stepw discovered a stack overflow vulnerability that affects ALL Trinity SPL versions up to now, I implemented an exploit for it, see details here.
The same bug is present in Hermes SPL versions >= 1.11, and all SPLs using HTC common base 1.51, so probably newer Breeze SPLs are vulnerable too.
Sadly for hermes users this bug can't be exploited the same way it's done on Trinity, this is the memory layout on Trinity:
Code:
0x80b00000 | xxxxxxxxxxx | \
.... | xxxxxxxxxxx | > wdata buffer
0x80b10000 | xxxxxxxxxxx | /
+-------------+
| . |
| . |
+-------------+
0x8c000000 | SPL-begins | \
.... | SPL SPL SPL | ME
.... | SPL SPL SPL | MO <--- how_far
.... | SPL SPL SPL | RY
.... | SPL SPL SPL | /
0x8c040000 | SPL-ends |
+-------------+
| . |
| . |
+-------------+
| . | \
0x8c08cb90 | . | s
.... | | t /\
.... | | a ||
.... | | c ||
.... | | k ||
0x8c08db90 | | /
| |
By doing recusrive 'ruustart' calls we can overflow the stack and set arbitrary bytes in 0x64 bytes buffer (size of command buffer in ruu mode).
We first try to detect how far the overflow should go, this varies on each SPL version. Then we put a known pattern on the stack and use the 'checksum' command to determine offsets of current stack top and size of stack frame of ruustart and normal command mode.
Then we load our unsigned code using wdata, of course we get an "invalid cert error" from bootloader, but the data we send is stored at 0x80b00000 (wdata buffer). We place here a modified IPL to skip loading SPL from NAND, and the custom SPL we want to load.
Then we calulate how many recursions we need to reach the spl end at 0x8c040000, the first recursions are padded with 0's as they are useless, only need them to overflow the stack, we put our shellcode here, the shellcode is a handler which executes the loader that resides in ram (0x80b00000) which copies patched IPL, SPL to RAM, disables ARM instruction caching and virtual addressing and branches to 0 offset to start IPL.
After placing the shellcode, we send the next ruustart calls with padding that contains branch instructions (relative jumps to the handler), we calculate how many calls we need based on target offset, initial stack offset and stack frame size.
Finally we need to jump to our patched code, to do this we call a function which has its entry point properly aligned with the overflown stack frame (we only control 0x64 bytes out of the frame size for ruustart which is tipically 0xe0), this also varies in each SPL version.
Now let's see the problem we're facing in hermes, this is the Hermes memory layout:
Code:
| . | \
| . | s /\
| | t ||
.... | | a ||
| | c ||
.... | | k
0x8c033b90 | | /
+-------------+
| . |
| . |
+-------------+
0x8c080000 | SPL-begins | \
.... | SPL SPL SPL | ME
.... | SPL SPL SPL | MO <--- how_far; we never reach here :(
.... | SPL SPL SPL | RY
.... | SPL SPL SPL | /
0x8c0c0000 | SPL-ends |
+-------------+
| . |
As you can see here, the stack grows up in the same direction as trinity, but the SPL code is placed below the stack so we can't overwrite it, thus we can't call a function that branches to our code.
So this is a call for developers & researchers, we need to find what else is between the stack and the ram top in hermes and see if there's something there that could be exploited, or if there's a pointer in ram that code branches to, we can exploit it by replacing the pointer.
You can use the Trinity exploit code with '-m hermes' hidden flag to test things on Hermes, feel free to modify / adapt the source for your tests on hermes.
Any ideas are welcome, have fun!
Damn pof your a real wacko and a genious, nice job man congrats!!
Re: spl overflow
Cool!
Congratz to stepw for this amazing research and exploit!
pof! GOOD work and nice code! Hope caffeine let you sleep some day!
Tonight we have to celebrate this with some beers!
heheh
thanks, keep up the good works, hope this software be develope as soon as posible so that our bricked phone be alive again.
I don't Understand
i'm using dopod 838 pro....where the memory layout mus edit?
Related
HOWTO: Setup a working environment to build CM7, with SVN
0. Overview
In this thread: http://forum.xda-developers.com/showthread.php?t=1565517, HPA has shown a custom ROM based on CM7, and his development files. I think there's a need to create a guideline of how to create such artifacts yourself by setting up your own development environment, download the source code and build ones for yourself. This post address that need. Hope this helps!
1. Install a version tracking system
1.1 Install SVN, please refer to "Setup a Subversion Server in 4 Minutes" (http://www.tonyspencer.com/2007/03/02/setup-a-subversion-server-in-4-minutes/)
1.1 Install RapidSVN by running "sudo apt-get install rapidsvn" (Ubuntu users may need to use sudo, or by installing it from Synaptic, for more details please refer to http://www.rapidsvn.org/index.php/OnlineHelp:Contents)
What's just happened: you installed Subversion (a software versioning and revision control system) and a GUI tool to track changes to the scripts you are going to create/update. Having a revision control system up and running is recommended since you're going to change many things from the original files, or create ones yourself. When your change is irrelevant, Subversion will save the day by allow you to revert back to a last-known-good version in the past - that's all we need, I think.
2. Get CM7 source code
Assume that we're going to use a folder named "gingerbread" in your home folder for this task:
Code:
$ cd ~/android/gingerbread
$ repo init -u git://github.com/CyanogenMod/android.git -b gingerbread
$ repo sync
3. Initialize the build script folder structure
Ensure that, the folder containing development files will have the same structure as the CM7 source tree, like this:
Code:
$ tree -d ~/android/cm7dev/gingerbread
gingerbread
|-- device
| `-- dell
| `-- venue
| |-- files
| |-- libaudio-qsd8k
| `-- overlay
| |-- frameworks
| | `-- base
| | |-- core
| | | `-- res
| | | `-- res
| | | `-- values
| | `-- packages
| | `-- SettingsProvider
| | `-- res
| | `-- values
| `-- packages
| `-- apps
| |-- CMParts
| | `-- res
| | `-- values
| |-- Mms
| | `-- res
| | `-- values
| |-- Phone
| | `-- res
| | `-- values
| |-- Settings
| | `-- res
| | `-- values
| `-- Torch
| `-- res
| `-- values
|-- frameworks
| `-- base
| |-- include
| | |-- camera
| | `-- media
| |-- libs
| | `-- camera
| |-- media
| | |-- java
| | | `-- android
| | | `-- media
| | |-- jni
| | `-- libstagefright
| | `-- omx
| |-- policy
| | `-- src
| | `-- com
| | `-- android
| | `-- internal
| | `-- policy
| | `-- impl
| |-- services
| | |-- camera
| | | `-- libcameraservice
| | `-- java
| | `-- com
| | `-- android
| | `-- server
| `-- telephony
| `-- java
| |-- android
| | `-- telephony
| `-- com
| `-- android
| `-- internal
| `-- telephony
| `-- gsm
|-- packages
| `-- providers
| `-- MediaProvider
| `-- src
| `-- com
| `-- android
| `-- providers
| `-- media
`-- vendor
`-- cyanogen
`-- products
Here, we have 4 sub-folders called "device", "frameworks", "packages" and "vendor". Later we will merge this folder with the CM7 source tree.
4. Import cm7dev files (the above tree folder structure) to SVN repo
Code:
$ svn import ~/android/cm7dev/gingerbread file:///data/svnrepos/gingerbread
5. Create a new empty working directory
This will be the place we checkout our code, and actually do the development task
Code:
$ cd ~/android
$ mkdir dv-dev
$ mkdir dv-dev/gingerbread
Now, checkout code from URL file:///data/svnrepos/gingerbread to the above working folder. You can use RapidSVN, or if you're familiar with SVN command line interface, issue this:
Code:
$ svn co file:///data/svnrepos/gingerbread ~/android/dv-dev/gingerbread
6. Merge CM7 code folder with our working directory
Now, copy everything from CM7 code folder (~/android/gingerbread) to the your working directory ~/android/dv-dev/gingerbread. Since they have the same name, with the same sub-folders, a confirmation will be shown to ask you whether you want to merge the content. Say Yes, and besure to select to apply to all items found.
This step ensures that, you can now build CM7 right from the working folder, and any changes to build script can be tracked by SVN (checked in). Now you're ready to go with the build progress. You may want to copy files from ~/android/cm7dev/gingerbread to the working folder again to overwrite all conflicts if there are any.
7. Copy proprietary files
Be sure your phone is connected to your PC, and USB access are well-configured so that ADB can do its task to pull the proprietary needed files.
Code:
$ cd ~/android/dv-dev/gingerbread/device/dell/venue
$ ./extract-files.sh
In this step, several changes need to be made for this file (extract-files.sh). You will have to adjust one for yourself since I noticed that HPA - the author - wrote some script to pull files that do not exists (he might have based on a Streak instead).
8. Install new versions of gApps and Rom Manager (of course, if you want)
Code:
$ cd ~/android/dv-dev/gingerbread/vendor/cyanogen/
$ ./get-rommanager
9. Build (the setup-makefiles.sh below will also has to be modified)
Code:
$ cd ~/android/dv-dev/gingerbread/device/dell/venue
$ ./setup-makefiles.sh
$ cd ~/android/dv-dev/gingerbread
$ cp ./vendor/cyanogen/products/cyanogen_venue.mk ./buildspec.mk
# choose device
$ . build/envsetup.sh
$ lunch cyanogen_venue-eng
# actual build
$ mka (or make -j`grep 'processor' /proc/cpuinfo | wc -l`, like what shown in Cyanogen official guidelines)
Now, let's just wait adjust the build scripts base on what you get (errors) during the build progress. For example, here's what I met:
Code:
target Strip: InputChannel_test (out/target/product/venue/obj/EXECUTABLES/InputChannel_test_intermediates/InputChannel_test)
(unknown): error 4: Added public method android.telephony.PhoneNumberUtils.formatKoreanNumber
(unknown): error 5: Added public field android.media.MediaRecorder.AudioEncoder.EVRC
(unknown): error 5: Added public field android.media.MediaRecorder.AudioEncoder.QCELP
(unknown): error 5: Added public field android.telephony.PhoneNumberUtils.FORMAT_KOREA
******************************
You have tried to change the API from what has been previously approved.
To make these errors go away, you have two choices:
1) You can add "@hide" javadoc comments to the methods, etc. listed in the
errors above.
2) You can update current.xml by executing the following command:
make update-api
^^^^^^^^^^^^^^^^^^
NO. NO. STOP BEING LAZY. SERIOUSLY.
DO NOT DO THIS in CM. THIS IS A LIE. IF YOU DO THIS I WILL HATE YOU.
USE OPTION #1.
-Koush
To submit the revised current.xml to the main Android repository,
you will need approval.
******************************
I typed "make update-api" like the author said above, and things were fine.
10. Remove symbolic links in /system/xbin, /system/bin
All symbolic links in the above folders need to be removed, since they will be created during the flashing progress, via instructions in updater-script
Code:
$ cd ~/android/dv-dev/gingerbread/out/target/product/venue/system/bin
$ find . -maxdepth 1 -type l -exec rm -f {} \;
$ cd ~/android/dv-dev/gingerbread/out/target/product/venue/system/xbin
$ find . -maxdepth 1 -type l -exec rm -f {} \;
11. Deploy
Now, copy the following things from ~/android/dv-dev/gingerbread/out/target/product/venue
- ./system
- boot.img
to another directory to create an update.zip file.
12. Other tools you might need/consider
Meld: a visual diff and merge tool
Geany: a text editor using the GTK2 toolkit with basic features of an integrated development environment
RabbitVCS: a graphical front-end for version control systems available on Linux that can be integrated into file managers such as Nautilus, Thunar. You'll find it familiar if you use TortoiseSVN on Windows before.
P.S. My development files: http://www.mediafire.com/?2ozrmxotdsib9nn
Here is my working result:
http://www.mediafire.com/?8a8ntad2t7tv4mb
and its screenshot:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Still, there is not many differences with the original update-cm-7.2.0-RC1-DV-KANG-HPA-BETA2-signed yet, but at least we know how to build it! Right?
Update: ROM with my custom kernel (4.06)
hey, chacona .!! Can u add my yahoo ID!
Trainhque_dideple_dayemphe_7593
i have something to ask you ! ?
chacona said:
Here is my working result:
http://www.mediafire.com/?zqqkne7qb4bqplf
and its screenshot:
Still, there is not many differences with the original update-cm-7.2.0-RC1-DV-KANG-HPA-BETA2-signed yet, but at least we know how to build it! Right?
Update: ROM with my custom kernel (4.06)
Click to expand...
Click to collapse
Is there anyway to get more free RAM?
How did you get so much RAM?
As I have only 184 MB of free RAM.
prasad12ka4: sorry, I don't know how to get more RAM so far. What I've done is just establishing a development environment, and successfully built a working copy of CM7 myself, proving that what I did is correct. Surely, I have a lot of things to do after that.
Guys.!!! Dell venue n dell streak 5got same rom n environment hardware too just diffrence is venue is Hdpi n dell streak is Mdpi .so why do nt we join hands n make ics work for dell or on other hand u can take advantage of our dell streak 5 formus there r few good roms like longhorn 2.8 with Hdpi support for dell Venue and Dcs 1.1.which supports both hdpi n mdpi just need to edit build.prop n may be kernel....whish u all safe cooking ...n Friends in need friend indeed ..
Max
Sent from my Dell Streak using xda premium
djmax81 said:
Guys.!!! Dell venue n dell streak 5got same rom n environment hardware too just diffrence is venue is Hdpi n dell streak is Mdpi .so why do nt we join hands n make ics work for dell or on other hand u can take advantage of our dell streak 5 formus there r few good roms like longhorn 2.8 with Hdpi support for dell Venue and Dcs 1.1.which supports both hdpi n mdpi just need to edit build.prop n may be kernel....whish u all safe cooking ...n Friends in need friend indeed ..
Max
Sent from my Dell Streak using xda premium
Click to expand...
Click to collapse
this is indeed exciting
Sent from my Dell Venue using xda premium
yah if some dev help us then surely we will get ics on dell venue
I am still working on CM7, with some kernel related tasks such as overclocking, checking the memory (I wonder why with 2.3.3 the total memory is only about 383, and on 2.2.2 is about 400+). Maybe it's a ROM problem, but I will try to find the root cause in the kernel first.
Because of the reason above, I still have no chance to look at the ICS ROM yet. However, there might be a lot of things to be learnt (as stated in CM forum). But, for stability, I think we should wait until ICS becomes RTM to begin our development work since changes are still can be many.
Ok guys. I've started this thread to continue the technical discussion that was being carried on at @carloswii5 's thread [Guide]Unlock bootloader for Noobs P769. With that said, let's carry on...
Stock Dump Files
[ xloader dumps ]
V20H TMobile USA
[ uboot dumps ]
V20H TMobile USA
[ misc dumps and info ]
V20H TMobile USA - Stock recovery partition dump
V20H TMobile USA - omapconf tool device info dump
V20H TMobile USA - nv partition dump. IMEI and WIFI MAC address removed and replaced with markers. View 'edited_nv_README.txt' for details.
[ Links ]
LG Open Source - Source Code Download for P769
Findings
[ nv.img dump - mmcblk0p7 ]
Orange is the offset where the data starts
Blue is the data found
Code:
@ [B][COLOR=DarkOrange]0x1000[/COLOR][/B] - [COLOR=Blue]15 digit hex number[/COLOR] - IMEI number
@ [COLOR=DarkOrange][B]0x1A00[/B][/COLOR] - [COLOR=Blue]LGP769AT-01-V20h-310-260-AUG-14-2013+00[/COLOR] - Software version
@ [COLOR=DarkOrange][B]0x1C00[/B][/COLOR] - [COLOR=Blue]Series of 31 0x01's and 0x02's[/COLOR] - Unknown ATM
@ [COLOR=DarkOrange][B]0x1E00[/B][/COLOR] - [COLOR=Blue]12 digit hex number[/COLOR] - WIFI MAC address
@ [COLOR=DarkOrange][B]0x3C00[/B][/COLOR] - [COLOR=Blue]L6260_MODEM_SIC_01.1305.00\n[/COLOR] - Baseband version
@ [COLOR=DarkOrange][B]0x6403[/B][/COLOR] - [COLOR=Blue]0x69[/COLOR] - Apparently this value varies from device to device.
Compared V20H TMobile USA nv.bin with V20B EURO nv.bin.
Found differences listed below. This has been a combined effort between myself and @kuma82
At offset 0x1603:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x1603 | 0x01 | 0x02 |
=======================================
Starting at offset 0x1615:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x1615 | 0x02 | 0x02 |
0x161D | 0x02 | 0x01 |
0x1625 | 0x02 | 0x07 |
0x162D | 0x02 | 0x07 |
0x1635 | 0x02 | 0x07 |
0x163D | 0x02 | 0x07 |
0x1645 | 0x02 | 0x07 |
0x164D | 0x02 | 0x07 |
0x1655 | 0x02 | 0x07 |
0x165D | 0x02 | 0x07 |
0x1665 | 0x02 | 0x07 |
0x166D | 0x02 | 0x07 |
=======================================
NOTE: Each piece of data is separated by 8 bytes
Starting at offset 0x1C00:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x1c00 | 0x01 | 0x01 |
0x1c01 | 0x01 | 0x01 |
0x1c02 | 0x01 | 0x01 |
0x1c03 | 0x01 | 0x02 |
0x1c04 | 0x02 | 0x02 |
0x1c05 | 0x01 | 0x01 |
0x1c06 | 0x01 | 0x01 |
0x1c07 | 0x01 | 0x01 |
0x1c08 | 0x02 | 0x02 |
0x1c09 | 0x01 | 0x02 |
0x1c0a | 0x01 | 0x01 |
0x1c0b | 0x01 | 0x01 |
0x1c0c | 0x01 | 0x01 |
0x1c0d | 0x02 | 0x02 |
0x1c0e | 0x02 | 0x02 |
0x1c0f | 0x01 | 0x01 |
0x1c10 | 0x01 | 0x01 |
0x1c11 | 0x01 | 0x01 |
0x1c12 | 0x01 | 0x02 |
0x1c13 | 0x01 | 0x01 |
0x1c14 | 0x01 | 0x01 |
0x1c15 | 0x01 | 0x01 |
0x1c16 | 0x01 | 0x01 |
0x1c17 | 0x02 | 0x02 |
0x1c18 | 0x02 | 0x02 |
0x1c19 | 0x02 | 0x02 |
0x1c1a | 0x02 | 0x02 |
0x1c1b | 0x02 | 0x02 |
0x1c1c | 0x02 | 0x02 |
0x1c1d | 0x01 | 0x01 |
0x1c1e | 0x02 | 0x02 |
=======================================
At offset 0x2200:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x2200 | 0x00 | 0x01 |
=======================================
At offset 0x2202:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x2202 | 0x00 | 0x10 |
=======================================
At offset 0x3400:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x3400 | 0x0b | 0x00 |
=======================================
At offset 0x2600:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x2600 | 0x00 | 0x94 |
=======================================
At offset 0x4800:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x4800 | 0x00 | 0x11 |
0x4801 | 0x00 | 0x01 |
=======================================
At offset 0x4A01:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x4A01 | 0x10 | 0x00 |
=======================================
At offset 0x6403:
Code:
=======================================
OFFSET | V20H | V20B | |
=======================================
0x6403 | 0x69 | 0x04 |
=======================================
And the last one.
Just wanted to say real quick that ill be having a 2nd shot at rooting and unlocking a co-workers l9 lets see what the real deal. My first attempt was good. Maybe it'll be one of two:
1. Like some one mentioned, maybe lg only gave a certain open time limited window and than relocked or what not.
2. Steps are being missed, rushed at highly anxious or hyped moments...lmao
Either way its worth another attempt.
Sent from my LGMS769 using XDA Premium 4 mobile app
What we need is a definitive tutorial on unlocking the bootloader. Some say wait 30 minutes while others say an hour. To root or not to root? Flash the radio.zip or paste it over while using offline flash? This is like one big hot mess...lol. :banghead:
Sent from my LG-P769 using XDA Premium 4 mobile app
---------- Post added at 11:25 PM ---------- Previous post was at 11:21 PM ----------
IMHO....LG closed that window long ago.
Sent from my LG-P769 using XDA Premium 4 mobile app
LaDY Vengeance said:
What we need is a definitive tutorial on unlocking the bootloader. Some say wait 30 minutes while others say an hour. To root or not to root? Flash the radio.zip or paste it over while using offline flash? This is like one big hot mess...lol. :banghead:
Sent from my LG-P769 using XDA Premium 4 mobile app
---------- Post added at 11:25 PM ---------- Previous post was at 11:21 PM ----------
IMHO....LG closed that window long ago.
Sent from my LG-P769 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Ill try and see if i can record my process.
Sent from my LGMS769 using XDA Premium 4 mobile app
Here's one for ya... Source code for various P769's is available from LG. What I just downloaded was V20H. It also includes the sources for the kernel. Here's the link .
shinobisoft said:
And the last one.
Click to expand...
Click to collapse
Have you had a chance to compare the nv.img?
Sent from my LGMS769 using XDA Premium 4 mobile app
kuma82 said:
Have you had a chance to compare the nv.img?
Sent from my LGMS769 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
No I haven't. Actually just had to re-read your PM to find the link for it. LOL. I read the the first time with TapaTalk.
When I sold my phone I left of here :
http://forum.xda-developers.com/showthread.php?t=2016628
trying to get omap flash to dump some data, Im pretty sure I had it recognizing the phone.
This is only for the P769? you should add it to the title if it is. I have a P768 (a weird variant: P778g) with an unlocked bootloader, if i can extract something useful for you guys ill be happy, i want to help with this.
I'd like that, i'm having problems unlocking my p768, maybe it would help. After all, it's not an exclusive problem of the p769 variant.
Wish you all the best of luck.
Sent from my LG-P768 using xda app-developers app
mato_d007 said:
This is only for the P769? you should add it to the title if it is. I have a P768 (a weird variant: P778g) with an unlocked bootloader, if i can extract something useful for you guys ill be happy, i want to help with this.
Click to expand...
Click to collapse
No this discussion is not limited to the P769.
Sent from my LG-P769 using Tapatalk
Glad to have a new thread finally.
i found this in init. lge. usb. rc
isnt any posibility that this make something to block the unlock method?
# adb only USB configuration
# This should only be used during device bringup
# and as a fallback if the USB manager fails to set a standard configuration
# ADB only(631F) is supported from LG driver V3.8
# Set Mass Storage because U2 LG driver is Currently 3.7
on property:sys.usb.config=adb
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor 1004
write /sys/class/android_usb/android0/idProduct 61A6
write /sys/class/android_usb/android0/bDeviceClass 239
write /sys/class/android_usb/android0/bDeviceSubClass 2
write /sys/class/android_usb/android0/bDeviceProtocol 1
write /sys/class/android_usb/android0/functions mass_storage,adb
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}
this is in the root of the phone
Sent from my LG-P760 using XDA Premium 4 mobile app
andras7008 said:
i found this in init. lge. usb. rc
isnt any posibility that this make something to block the unlock method?
# adb only USB configuration
# This should only be used during device bringup
# and as a fallback if the USB manager fails to set a standard configuration
# ADB only(631F) is supported from LG driver V3.8
# Set Mass Storage because U2 LG driver is Currently 3.7
on property:sys.usb.config=adb
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor 1004
write /sys/class/android_usb/android0/idProduct 61A6
write /sys/class/android_usb/android0/bDeviceClass 239
write /sys/class/android_usb/android0/bDeviceSubClass 2
write /sys/class/android_usb/android0/bDeviceProtocol 1
write /sys/class/android_usb/android0/functions mass_storage,adb
write /sys/class/android_usb/android0/enable 1
start adbd
setprop sys.usb.state ${sys.usb.config}
this is in the root of the phone
Sent from my LG-P760 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Looks like it's setting up the adb daemon on the device.
Sent from my LG-P769 using Tapatalk
I've been trying like crazy to get my friends new L9s bootloader unlocked with no luck. Then my lg offline tool got uninstalled and I couldnt get it working correct again. Well in one last attempt I loaded the stuff on my neighbors laptop (xp) and gave it one last attempt except I did a few things different and it WORKED MY FIRST TRY! Now I think it may of been the steps I skipped/ changed that made it work. Now to what I did. First I flashed v10g except this time I used the 760 version. I ran the bin file in the ICS rootguide folder instead of JB. I then proceeded to flashing v20b as shown in the video how-to except I DID NOT swap the bin file for root instead I added the radio while flashing. After it was complete I ran the bin file from ICS in rootguide again. I let the phone sit for 45 mins on data followed by 45 mins on wifi. Checked adb devices and it did not reconize it so I ran the JB bin file. Checked devices again, it reconized it. Typed the command and it rebooted right to the unlock screen! I should also add my first failed attempts was on windows 8 x64. Hope this helps someone else get it done! I almost gave up on it, luckly I did that one last try!
Sent from my LGMS769 using XDA Premium 4 mobile app
lwg45714 said:
I've been trying like crazy to get my friends new L9s bootloader unlocked with no luck. Then my lg offline tool got uninstalled and I couldnt get it working correct again. Well in one last attempt I loaded the stuff on my neighbors laptop (xp) and gave it one last attempt except I did a few things different and it WORKED MY FIRST TRY! Now I think it may of been the steps I skipped/ changed that made it work. Now to what I did. First I flashed v10g except this time I used the 760 version. I ran the bin file in the ICS rootguide folder instead of JB. I then proceeded to flashing v20b as shown in the video how-to except I DID NOT swap the bin file for root instead I added the radio while flashing. After it was complete I ran the bin file from ICS in rootguide again. I let the phone sit for 45 mins on data followed by 45 mins on wifi. Checked adb devices and it did not reconize it so I ran the JB bin file. Checked devices again, it reconized it. Typed the command and it rebooted right to the unlock screen! I should also add my first failed attempts was on windows 8 x64. Hope this helps someone else get it done! I almost gave up on it, luckly I did that one last try!
Sent from my LGMS769 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
What root guide are you referring to?
lwg45714 said:
I've been trying like crazy to get my friends new L9s bootloader unlocked with no luck. Then my lg offline tool got uninstalled and I couldnt get it working correct again. Well in one last attempt I loaded the stuff on my neighbors laptop (xp) and gave it one last attempt except I did a few things different and it WORKED MY FIRST TRY! Now I think it may of been the steps I skipped/ changed that made it work. Now to what I did. First I flashed v10g except this time I used the 760 version. I ran the bin file in the ICS rootguide folder instead of JB. I then proceeded to flashing v20b as shown in the video how-to except I DID NOT swap the bin file for root instead I added the radio while flashing. After it was complete I ran the bin file from ICS in rootguide again. I let the phone sit for 45 mins on data followed by 45 mins on wifi. Checked adb devices and it did not reconize it so I ran the JB bin file. Checked devices again, it reconized it. Typed the command and it rebooted right to the unlock screen! I should also add my first failed attempts was on windows 8 x64. Hope this helps someone else get it done! I almost gave up on it, luckly I did that one last try!
Sent from my LGMS769 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
You see! im almost completely positive some people are missing steps lol... Cant wait to get my hands on my coworkers l9 and try a 2nd time.
Sent from my LGMS769 using XDA Premium 4 mobile app
After CM12.1 install I'm unable to install the gapps pico. Here's the log from gapps install.
Notice the Total System Size is only 12mb... Using tk_gapps-modular-pico-5.1.1-20150920-signed.zip
Is there any way to increase the partition size or a quick fix? The smallest pico is about 50mb and it's still going to fail with only 12mb size.
# Begin TK GApps Install Log
--------------------------------------------------------------------------------
ROM Android Version |
ROM ID |
ROM Version | non-standard build.prop
Device Recovery | TWRP 2.8.6.0
Device Name | meliuslte
Device Model |
Device Type | phone
Device CPU |
getprop Density | 240
default.prop Density | 240
build.prop Density |
Display Density Used | 240dpi [default]
Install Type | Clean[Data Wiped]
Google Camera Installedπ | Clean
Google Keyboard Installedπ | Clean
FaceUnlock Compatible | false
Google Camera Compatible | true
Google Webview Compatible | true
Current GApps Version | NO GApps Installed
Curent TK GApps Package | NO GApps Installed
Installing GApps Version | 20150920
Installing GApps Type | pico
Config Type | exclude
Using gapps-config | /external_sd/Download/gapps-config.txt
Remove Stock/AOSP Browser | false[NO_Chrome]
Remove Stock/AOSP Email | false[NO_Gmail]
Remove Stock/AOSP Gallery | false[NO_Photos]
Remove Stock/AOSP Launcher | false[NO_GoogleNow]
Remove Stock/AOSP MMS App | false[NO_Hangouts]
Remove Stock/AOSP Pico TTS | false[NO_GoogleTTS]
Total System Size (KB) | 12052
Used System Space (KB) | 4108
Current Free Space (KB) | 7944
Additional Space Required (KB) | 74904 << See Calculations Below
--------------------------------------------------------------------------------
π Previously installed with TK GApps
# End TK GApps Install Log
INSTALLATION FAILURE: Your device does not have sufficient space available in
the system partition to install this GApps package as currently configured.
You will need to switch to a smaller GApps package or use gapps-config to
reduce the installed size.
# Begin GApps Size Calculations
---------------------------------------------------------
TYPE | DESCRIPTION | SIZE | TOTAL
| Current Free Space | 7944 | 7944
Remove | Existing GApps | + 0 | 7944
Remove | Obsolete Files | + 0 | 7944
Install | Core≤ | - 28744 | -20800
Install | GMSCore≤ | - 43656 | -64456
Install | calsync≥ | - 1232 | -65688
| Buffer Space≤ | - 9216 | -74904
---------------------------------------------------------
Additional Space Required | 74904
---------------------------------------------------------
≤ Required (ALWAYS Installed)
≥ Optional (may be removed)
# End GApps Size Calculations
# Begin User's gapps-config
Books
Chrome
ClooudPrint
Docs
Earth
ExchangeGoogle
Slides
Sheets
# End User's gapps-config
Hey, i have a little problem and i would be grateful if someone would help me, my LeEco Le Max2 Bricked, the screen went blue , i turned it off and now it doesn't want to start at all or charge ( even the led is not functional)
I explored the forum and passed a few errors but i'm stuck at :
Total to be tansferd with <program> or <read> is 3.17 GB
22:18:04: INFO: Sending <configure>
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: XML not formed correctly. Expected a < character at loc 0}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: 3. TAG not found or recognized}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR:
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
This can mean
1. You forgot to send DeviceProgrammer first (i.e. QSaharaServer.exe -s 13rog_emmc_firehose_8994_lite.mbn)
2. OR, you did send DeviceProgrammer, but it has crashed and/or is not correct for this target
Regardless this program speaks FIREHOSE protocol and your target is speaking SAHARA protcol, so this will not work
}
Writing log to 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
Thanks
do this steps :
https://www.gizmochina.com/2016/11/20/leeco-x820-max-2-super-unbrick-guide/
---------- Post added at 12:11 AM ---------- Previous post was at 12:11 AM ----------
do this steps :
https://www.gizmochina.com/2016/11/20/leeco-x820-max-2-super-unbrick-guide/
HTC-TYTN2 said:
do this steps :
https://www.gizmochina.com/2016/11/20/leeco-x820-max-2-super-unbrick-guide/
---------- Post added at 12:11 AM ---------- Previous post was at 12:11 AM ----------
do this steps :
https://www.gizmochina.com/2016/11/20/leeco-x820-max-2-super-unbrick-guide/
Click to expand...
Click to collapse
Why not this https://forum.xda-developers.com/le-max-2/how-to/guide-hard-brick-fix-qualcomm-hs-usb-t3492949 ?
valy_cta said:
Why not this https://forum.xda-developers.com/le-max-2/how-to/guide-hard-brick-fix-qualcomm-hs-usb-t3492949 ?
Click to expand...
Click to collapse
I didn't have any experience with flashing devices , when i said i didn't managed to make it work i was talking about your tutorial, i followed all your steps and i'm getting blocked by that error .
From the log I thought it was a corrupted file or something . Do you have any other idea why i'm getting that Firehose Error? I searched google and found 0 results in how i'm supposed to fix it
fratziweru said:
I didn't have any experience with flashing devices , when i said i didn't managed to make it work i was talking about your tutorial, i followed all your steps and i'm getting blocked by that error .
From the log I thought it was a corrupted file or something . Do you have any other idea why i'm getting that Firehose Error? I searched google and found 0 results in how i'm supposed to fix it
Click to expand...
Click to collapse
if the method can not unbrick your phone, you can try the firmware , hope help you .
https://www.needrom.com/download/le...ultilanguage-rom-unbrick-phone-qfil-fastboot/
Anybody know how to solve this problem?
/*invalid image type recieved*/
is_ack_succesfull : 1031 SAHARA_NAK_INVALID_IMAGE_TYPE
sahara protocol error
uploading image using sahara protocol failed
fish555 said:
Anybody know how to solve this problem?
/*invalid image type recieved*/
is_ack_succesfull : 1031 SAHARA_NAK_INVALID_IMAGE_TYPE
sahara protocol error
uploading image using sahara protocol failed
Click to expand...
Click to collapse
Its very possible that Windows security corrupted the Qfil and damaged this file, turn off antivirus, re-download Qfil and try again.
tsongming said:
Its very possible that Windows security corrupted the Qfil and damaged this file, turn off antivirus, re-download Qfil and try again.
Click to expand...
Click to collapse
Thanks for your answer
I turene off antivirus and brandmauer.
I think the problem must be in wrong image (i used kdz, img for d325 and my phone is 325f)
Also i red on forums that d325 may have two kind of processors.It's the reason why BoardDiag showed error
Anyone has 810 qfil ?
---------- Post added at 05:23 PM ---------- Previous post was at 05:19 PM ----------
Qualcomm 810 qfil which match with this methode?
leeco max x900
Hi,
I have bought a brand new LeTV (Leeco) Max 1 (x900). I installed twrp and tried to install custom rom. Unfortunately I didnt succeed and my phone is now only going into qualcomm 9008 mode. I have tried QFIL with the previous x800 service rom which supposedly puts it into a bootloop but you can still get it into fastboot mode. I have tried and tried but I constantly get the same sahara errors over and over. From what I have been reading, Qualcomms are unbrickable. So my question is where am I going wrong? The phone has a Qualcomm 810 in it. Do I need a specific file from LeEco that is currently unattainable? Please help. This is the flashest looking brick that I have ever owned...
fratziweru said:
Hey, i have a little problem and i would be grateful if someone would help me, my LeEco Le Max2 Bricked, the screen went blue , i turned it off and now it doesn't want to start at all or charge ( even the led is not functional)
I explored the forum and passed a few errors but i'm stuck at :
Total to be tansferd with <program> or <read> is 3.17 GB
22:18:04: INFO: Sending <configure>
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: XML not formed correctly. Expected a < character at loc 0}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: 3. TAG not found or recognized}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR:
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
This can mean
1. You forgot to send DeviceProgrammer first (i.e. QSaharaServer.exe -s 13rog_emmc_firehose_8994_lite.mbn)
2. OR, you did send DeviceProgrammer, but it has crashed and/or is not correct for this target
Regardless this program speaks FIREHOSE protocol and your target is speaking SAHARA protcol, so this will not work
}
Writing log to 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
Thanks
Click to expand...
Click to collapse
fratziweru said:
Hey, i have a little problem and i would be grateful if someone would help me, my LeEco Le Max2 Bricked, the screen went blue , i turned it off and now it doesn't want to start at all or charge ( even the led is not functional)
I explored the forum and passed a few errors but i'm stuck at :
Total to be tansferd with <program> or <read> is 3.17 GB
22:18:04: INFO: Sending <configure>
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: XML not formed correctly. Expected a < character at loc 0}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR: 3. TAG not found or recognized}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:18:04: {ERROR:
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
This can mean
1. You forgot to send DeviceProgrammer first (i.e. QSaharaServer.exe -s 13rog_emmc_firehose_8994_lite.mbn)
2. OR, you did send DeviceProgrammer, but it has crashed and/or is not correct for this target
Regardless this program speaks FIREHOSE protocol and your target is speaking SAHARA protcol, so this will not work
}
Writing log to 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Aex\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
Thanks
Click to expand...
Click to collapse
This my be too late for you, but it can help people in the future with this same issue.
When using the QFIL program, you need to use the "prog_emmc_firehose_8994_lite.mbn" rather than the other .mbn (or elf) file as the program path, on my phone, I had 2 .elf files and use the wrong one, which caused me to have the same fault as you did. You must also use all program and patch files or you will get it to be in a state that it only gets to the point of the splash screen. The recovery/ bootloader is not available using the phones buttons and the device does not appear on the PC at all.
If somehow you got to that point. Leave your phone connected to the computer when it is stuck on the splash screen. In about 20 minutes ( yes, I know it is a long time.) the phone will reset with two options in recovery mode. The phone will also be picked up by the PC at this time.
Just enter cmd prompt in the adb file and enter "adb reboot edl" to bring your phone into edl mode. This will allow you to reinstall firmware using the QFIL program.
JFYI, I just received the Play-systemupdate of Dec 1, 2021.
See screenshot.
This is what got updated (for me): packages + version (after update):
Code:
com.google.android.modulemetadata | 2021-12-01S+
com.google.android.networkstack | aml_net_3112130
com.google.android.networkstack.tethering | 12-7798439
com.google.android.odad | S.8.playstore.p
com.google.android.permissioncontroller | aml_per_3112110
com.google.android.providers.media.module | 12-7964833
Not yet for me.
I'm still on November. Is it just me?