KERNEL] HTC Nand Read!
05/23/2006 23:57:46 [K :: KERNEL] Kernel: EEPROM signature Old=FF FF FF FF FF
05/23/2006 23:57:46 [K :: KERNEL]
If i understand that pof say for resolve my probleme i need the lnb wifi ?
The offset is not 0xb6d00000 0x20000000 ?

working on it
ok, good news for those who have ****ed up wlan EEPROM...
I was able to rbmc the right place where the WLAN eeprom is stored, as a proof of concept:
This is my MAC address: 00:09:2d:f1:f2:d3
This is the EEPROM signature reported by "task 32 ff": 50 12 EE 0 2
Code:
[B][COLOR="DarkGreen"]50 12 EE 00 02[/COLOR][/B] 00 00 00 06 00 00 00 A1 01 00 00 P.î.........¡...
43 50 AA 80 00 00 00 00 00 00 00 00 00 00 00 00 CPª?............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 11 56 05 1B 06 00 11 31 01 00 01 09 56 12 00 ..V.....1....V..
00 00 01 0D 56 71 00 00 00 02 6D 54 [B][COLOR="DarkRed"]D3 F2 F1 2D[/COLOR][/B] ....Vq..........
[B][COLOR="DarkRed"]09 00[/COLOR][/B] 00 00 01 05 5A 64 00 00 00 01 09 5A 00 00 ......Zd.....Z..
00 00 01 0D 5A 00 00 00 00 01 01 0C 03 00 00 00 ....Z...........
01 01 5A 00 00 00 00 01 55 09 01 00 00 00 01 E5 ..Z.....U......å
58 02 00 00 00 01 F1 58 08 00 00 00 01 D5 58 10 X.....ñX.....ÕX.
00 00 00 01 B1 58 04 00 00 00 00 00 00 00 00 00 ....±X..........
00 0C 00 8B 00 C6 00 D0 00 DC 00 EE 00 0C 01 15 ...?.Æ.Ð.Ü.î....
01 17 01 2D 01 67 01 77 01 7F 01 01 39 00 00 11 ...-.g.w...9...
00 04 01 01 01 00 05 01 06 00 02 01 02 01 02 1E ................
00 0A 00 02 05 02 04 11 22 44 03 06 41 20 30 31 ........"D..A 01
32 40 04 09 54 49 20 41 43 58 31 30 30 05 07 54 [email protected] ACX100..T
49 20 54 65 73 74 01 08 00 00 00 00 00 00 00 00 I Test..........
05 02 00 00 3B 00 81 00 C5 00 1F 01 04 04 44 10 ....;..Å.....D.
00 00 45 10 00 00 18 5A 40 00 14 5A 20 00 02 0E [email protected] ...
A0 01 F7 00 08 01 7E 02 78 00 B2 01 8A 09 80 00 .÷...~.x.².?.?.
F7 00 08 01 79 02 78 00 A4 01 8A 09 01 07 00 01 ÷...y.x.¤.?.....
40 00 00 00 01 00 00 05 04 00 01 01 00 00 00 00 @...............
FF FF FF FF FD FD FD FD FB FB FB FB FB 0E 04 09 ÿÿÿÿýýýýûûûûû...
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 ................
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 ................
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 ................
09 09 09 09 09 09 09 0E 01 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 03 02 D4 08 D4 08 07 00 01 .........Ô.Ô....
This is on NAND, around offset 0x500CD800 (after SPL and before MainSplash).
Probably this can be overwriten with 'lnb' command on MFG bootloader, i'm investigating this with Olipro right now.
If anyone wants to serve as a guinea pig, let us know

Related

[Q] MTK6582 repartition help

Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
Hello. I have a THL W100S. The processor is also MTK6582. I made a stupidity, trying to make repartition with meteos-mtk6589 and now my phone is dead
I did not even install CWM
Now I do not know if I can revive it. I tried with SP Flash Tool, but no reaction... Is there any solution to solve this problem?
1. Do a full backup of the current firmware in recovery
2. Install the application, run (on request Root rights answer - YES \ grant)
3. Choose the size of data partition (2.5GB or 2.77GB)
4. Select in the program restarts in recovery
5. Do wipe data
6. Restoring the backup firmware
7. Boot the system
I set 2.77GB, can this be a problem, maybe it was better to choose 2.5GB? After point 5 phone has rebooted and then show only one. This - gifti.me/i/6ylSuEc.gif
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
I have the same problem. My phone is a W450 mtk6582.
Many thanks
My phone is an Star W450 to...
@hat3ck
my first try was the meteos-mtk6589 but i have a cwm installed.. ... and the phone didn't boot at least
I fix it by flash all options without preloader
and it's like it was
try to flash again.
greetz TO
theoverfiend said:
My phone is an Star W450 to...
@hat3ck
my first try was the meteos-mtk6589 but i have a cwm installed.. ... and the phone didn't boot at least
I fix it by flash all options without preloader
and it's like it was
try to flash again.
greetz TO
Click to expand...
Click to collapse
Thanks for reply! I tried flashing, but nothing, maybe I don't have the need drivers? Can you make a screenshot of window manage without conected phone? Or how I can verify if my laptop sees the phone...
@hat3ck
try this Tutorial 4 Driver install
(under the red ATTENTION text)
http://forum.xda-developers.com/showthread.php?t=2160490
p.s. whats your home country / language?
Greetz TO
theoverfiend said:
@hat3ck
try this Tutorial 4 Driver install
(under the red ATTENTION text)
http://forum.xda-developers.com/showthread.php?t=2160490
p.s. whats your home country / language?
Greetz TO
Click to expand...
Click to collapse
Thanks, I will try now. Language Romanian, but I can understand and Russian.
okay i dont understand Romanian and Russian. it's like for me. :laugh:
if you run Windows 8 it's a little bit tricky to install the drivers.
Instructions for Win8:
1) Windows Key + X -> Start command prompt (administrator).
2) C: \ Windows \ System32 \ shutdown.exe / r / o
3) Select Troubleshooting
4) Advanced Options
5) Start Settings
6) Restart
7)Disable Driver Signature Enforcement.
Greetz TO
theoverfiend said:
Hello @ all xda-developers user & team
I have an MTK6582 based phone with internal store size of 0,98GB and phone store of 1,78GB
internal it should be 2.5 GB
is there a way to change the stor size like on the MTK6589??
i search for an easy way like the meteos-mtk6589-rom-edit app / tool
but nothing...
now i read about changing the ebr1 hex, but the example what i found is for mtk6589 and my ebr1 looks a little bit different...
thats how is looks like
000001C0 00 00 83 00 00 00 00 E8 01 00 00 E0 15 00 00 00
000001D0 00 00 83 00 00 00 00 C8 17 00 00 F0 03 00 00 00
000001E0 00 00 83 00 00 00 00 B8 1B 00 00 00 20 00 00 00
000001F0 00 00 05 00 00 00 00 94 01 00 FF FF FF FF 55 AA
if some one could help me I would be very happy
greetings TO
Click to expand...
Click to collapse
Hi, you must modify EBR1 and EBR2 like this:
1. EBR1 from:
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 20 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
to
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 50 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
2. EBR2 from:
00 00 83 00 00 00 00 24 3A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
to
00 00 83 00 00 00 00 24 6A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
Flash the files with SPFlashTool. Please make a backup before!! If something go wrong just reflash old EBR1 and EBR2.
Thanks!
mircam said:
Hi, you must modify EBR1 and EBR2 like this:
1. EBR1 from:
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 20 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
to
00 00 83 00 00 00 00 E9 01 00 00 E0 15 00 00 00 00 00 83 00 00 00 00 C9 17 00 00 F0 03 00 00 00 00 00 83 00 00 00 00 B9 1B 00 00 00 50 00 00 00 00 00 05 00 00 00 00 95 01 00 FF FF FF FF 55 AA
2. EBR2 from:
00 00 83 00 00 00 00 24 3A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
to
00 00 83 00 00 00 00 24 6A 00 FF 46 C4 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
Flash the files with SPFlashTool. Please make a backup before!! If something go wrong just reflash old EBR1 and EBR2.
Thanks!
Click to expand...
Click to collapse
so, is it successfull? can you report it and make a n00b tutorial here? thx a lot!
I have a Thl W100S but I can't root it a 100% ! Framaroot says success but after reboot no root access, other software don't root a 100% any suggestions guys? Its the 2nd day I have it latter I will try again, thanks in advance
Sent from my W100 using XDA Premium 4 mobile app
matrix0807 said:
so, is it successfull? can you report it and make a n00b tutorial here? thx a lot!
Click to expand...
Click to collapse
Hi
My ebr1 and ebr2 matches this. I will definintly try this and let you know the result.
My phone is Symphony W128.
Can u root symphony w128
Sent from my Symphony W128 using xda premium
can you post edited files?
Was repartitioning for MTK6582 successful?
Sent from my NOA H42 using Tapatalk
Sargos76 said:
I have a Thl W100S but I can't root it a 100% ! Framaroot says success but after reboot no root access, other software don't root a 100% any suggestions guys? Its the 2nd day I have it latter I will try again, thanks in advance
Sent from my W100 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Hi
try kingroot this version rooted my mtk6582

[Q] help~~ who know this ext4 format

the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
showjechar said:
the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
Click to expand...
Click to collapse
hello ~
showjechar said:
the file head is :
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 20 00 10 00 00 10 00 00 :&?
00000010 00 00 03 00 BF 07 00 00 00 00 00 00 00 00 00 00 ?
00000020 C1 CA 00 00 00 00 00 00 01 00 00 00 10 10 00 00 潦
The right should be:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 3A FF 26 ED 01 00 00 00 1C 00 0C 00 00 10 00 00 :&?
00000010 00 00 03 00 C0 07 00 00 00 00 00 00 C1 CA 00 00 ? 潦
00000020 01 00 00 00 0C 10 00 00 00 00 00 00 00 00 00 00
simg2img can't work;
Click to expand...
Click to collapse
sudo java -jar ./sgs2toext4.jar system.img system_ext4.img

Help me get Heart Rate data [OpenFit: Open source Gear Fit application]

Hello everyone, I am the developer of OpenFit a alternative to the Gear Fit Manager as it doesnt run officially on non-samsung roms. I have implemented various features (see the original post for feature list) and I am at the point where I want to attempt getting heart rate data. I am on CM and cannot use S Health. I was wondering for those who have used S Health with touchwiz, does the app show you heart rate? and pedometer etc? If it does I think I may be able to reverse engineer it, I just need the raw BT data. for this I would need someone who is able to run S Health and log BT data. In CM its under Settings>Developer Options>Enable Bluetooth HCI snoop log . This will capture all the BT traffic between the phone and gear fit.
If anyone is able to do this, please comment below. I would like to reverse engineer this and have it able to sync with google fit, and other fitness apps.
Requirements?:
Stock Samsung Rom with S Health
Root?
Please check out my app and my progress of OpenFit. Download available: http://forum.xda-developers.com/gear-fit/themes-apps/openfit-source-gear-fit-application-t3005697
I am also thinking of releasing it on the Google play store. thoughts?
I have access to a galaxy s5 mini with stock rom,shealth, gearfit and adb. Might worth a try?
see PM for my log file from a samsung s5 mini
Perhaps this is something usefull? syncing GF steps with S-Health. It will synchronise to 185 steps, 0.13km, 6kcal (i am not lazy, its a development GF)
Phone:
0000 0b ff 15 01 02 05 00 00 00 00 0f 00 00 00 86
GF:
0000 09 ff c3 01 02 5c 00 00 00 04 00 00 00 10 00 00
0010 00 ff 04 01 00 00 00 f0 39 cb 55 1a 00 00 00 5b
0020 8f 8a 41 c2 f5 68 3f 00 01 00 00 00 45 b5 c8 55
0030 23 00 00 00 00 00 2a 43 00 00 82 42 35 e6 02 00
0040 cd 7f cf 12 f1 49 02 00 d1 fb 01 00 11 98 02 00
0050 22 bf 02 00 01 01 00 00 00 cf 3b cb 55 10 27 00
0060 00 00 00 00 00 5c
Phone:
0000 0b ff 62 01 01 02 ac 00 00 00 02 10 00 00 00 ff
0010 08 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00
0020 00 ed a2 e1 21 4f 01 00 00 ff ff ff ff 00 00 00
0030 00 00 00 00 00 ff ff ff ff ff ff ff ff ff 00 00
0040 00 00 00 00 00 00 0a 00 00 00 02 00 00 00 c0 b7
0050 c8 55 00 00 00 00 0a 00 00 00 00 00 00 00 00 00
0060 3b 40 00 00 00 00 48 3c cb 55 00 00 00 00 aa 00
0070 00 00 00 00 00 00 00 40 5f 40 00 00 00 00 01 00
0080 00 00 46 b5 c8 55 10 27 00 00 00 00 00 00 45 b5
0090 c8 55 23 00 00 00 00 00 2a 43 00 00 82 42 35 e6
00a0 02 00 f1 49 02 00 d1 fb 01 00 11 98 02 00 22 bf
00b0 02 00 cd 7f cf 12 86
GF:
0000 02 0c 20 16 00 12 00 44 00 09 ff 1b 01 02 08 00
0010 00 00 03 00 00 00 10 00 00 00 5c
Thank you @thijsnl I will look at this data once I get home and have access to wireshark. Im hoping It contains good data
After looking trough the log, i found a message with the text, "HELLOCUP". Im wondering if this is some way to "authenticate" with the gear fit saying it is indeed a samsung phone. Im also seeing a pattern, or a Heart beart the app is sending to the gear fit, each with its number incrementing, shown below:
02050000000001000000
// seems to send the same command here lets call it getData command
02050000000002000000
// getData
02050000000003000000
// getData
etc...
Im wondering if this a way the App tells gear fit to perform an operation. @thijsnl was the data you sent me for heart rate or pedometer? or some other function? thanks!
Sorry, the HELLOCUP was actually a little app i wrote with the cups library. It shows up in 'App Connect'. The 4 packets i posted are for pedometer sync i believe.. I did like start bluetooth hci snoop, switch back to shealth, hit the sync button... Synced, en then adb pulled the hci log.
Sent from my D5803 using XDA Free mobile app
I don't think I ever used the S Health feature, so I do not know what to expect on your behalf. One thing I would test, Is turning on exercise mode, like walking or running which dont seem to need the phone, but, and I know cycling/ hiking wants gps. All this data would be helpful to see what is going on.
Is there a way to get Heart rate and pedometer displayed on the phone? If so, could you re-run these few more tests and capture the log as well?
Based on the log provided above, I was able to send the gear fit to what i think is a fitness sync, and got overwhelming amounts of data. Its a big mess and its going to be near impossible to parse 13384 bytes of information. Not looking forward to this. maybe i got some other information.
Haha, 13K to notice a heart rate value (Uint8? as >256 bpm would be insane) is finding a needle in a haystack.
I checked the hexfile from the firmware update, and wingtip_in.bin showed up some test functions. Another post on xdadev showed an
UART mode, which may can get handy to see dataflow, commands, etc when enabled.
I will keep you updated
i just got some minor results.
Somehow i set my Gf in kind of debug mode HIGH with uart to PDA mode?
However i managed to install the Samsung Serial port driver for the CDC device connecting.
It allows me to enter AT commands
Not support
AT
OK
At+help
The AT Cmd is Error!
AT+VERSNAME
+CME Error:NA
OK
AT+VERSNAME?
+CME Error:NA
OK
AT+VERSNAME=?
+CME Error:NA
OK
AT+VERSNAME=1,1,0
+VERSNAME:1,MP 0.800
OK
I see some AT commands showing up in wingtip_ex.bin (from the firmware). so i might be able to enable a higer debug mode.
Mathijs
I'm also able to mount my GF as two partitions in windows and able to grab data, and log files from the GF
[ 45.414] [ _MUX_SEND_] ^ 49208 1677969760 Sending... 18 bytes
[ 45.417] [ BTU] ^ 49212 1685040424 Sended completed : 18 bytes.
[ 45.420] [ BTU] ^ 49214 1685040424 pop OK. current size : 0 bytes
[ 45.421] [ UI_Task] ^ 49217 268466020 [APP][StatusManager] SendData: 11
[ 45.423] [ UI_Task] ^ 49218 268466020 [APP][StatusDataExchanger] SendData, datatype = 11
[ 45.424] [ UI_Task] [CM]1[12:37:57]>>>> GetConnectionState state(11) (3)
[ 45.424] [ UI_Task] ^ 49220 268466020 channel 4 sending 3 bytes.
[ 45.426] [ _MUX_SEND_] ^ 49221 1677969760 Sending... 8 bytes
[ 45.429] [ BTU] ^ 49224 1685040424 Sended completed : 8 bytes.
[ 45.432] [ BTU] ^ 49227 1685040424 pop OK. current size : 0 bytes
[ 45.434] [ UI_Task] ^ 49230 268466020 [APP][StatusManager] SendData: 4
[ 45.436] [ UI_Task] ^ 49231 268466020 [APP][StatusDataExchanger] SendData, datatype = 4
Perhaps this is usefull when debugging?
wow, I didn't know you had access to such low level info. Though it may be helpful to see what data is sends out when a sync request is being made. I am also thinking the reason I have 13k bytes was because I have history for yesterday exercise which was 1.5hr of using the running feature, and if it saves the heart rate, gps, for each minute or so I can see how this data adds up. But I'm still uncertain what that data is. Maybe its not even related to fitness, but I'm almost certain it is based on the first byte of the message which is '02'(HEX) and all the other commands related to fitness also start with '02'(HEX), which is why I assume its fitness data. What I will try to do is clear my history and have a very small sample set. no more than 1 minute of exercise, and see what data that returns. I'm hoping to see much less data, If i don't then these suspicions go out the door.
@thijsnl
in the data set you sent me, was the only data sync'd
185 steps, 0.13km, 6kcal
or was there more data? This will help me try to decipher the raw packets.
This is what snhealth showed up. I got a brilliant idea yesterday while running.. I can access the fit data files inside the gear fit. I think they must be quite the same when syncing, so if i can pass you these files and the bt hci log while syncing, there may be better chancesnto get the right data out.. Weel keep you updated
Sent from my D5803 using XDA Free mobile app
Here is some more data attached from my GF
A log file, and some other health related files i guess.
Good luck
Clear is that the GF uses embOS from SEGGER (RTOS) and that the embUSB support is built in (for mass storage device and terminal)
EDIT: hehe.. too much private information in the files .
Awesome. I'll take a look tomorrow. Can't wait
Sent from my SCH-I545 using XDA Free mobile app
jareddlc said:
Awesome. I'll take a look tomorrow. Can't wait
Sent from my SCH-I545 using XDA Free mobile app
Click to expand...
Click to collapse
I did some quick lookup on pedo_info.dat. There seem to be a kind of pattern, at offset 38d, every 20 bytes:
Code:
[[email protected]]$ ./stats 38
01 00 00 00 B8 C2 C5 55 07 00 00 00 F6 28 94 40 1F 85 6B 3E
02 00 00 00 C0 C9 C5 55 5F 00 00 00 1F 85 8D 42 3E 0A 57 40
03 00 00 00 18 CC C5 55 07 00 00 00 66 66 AE 40 00 00 80 3E
04 00 00 00 70 CE C5 55 5A 00 00 00 47 61 84 42 3D 0A 47 40
05 00 00 00 C8 D0 C5 55 08 00 00 00 8F C2 ED 40 9A 99 99 3E
06 00 00 00 80 DC C5 55 51 00 00 00 B8 1E 73 42 66 66 36 40
07 00 00 00 D8 DE C5 55 09 00 00 00 8F C2 B5 40 0A D7 A3 3E
08 00 00 00 38 E8 C5 55 4C 00 00 00 CD CC 76 42 1F 85 3B 40
09 00 00 00 90 EA C5 55 40 00 00 00 14 AE 4C 42 0A D7 13 40
0A 00 00 00 E8 EC C5 55 5A 02 00 00 12 2E E5 43 87 5C CF 41
0B 00 00 00 40 EF C5 55 86 02 00 00 AE 6E 00 44 D0 EB D9 41
0C 00 00 00 98 F1 C5 55 90 03 00 00 1C 15 33 44 CB 8F 18 42
0D 00 00 00 F0 F3 C5 55 6A 02 00 00 89 6B EB 43 65 D7 C7 41
0E 00 00 00 48 F6 C5 55 4D 00 00 00 D6 A3 5C 42 40 E1 4A 40
0F 00 00 00 A0 F8 C5 55 1F 01 00 00 B0 87 50 43 37 0A 3B 41
10 00 00 00 F8 FA C5 55 15 02 00 00 38 93 C6 43 06 29 B0 41
11 00 00 00 58 04 C6 55 24 00 00 00 F6 28 C6 41 5C 8F C2 3F
12 00 00 00 B0 06 C6 55 23 03 00 00 01 B0 02 44 00 00 03 42
13 00 00 00 08 09 C6 55 65 01 00 00 5B 4F 6A 43 98 99 69 41
14 00 00 00 60 0B C6 55 78 00 00 00 14 2E A3 42 29 5C 9F 40
the counter in the first byte and the C5 55 pattern in the middle...
Regards,
Mathijs
Ok, i decided to figure out how the StopWatchDB file works.
Not that this information is very useful, but it is more predictable than others.
So i start my stopwatch, and pressed the white button at 1s, then wait 2s, then wait 3 sec, wait 4sec, wait 5 sec, wait 6 and press stop.
I made a picture of it, it is in Dutch, but you get the point.
I analysed the code and see some repeating patterns, and even a number indicator:
Code:
52 33 35 30 58 58 55 30 42 4F 41 32 00 00 00 01
00 00 00 33 05 00 00 01 00 00 00 31 0D 00 00 01
00 00 00 CB 18 00 00 01 00 00 00 D9 27 00 00 01
00 00 00 1C 3C 00 00 01 00 00 00 E2 18 00 00 01
00 00 00 82 1A 00 00 01 00 00 00 7C 1B 00 00 01
00 00 00 DB 1C 00 00 01 00 00 00 39 1E 00 00 01
00 00 00 DA 1F 00 00 01 00 00 00 BD 21 00 00 01
00 00 00 0B 23 00 00 01 00 00 00 E4 23 00 00 01
00 00 00 9B 24 00 00 01 00 00 00 6E 26 00 00 01
00 00 00 79 27 00 00 01 00 00 00 62 28 00 00 01
00 00 00 7E 29 00 00 01 00 00 00 89 2A 00 00 01
00 00 00 2A 2C 00 00 01 00 00 00 44 2D 00 00 01
00 00 00 2F 2E 00 00 01 00 00 00 3E 2F 00 00 01
00 00 00 45 30 00 00 01 00 00 00 5F 31 00 00 01
00 00 00 2E 34 00 00 01 00 00 00 00 36 00 00 01
00 00 00 D1 37 00 00 01 00 00 00 95 39 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00 00 00 A2 52 00 00 01 00 00 00 05 00 00 00
Then i made a simple c program to decompile it:
[[email protected] gf]$ ./stop
DB Length: 831
Firmware: R350XXU0BOA2
Number of records: 5
Record 0: 00 00 01 00 00 00 33 05 Estimated time is 1331
Record 1: 00 00 01 00 00 00 31 0D Estimated time is 3377
Record 2: 00 00 01 00 00 00 CB 18 Estimated time is 6347
Record 3: 00 00 01 00 00 00 D9 27 Estimated time is 10201
Record 4: 00 00 01 00 00 00 1C 3C Estimated time is 15388
End time: 21154
Voila! 21.154 seconds.
The quick n dirty code is:
Code:
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
int main(int argc,char * argv[])
{
int fd;
unsigned char data[16*1024];
int x;
int i;
int a=13;
int len=0;
int numrec=0;
int time=0;
int endtime=0;
if (argc>1) { a=atoi(argv[1]); }
fd = open("stop5.dat",O_RDONLY);
len = read(fd,data,1024*128);
if (len == 0) { return 0; }
numrec = data[len-4] + 256*data[len-3] + 256*256*data[len-2] + 256*256*256*data[len-1];
printf("DB Length: %d\n",len);
printf("Firmware: %s\n",data);
printf("Number of records: %d\n",numrec);
for (i=0;i<numrec;i++)
{
printf("Record %d: ",i);
for(x=0;x<8;x++)
{
printf("%02X ",data[a++]);
}
time = data[a-2] + data[a-1]*256;
printf("Estimated time is %d",time);
printf("\n");
if (data[a+2] != 0x01) { break; }
}
endtime = data[len-12] + 256 * data[len-11] + 256*256*data[len-10] + 256*256*256*data[len-9];
printf("End time: %d\n",endtime);
return 0;
}
Lets see what other file's hide from us.
@jareddlc: I think more data is coming over when sync:
- sleep
- heartbeat
- pedometer
- stopwatch
- excercise
awesome work!
I also got some hopefully promising data. I ran the running mode yesterday for about 1 minute, but I don't get things like GPS etc so alot of info is blank, with exception of heart rate.
Here are my findings:
My watch reported back with: should be: Monday Aug 17 8:34 pm, running, 01:02 time, 0.00 km,0 cal, avg speed, 0.0kmh, max speed, 0.0kmh, avg pace - --km, max pace, - --, avg heart 88bpm, max 93 bpm so i found most time stamps, and now im looking for 88 (58 in HEX) and 93 (5D in HEX) seems i found the "summary" report.
Code:
5807D255 = Monday, August 17, 2015 9:10:00 AM
A8000000AE070F439A99D140
1013D255 = Monday, August 17, 2015 10:00:00 AM : 1439830800
CC0000000AD71743703DE240
D025D255 = Monday, August 17, 2015 11:20:00 AM : 1439835600
0901000046E14743F7281441
E033D255 = Monday, August 17, 2015 12:20:00 PM : 1439839200
//...
10A9D255 = Monday, August 17, 2015 8:40:00 PM : 1439869200
39000000CCCC3042D7A300400901000000D89FDF3E4F01000000000000000000000000000000000000040000000C01000000
D7A7D255 = Monday, August 17, 2015 8:34:47 PM : 1439868887
3E00000000000000 5800000000000000 0153460000000000 0000000000000000 00000000 00 5D00000000000000 000000000001000000 = 88bpm : 58 HEX 93bpm : 5D HEX
45B5C855 = Your time zone: Monday, August 10, 2015 7:29:25 AM : 1439216965
2300000000002A430000824235E60200CD7FCF12F1490200D1FB01001198020022BF02000101000000
A5AAD255 = Monday, August 17, 2015 8:46:45 PM : 1439869605
1027000000000000

LG G5 Bootloop

Hello guys,
Since yesterday my g5 is blocked:
a message that the system was corompu appeared, so I wanted to put my re G5 zero except that it is not recognized by LGUP while he is detect by LG MOBILE SUPPORT TOOL and LG Bridge which does not start a recovery.
Do you have an idea ?
PS: I am french and translation through google sorry for spelling.
There's a reason of this bootlop and corrupted system?
Install the right driver for LGUP, it seems impossible that it's not recognized.
Erario said:
There's a reason of this bootlop and corrupted system?
Install the right driver for LGUP, it seems impossible that it's not recognized.
Click to expand...
Click to collapse
The reason comes from the fact bootloop of modifying the build.prop; I have yet resataure the file via a backup that I had done beforehand.
Since the message of corompu system over any access TWRP it was replaced by the original one.
Normally all the drivers are installed jai installed:
LGH850_DLL.msi
LGUP_Lab_Frame_Ver_1_11.msi
LGMobileDriver_WHQL_Ver_4.0.4.exe
LOG LG UP
[12:19:32] Start Find Available USB Port
[12:19:32] Find 0 Port de communication (COM1)
[12:19:32] Find 1 LGE AndroidNet USB Serial Port (COM41)
[12:19:32] CBasicComControl:pen, the port(COM 41) is constructed successfully => HANDLE : 0x2bc
[12:19:32] CPort:penPort() Success. Port number is 41
[12:19:32] [T000003] 41 54 0D AT.
[12:19:33] CBasicCom::SendRecvPacket, PACKET_ERROR code = 1460 Msg => [12:19:33] [T000005] EF 00 16 65 7E ...e.
[12:19:34] [R000007] EF 00 00 05 00 AD 7E .......
[12:19:34] ---------------------------------------------------------------------------------
[12:19:34] SubProcess Name : NoOperationCmd
[12:19:34] [T000004] 06 4E 95 7E .N..
[12:19:35] [R000004] 02 6A D3 7E .j..
[12:19:35] [T000005] EF 00 16 65 7E ...e.
[12:19:36] [R000007] EF 00 00 05 00 AD 7E .......
[12:19:36] [T000005] EF A0 1C C0 7E .....
[12:19:37] [R000150] EF A0 00 00 00 00 00 4C 47 2D 48 38 35 30 00 00 00 55 6E 6B 6E 6F 77 6E 00 00 00 00 00 00 00 00 .......LG-H850...Unknown........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 35 37 36 35 37 30 37 31 31 36 36 38 34 33 00 ................357657071166843.
00 00 00 00 64 1E 41 6E 64 72 6F 69 64 00 00 00 55 6E 6B 6E 6F 77 6E 00 00 00 00 00 00 00 00 00 ....d.Android...Unknown.........
00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 63 6F 6D 6D ...........................1comm
6F 6E 00 00 77 4F 50 45 30 00 00 00 00 00 00 00 00 00 00 0F 40 7E [email protected]
[12:19:37] CComPort::ClosePort, Closed Port Successfully for COM 41
[12:19:37] CBasicComControl::Close, the port(COM41) is closed successfully
[12:19:37] ==> COM41 is detected
[12:19:37] ModelListManager is initialized
[12:19:52] CBasicComControl::IsConnected, the port(COM41) connection is not detected
Click to expand...
Click to collapse

simlock.ta bricked Network Xperia Z2 (D6502)

hey guys i need ur help.i just flashed new firmware android marshmallow 6.0.1 on my D6502 and there was a file called simlock.ta and it just bricked my phone.
1.my phone is working fine but no simcard is valid and my network is completely bricked,
from menu services
bootloader status:unknown
hwconfig:unknown
2.simlock.ta file inside the firmware that i flashed :silly::silly:
Code:
// [SIMLOCK S1]
02
000007DA 0141 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 02 00 05 0A 02 00 00 00 0A 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 4D 4F 50
5F 49 44 3D 22 38 35 38 37 22 3B 4F 50 5F 4E 41
4D 45 3D 22 43 75 73 74 6F 6D 69 7A 65 64 20 4D
41 41 22 3B 43 44 41 5F 4E 52 3D 22 31 32 39 31
2D 34 36 37 35 22 3B 52 4F 4F 54 49 4E 47 5F 41
4C 4C 4F 57 45 44 3D 22 31 22 3B 00 00 00 09 00
07 30 30 31 30 31 2D 2A 00 00 00 00 00 00 00 00
00 00 00 00 02 00 00 00 0A 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 0A 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 02 00 00 00 0A 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00
3.please avoid telling repeated answers i know all of them .i flashed any firmware from other region but not fixed.i flashed other simlock.ta file from other firmwares but i couldnt find the right simlock.ta and i wanna know what is the correct simlock.ta for my device cause this file inside android 6.0.1 completely reset my network and bootloader status.
4.i was in bootloader unlocked phone but now i cant unlock or relock it when i try to unlock or relock in flashtool or command prompt it says this command is not allowed
5.i can go to flash mode via volume- and power button but my fast boot (volume+ and power button) is not allowed.fastboot damaged and i cant flash any kernel via fastboot or use a recovery mode.
adb mode is not accessible cause no fast boot for my phone.i cant get adb shell from my phone so restoring ta backup is not allowed however i dont have any backup from ta partition.
6.the only solution left that i think it works and that was working for older devices is flashing a simlock.ta on sonyerricson arc,arc s,x10,neo, xperia play or older devices there was a unbrick simlock.ta called "TA brick fix" that we can fix this by flashing but on z2 its not working.please gimme any simlock.ta file that u think it is working for d6502 or tell me a working guide line to fix this issue.
7.i contact my support area but they told me i have to change my main board cause they cant fix it.i know guys there is only problem with simlock.ta only this file damaged my phone and i wanna make the own working simlock.ta back.
8.i am a developer and i know enough about coding and hex editing if u have a deep idea about how simlock.ta hex file works tell me to test it.i dont know what is the right algorithm for simlock.ta on Z2
9.please if u have D6502(L50w)/D6503 Z2 backup ur .ta partition and send it here ill check for solution (Im aware that flashing any other .ta partition from another device can lead me to hard brick,i only want to analyse .ta partitions to find a solution).
.ta partition backup guidehttp://forum.xda-developers.com/showthread.php?t=2292598 :highfive::highfive::fingers-crossed::good:
http://www.4shared.com/zip/aLCY46Xoce/TA-backup-20160423101131.html
Xperia Z2(D6502)
I have same problem with my Xperia U, i have flashed the simlock.ta, after that no network no simcard, bootloader unlock allowed : no
Can't boot to fastboot mode.
Do you find the way fix the problem mind to share with me？
riclim said:
I have same problem with my Xperia U, i have flashed the simlock.ta, after that no network no simcard, bootloader unlock allowed : no
Can't boot to fastboot mode.
Do you find the way fix the problem mind to share with me？
Click to expand...
Click to collapse
No,i contact the sony Co and they said the only way is changing the motherboard with a broken lcd or damaged phone.but still trying to find a way to hack into trim area like 2011 series mobiles
untraceablezing said:
No,i contact the sony Co and they said the only way is changing the motherboard with a broken lcd or damaged phone.but still trying to find a way to hack into trim area like 2011 series mobiles
Click to expand...
Click to collapse
I think this problem hard to hack and fix it, i found the answer is every phone have a unique simlock.ta code, if you didn't back up it, after flash the .ta file, the phone will half brick, don't know how to find back the phone .ta file code, every phone is different

Categories

Resources