Any one know command to mtty for atom exec\orsio n725 or RoverPC G5.
Phone connect to pc by rs-232, standart command not work
PS sorry for my english
Sorry, just want to understand further, why you using a serial cable (RS-232) to connect to your PC. is your phone hanged at bootloader mode?
Winterice said:
Any one know command to mtty for atom exec\orsio n725 or RoverPC G5.
Phone connect to pc by rs-232, standart command not work
PS sorry for my english
Click to expand...
Click to collapse
mtty is made for HTC devices. Atom is made by Quanta. I've been looking for the same tool myself. have you tried putty? If I'm not mistaken, you are trying to reformat the DOC? or upgrade the device thru mtty?
I have looked into the things we can upgrade from SDCARD flashing, and DOC.IMG is one of the option. I think this will change the format of DOC. One way to get a copy of this DOC.IMG is to dump the ROM thru SDCard using buzz romdumper64.
Please let me know of your developments.
Phone in bootloader, i am try dump rom. if plug phone with USB mtty doesn't see phone. if use command 'r' phone write message Format DOC.OK
Sorry for my English.
This experiments with the MTTY.
This experiments to copy ROM to the SD card or file.
I'm Running MTTY.
connecting PC and the Rover G5 (Atom Exec/Orsio N725), using a serial cable (RS-232).
Run bootloader mode.
On the PC screen :
-----------------
*******Beginning System Initialization*******
Run Mode = 104 MHz
Turbo Mode = Run Mode
MemClk = 104 MHz
Bus Mode = NORMAL
SDCLK[1] = MemClk (SDRAM Clk)
SDCLK[0] = MemClk/2 (Sync. FLASH Clk)
Mode = RUN
Boot FLASH in Asynchronous mode
******************************************************
OEMInitDebugSerial using STUART888
Microsoft Windows CE Ethernet Bootloader built Jun 13 2006 20:41:44
Copyright © 2006 Microsoft Corporation
Portions copyright © 2006 Intel Corporation
Original MSC0 12801282
New MSC0 12807FF2
New MDREFR = 0x11E018
New SXCNFG 40044004
Flash type L18
main:InitDisplay()
InitLCDCtrl..
ClearFrameBuffer..0xA6000480
+Check LCM ID:
==PreBL_Ver = 0.0.0
==2nd_BL_Ver = 0.0.0
Ethernet Boot Loader Configuration:
0) IP address: 0.0.0.0
1) Subnet mask: 0.0.0.0
2) # bootme's: 0
3) Boot delay: 0 seconds
4) DHCP: Disabled
5) Reset to factory default configuration
6) Launch existing flash resident image at startup
7) Program RAM image into FLASH (Disabled)
8 ) Program SMSC MAC address
9) Boot device order: SMSC -> PCMCIA S0 -> PCMCIA S1
D) Download image now
E) Erase flash image
L) Launch existing flash resident image now
U) Download os image now (USB1.1)
O) Overwrite eboot image now (USB1.1)
H) Jump to DM
I) Sim Lock
------------------
But ...
There are undocumented commands.
If press "R" - a message on the screen
Formating DOC.
OK
So there are undocumented commands
we are interesting other command
It would help us if we get hold of Service Manual.
Winterice said:
Phone in bootloader, i am try dump rom. if plug phone with USB mtty doesn't see phone. if use command 'r' phone write message Format DOC.OK
Click to expand...
Click to collapse
Have you tried buzz grab_it ROM dumper? it worked perfectly well with the Atom. It dumped everything to SD Card. You just have to break it apart and identify the sections.
For the Atom:
diskimg.nb0
eboot.nb0
dm.nb0
flash.img
agent.mot
mot.mot
cpld.img
assetinf.img
extended.img
MDOC.img
what particularly interest me is MDOC.img because I believe we can change DOC format with this.
our device have 192 mb rom, i or Alex_beda try this dumper today
This dumper not working.
Message in the screen "cannot create file!"
Using the miniSD 2 GB Kingmax
May be need to use mini SD less 1 GB?
Or using any other dumper?
alex_beda said:
This dumper not working.
Message in the screen "cannot create file!"
Using the miniSD 2 GB Kingmax
May be need to use mini SD less 1 GB?
Or using any other dumper?
Click to expand...
Click to collapse
you have to modify the name of SDCard. It is named "memory card" in your device. the program looks for "Storage Card". Search this value using registry editor.
"Folder"="\Storage\Card"
jiggs said:
you have to modify the name of SDCard. It is named "memory card" in your device. the program looks for "Storage Card". Search this value using registry editor.
"Folder"="\Storage\Card"
Click to expand...
Click to collapse
Thank you!
I'm downloading dump in the miniSD card.
But...
Problem.
Dump size 128 MB maximum
ROM size in my divice 192 MB.
How downloading full size (192 mb)?
alex_beda said:
Thank you!
I'm downloading dump in the miniSD card.
But...
Problem.
Dump size 128 MB maximum
ROM size in my divice 192 MB.
How downloading full size (192 mb)?
Click to expand...
Click to collapse
Your ROM chip size is 192MB. BUT I think, your ROM system size is only 64mb. Same as ATOM. The rest is only persistent storage, extended partition, and checksum partition.
to verify, you can pdocread the memory layout of your device. don't forget to install the RAPI before pdocread; otherwise, it will not work.
my ELF's mac address may be lost
every times, when my elf restart,
a document named HTCExcpthLog_mmdd_hhmmss.txt will be build in SDcard at \storage card\HtcLog\
mmdd_hhmmss is the restart time.
Related
First of all .. my thanks goes to all the people to this forum!
You're really GREAT !!
In any case sorry for my poor english :wink:
I've few questions ...
I've read many many pages but I can't understand the right procedure to follow for dumping my Himalaya original ROMs because in some pages the "d2s" command is followed by some numbers and in other, by other numbers ... confusion bring me !
After that, otherwise, I've tried to follow the XDA II procedure and the storing procedure to SD seems to be ok .. but when I try to save the rom dump from my SD to PC using ntwr (otherwise was unreadable in Win), I've got a read error but, in any case, I obtain only one file on my PC of about 400 MB and I suppose that something is wrong because all of you speaks of about 50 MB ... so ... What's the right procedure with the right command? How can I be sure that my dump is correct? The dump it's only one file or one for separate ROM Radio and Extended?
When I solve this issue I can try to upgrade my Himalaya to WM2005.
Thank you for your help.
Please help me, I'd like don't lose my guarantee.
This post was submitted also to buzz forum
Now this is the situation ...
Qtek 2020 - 1.66.04ITA
-= Preparing the device =-
01 ) I,m gone to Bootloader (Power + Directions + Reset)
02 ) I see on the device "Serial v1.06"
03 ) I stop MSSync service Ctrl+Alt+Canc and stop wcescomm.exe
04 ) Put device on cradle
05 ) Now I see on the device "USB v1.06" instead of "Serial v1.06"
06 ) Put the 512 MB SD into the device
07 ) Start Mtty 1.42
08 ) Leave as is all the parameters
09 ) I've "USB" port (and not ".WCEUSBSH001") and I press USB
10 ) Ok seems to be connected to the device
-= Dumping the ROM on SD =-
11 ) Into mtty command line I write (and not copy and paste and without "sd a" at the end)
d2s 80000000 02000000
12 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
SDCARDD2S+,cStoragePlatformTyp e=FF
****************************** ****************************** ****************************** ****************************** ********
Store image to SD/MMC card successful.
USB>
13 ) Then I write
d2s 60000000 00300000 sd a
14 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
************
Store image to SD/MMC card successful.
USB>
15 ) Then I write
d2s 70000000 01080000 sd a
16 ) Device tell me % of work while in mtty I found
SD:Waiting for card insert.........
CMD3 for SD, it's OK, ready to get RCA from response.
SD : Detected one card
SD : ready for transfer OK
pc->drive.total_lba=EEC00
pc->drive.num_heads=0
pc->drive.sec_p_track=0
pc->drive.num_cylinders=0
pc->drive.block_size=200
pc->drive.features=0
pc->drive.RCA=B368
pc->drive.drv_type=40000000
pc->drive.securedAreaSize=0
pc->drive.securityDrv=0
pc->drive.busWidth=1
pc->drive.erasedSize=0
Total card size=1DD80000
DOCInfoTableinitHW+
Binary0:dwSize=80000
BINFS0:dwSize=0
FAT0:dwSize=1000000
FAT1:dwSize=EA0000
All:dwSize=1F20000
****************************** ****************************** ******
Store image to SD/MMC card successful.
USB>
-= Saving ROM from SD Card to PC =-
17 ) Put the SD Card into a Card Reader
18 ) Go to Dos command line into ntrw path
19 ) Type "ntrw read ROM.nb1 H:" where H: is the Card reader drive
Now start the problem ... :shock:
I want to know if it's all ok with this process ...
The output of ntrw is:
NTRW 2.0
Removable media
Cylinders: 0:60
TracksperCylinder: 255
SectorsPerTrack: 63
BytePerSectors: 512
bufsize is 65536
500629504 bytes written bytes: 0
ReadFile(): ROM.nb1 -- Parametro non corretto
First signal of some error but someone tell that's ok!
And then I see prompt.
Now I find the file ROM.nb1 that is 477 MB (like the SD size after a FAT format).
It's ok? ... I don't think so .. but let's going on!
I open the file with an HEX Editor and the file seems ok but after a string like HTCE the file contains all 00h.
Can I cut off that part?
How can I ensure myself that's all ok?
Come on guru don't leave me with the bootloader splash screen instead of the MAGNETO one :lol: :lol: :lol:
Thanks to rhmartin's help (on buzzdev.net) I've reach this situation ..
I've got my dumped rom in SD and in a file.
But ...
I acquire more information about my Qtek 2020 (XDA2):
ROM: 1.66.04ITA
Radio: 1.10
ExtROM: 1.66.148
I think that's a WM2003 (not SE), isn't it?
In any case ... I put back my dumped roms in SD and followed the procedure for rom restore:
1 - Bootloader
2 - Put SD into device
3 - Wait for "Press Power Button"
4 - ecc. ecc.
But I never reached number 3, what's wrong?
I've put back the dump as a single file (as ntrw output give to me), it's correct or I must put it back (and so backup first in that way) as 3 separate files?
I've seen that in download area there's no WM2003 dumped rom, so I search by myself and I found RUU172128ITA (1.72 ITA) but I prefer if my backup can be useful for disaster recovery and can be used for my original version backup.
I think that you understand my situation .. I prefer ask before a not funny situation instead fill the forum with hundreds emergency posts.
I hope you think I've reason.
Thank you for the patience and sorry for possible misunderstandings or english syntax errors!
NO ONE CAN HELP ME ... INCREDIBLE!
I'm ready to ask sorry but ...
There's no one in this great forum that can help me ...
IT'S INCREDIBLE !!! :shock: :shock: :shock:
I don't think that no one haven't my problem ...
PLEASE SOMEONE HELP ME
:evil:
I'm truly sorry about the delay.
I've finally got round to posting a a STAR100 SuperCID guide.
1. Get itsutils: http://www.xs4all.nl/~itsme/projects/xda/tools.html
2. Run pdocread.exe with no args. Take a note of the "uniqueid" value.
3. Run "pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb" - you'll get a file.
4. Head over to http://www.spv-developers.com/strtrkCID/. Feed it the DOCID and the file you got from steps 2 and 3. It'll give you back anoter file.
5. Run "pdocwrite -n 1 patchedfile.bin 0x000000 0x10000 -b 0x4000" where patchedfile.bin is obviously to be replaced with the patched file you got from step 4.
6. There is no 6. Report feedback.
Click to expand...
Click to collapse
All credit goes to itsme - he wrote all the tools and scripts which made all this possible.
Spawning script: perl startrek_cidedit.pl cid1e62995dd1db197b00b697388760b5e3.bin -i DOPOD601 -c 11111111 -o supercid1e62995.bin 2>&1
decrypting
bufend=44bdd4609845fd0931a871b4a31ddba42d4b96386f9 e9c5dff947c035432fc15
result=b2c7c4eede400853eb232eba436f394b3d75a9adf4c e9a1e452b26ea9059dc59
sha64k=8a7e3a8462b8c851ac125710d44abc05da4916f215e 331f98420db7ae5d87a5d
buffer checksum failed
why ?
Looks like the DOCID value you entered is incorrect. It should be a long stream of hex numbers.
Fantastic !!! Working Ok on SPV F600. Now, we need how to simunlock this smartphone.
Thank you very much Zone Mr.
i run pdocread in step 1 and got a dos screen that desaper in a second,and were i find the file in step 2.
Zone-MR said:
Looks like the DOCID value you entered is incorrect. It should be a long stream of hex numbers.
Click to expand...
Click to collapse
thank you Zone-MR,can u tell me how to get a long stream of hex numbers.
wlinsong said:
thank you Zone-MR,can u tell me how to get a long stream of hex numbers.
Click to expand...
Click to collapse
i know how to do,thank Zone-MR very very much
is there someone know how to flash rom use T-flash Card?
someone can't get the docid ,because you must use the old one!
I tried to do first step but when I ran pdocread.exe I get the following message :
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked.
I've app-unlocked my device, activesync works ok, and restarting does not help. Phone is Qtek8500.
Any ideas?
Thanks
Is the script to calculate CID area for startrek available?
I think this should use the same method on Artemis or Herald, the problem is that they have G4 DOC and we'll not be able to use pdocwrite, but on those phones we're already able to place a hacked SPL in mem with psetmem.exe and jump into it's address with modified haret version. If we have the right CID area we can use the hacked SPL to flash it.
sorry for the ignorance...
I have downloaded itsutils but where is the dpocread.exe??
do I have to connect to the device with the mtty??
Maybe a bit more explanation
I've CID unlocked my Qtek 8500 and installed new ROM 3.6.251.0. Thanks Zone, great work!
Maybe it would be useful to write more detailed instructions, so here it is :
1. Application unlock your phone using regeditstg and do the following :
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1001 = 2 -->Change the value data from 2 to 1
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1005 = 16 --> Change the value data from 16 to 40
HKEY_LOCAL_MACHINE\Security\Policies\Policies\0000 1017 = 128 --> Change the value data from 128 to 144
Reboot the phone
2. Run SDA_ApplicationUnlock tool. Reboot the phone after it finishes.
3. Download itsutil.zip from http://www.xs4all.nl/~itsme/projects/xda/tools.html , version from 2005-6-28. There is even newer version, but with that version you can not use pdocread without arguments.
4. Connect the phone with activesync
5. Run Command Prompt, go to subfolder named "build" in itsutils folder, and run pdocread without arguments
6. Note the value of "uniqueid". It will be something like : "00 00 00 00 12 03 02 14 3b 07 1b b2 04 05 07 54"
7. run pdocread again with these arguments : "pdocread -n 1 0x000000 0x10000 -b 0x4000 original-bdk1.nb". This will make original-bdk1.nb file in build folder (where the pdocread is located).
8. Upload this file and value of uniqueid to http://www.spv-developers.com/strtrkCID/. It will open a new page after few seconds. Go to bottom of the page and click the link "Download patched BDK1"
9. Download the file (it will be named like "supercidxxxxxxx.bin) to "build" folder
10. Run the pdocwrite from command prompt with these arguments : "pdocwrite -n 1 supercidxxxxxxx.bin 0x000000 0x10000 -b 0x4000". Replace supercidxxxxxxx.bin with the original name of downloaded file from step 9.
11. Wait 15-20 seconds and that is it. Reboot the phone and install the ROM you like
It works! I've got now 3.6.251.0_02.67.30 on my Qtek!
Thank's, damird, your guide is unreplaceble for such lamers like me
But maybe anyone can suggest me were can i find and how to install (if it possible) Russian t9 or only russian lang to input? Or maybe how to rollback to original ROM with this that lang... (1.02.261.1)
Thank's
added:
Problem's gone, Russian T9 added.
Damird!
Cheers mate
Hello, can you share with us this script to calculate CID area in StarTrek?
With this script we can SimUnlock the StarTrek very easy (at least I think...)
Thank you very much.
I'm confused here... is CID unlock not the same with SIM unlock?
my carrier is tmob but I'm getting cing 3125 at ebay so I need to SIM unlock the phone for it to work on tmob right?
wow, pof, I can't wait for it! i had bought one herald in China but wireless was disable by default. I hope I could unlock the CID and get a WWE rom to enable the wireless.
sokelut said:
I'm confused here... is CID unlock not the same with SIM unlock?
my carrier is tmob but I'm getting cing 3125 at ebay so I need to SIM unlock the phone for it to work on tmob right?
Click to expand...
Click to collapse
Correct, you still need to pay to carrier unlock the phone. Check the wiki for links to a few services that are known to work.
CID unlock? Error installing ROM
I'm getting an ERROR [294] INVALID VENDER ID
I did the CID unlock
It starts to install the rom but when it gets to 4% I get this error. How do i fix this?
Can anyone help?!
Need a little clarification
Im stuck in steps 3-11. I've downloaded itsutils and I don't know how to proceed.
Ok guys,
i think i'm in a sort of big trouble. I got SPL1.2, i was installing this Miky ROM and then at 91% Windows Mobile Device Center crashed on my pc. Now what i have is a 7500 booting with strange lines on the screen and then fading to white. I tried to pull out the battery and then to recover but nothing is working. I broke my 7500??? Why God is never here when i need him???
See if you can get into bootloader (tri color screen) if you can flash a factory rom. Have a look here, you should find what you need or a link to the needed resources http://forum.xda-developers.com/showthread.php?t=429013
Cheers
BR
***Why You Try This !!!___carefully step by step !!!!!!!!
cmonex
Senior Member Join Date: Jul 2006
Location: Budapest
Posts: 2,314
--------------------------------------------------------------------------------
here's an experimental program I made to make the process more automatic so users can fix their own wifi without our help.
this is good for both corrupt modelid and corrupt wifi, and fixes both at the same time.
STEP BY STEP:
1. download attachment at the end of the post for mac1.exe (requires .net 2.0 installed on the PC)
2. you will also need to download the other attachment in this post for the mtty program.
3. enter bootloader (tricolour screen) manually by pressing and holding camera button all the way in (yes I mean that, press it in as hard as you can!!), while doing a reset, then keep the camera button held until you see the tricolour screen.
4. disable USB in activesync (wmdc if you have vista - in this case, do not kill wmdc, just disable usb in it!!!)
5. run mtty and select USB option from the dropdown box!
6. then press enter in main window that comes up, see if that gives you Cmd>
7. now you should have Cmd>, if not, re-check if you did the above steps right until you get Cmd>
8. now run the mac1.exe, type in your MAC address you want to use for the Athena, if you have SPL 3.xx reported on the tricolour screen, then use the button for SPL 3.xx, otherwise if you have SPL 1.xx reported, use button for 1.xx.
9. this should have generated a .bin file for you, copy that bin file in the folder of mtty.
10. now, in mtty, type (do not copypaste!) this command: task 32
11. this should return Level = 0
12. now, you must only do one of the two following commands:
- if you have SPL 3.xx, then type (do not copypaste!!) this command: lnb filename.bin 76508000
(there filename is the name of the .bin file you generated - don't forget to put .bin after filename, as the full name is needed).
- OR, if you have SPL 1.xx, then the command is different (do not copypaste!!): lnbs filename.bin 75108000
(there filename is the name of the .bin file you generated - don't forget to put .bin after filename, as the full name is needed).
NOTE, the command starts with a lowercase "L", not "I"!
WARNING: PLEASE DO NOT MIX UP THESE TWO DIFFERENT COMMANDS!!!
if this info helps: most people will have SPL 3.xx, and if you have AP4 (not vanilla) already running then you're definitely 3.xx
13. mtty will popup a window asking "OK", you press OK!
if you get "Fail to synchronize with the host (1)", then make sure you did follow step by step. if still same error, try placing mtty and the bin file under C:\.
14. now the file downloads, if mtty reports it flashed the file, and at the end "code entrypoint unknown", then that's it, now boot back to WM and see if wifi works.
edit: see raskell's mtty tutorial too, #36. post in this thread
if you *really* can't manage to get it working, you can still feel free to PM me.
let me know if this program and step by step description helped any.
Attached Files mac1.zip (6.3 KB, 1585 views)
mtty_0513_Test.zip (553.9 KB, 1883 views)
__________________
Here is direct link__on floor #33 ===>
http://forum.xda-developers.com/showthread.php?t=387454&highlight=mtty&page=4
Good Luck!!!
Hello
Please help me return the model number,
cause when I try to change my rom I always get the same error Error [244] : Invalid model id.
Now I have
some strange symbols in bootloader.
This appeared after I'd tryed to change mac using mtty, as I have created bin file for SPL 1.xx
Please help me
Hi,
You need to carry out the instructions to the letter in post 33 HERE and it will sort your problem, read it all very careful, its easy to make a mistake if you're not paying attention.
regards
Jay
Thanks Jay.
It works again.
You're welcome, glad it helped
Regards
Jay
here's an experimental program I made to make the process more automatic so users can fix their own wifi without our help.
this is good for both corrupt modelid and corrupt wifi, and fixes both at the same time.
STEP BY STEP:
1. download attachment at the end of the post for mac1.exe (requires .net 2.0 installed on the PC)
2. you will also need to download the other attachment in this post for the mtty program.
3. enter bootloader (tricolour screen) manually by pressing and holding camera button all the way in (yes I mean that, press it in as hard as you can!!), while doing a reset, then keep the camera button held until you see the tricolour screen.
4. disable USB in activesync (wmdc if you have vista - in this case, do not kill wmdc, just disable usb in it!!!)
5. run mtty and select USB option from the dropdown box!
6. then press enter in main window that comes up, see if that gives you Cmd>
7. now you should have Cmd>, if not, re-check if you did the above steps right until you get Cmd>
8. now run the mac1.exe, type in your MAC address you want to use for the Athena, if you have SPL 3.xx reported on the tricolour screen, then use the button for SPL 3.xx, otherwise if you have SPL 1.xx reported, use button for 1.xx.
9. this should have generated a .bin file for you, copy that bin file in the folder of mtty.
10. now, in mtty, type (do not copypaste!) this command: task 32
11. this should return Level = 0
12. now, you must only do one of the two following commands:
- if you have SPL 3.xx, then type (do not copypaste!!) this command: lnb filename.bin 76508000
(there filename is the name of the .bin file you generated - don't forget to put .bin after filename, as the full name is needed).
- OR, if you have SPL 1.xx, then the command is different (do not copypaste!!): lnbs filename.bin 75108000
(there filename is the name of the .bin file you generated - don't forget to put .bin after filename, as the full name is needed).
NOTE, the command starts with a lowercase "L", not "I"!
WARNING: PLEASE DO NOT MIX UP THESE TWO DIFFERENT COMMANDS!!!
if this info helps: most people will have SPL 3.xx, and if you have AP4 (not vanilla) already running then you're definitely 3.xx
13. mtty will popup a window asking "OK", you press OK!
if you get "Fail to synchronize with the host (1)", then make sure you did follow step by step. if still same error, try placing mtty and the bin file under C:\.
14. now the file downloads, if mtty reports it flashed the file, and at the end "code entrypoint unknown", then that's it, now boot back to WM and see if wifi works.
edit: see raskell's mtty tutorial too, #36. post in this thread
if you *really* can't manage to get it working, you can still feel free to PM me.
let me know if this program and step by step description helped any.
Attached Files
File Type: zip mac1.zip (6.3 KB, 2125 views)
File Type: zip mtty_0513_Test.zip (553.9 KB, 2613 views)
Ameo
Pfff i have tried everthing what i could find and nothing works. i managed to get the driver working from usb on windows 7 but it keeps showing the bootloader! with some strange marks. i flashed it with 1.2 Olipro and im afraid it will never work again any suggestions left?
Greetings
After a long time search i think i can do a custom rom along with a CWM Recovery for TURBO X HIVE III tablet, but i need ORIGINAL boot.img, kernel.img, misc.img, recovery.img, system.img dump. I will do it myself, but in my Turbo X Hive III tablet i do not have original Andoid OS 4.1.1. I already put it on this nice tablet C.M.10.1 but with some other kernel from another tablet and i screw up the touchscreen drivers. From what i understand some of them are integrated in kernel, but i do not have the original kernel image! For those who wants to help to update this tablet (offcourse must have this device) i will upload a tool that can be easily dump .img for our needs! If more people want to develop something nice for this tablet i will provide more details on what we need to do or what i already did! But for now i will wait and see.....!!!
For the tool dump click HERE
Understanding!
Learning things first (optional).
All this is OPTIONAL for you to learn. If you don’t want to learn it then move on down to the instructions!
Understanding NAND layout:
Your NAND chips is broken into "partitions" or parts if you will call it that.
Each one of these servers a purpose. Here are all the partitions of a RockChip ROM.
Loader.bin - this is low in NAND and special. You can flash it but cannot dump it.
parameter - this file tells the loader how NAND memory is split up into partitions.
misc.img - this is a special area that tells the recovery system what to do on boot.
boot.img - this is the boot section and basically is the ram disk the kernel uses to boot.
kernel.img - this is of course the kernel.
cache.img - this is an area APPs store information like Google Play for instance.
kpanic.img - this is a special area for use by the kernel.
metadata.img - this is a NEW area for KitKat only. It does not exist in pre-kitkat ROMs. It's used for Encryption.
recovery.img - this is like boot.img but boots the recovery menu system.
system.img - this is the system OS.
backup.img - I am not sure what this is. It started showing up with Rockchip ROMs but does not appear to do anything.
But it might be work backing up anyway.
userdata.img - this is where APPs get installed, user accounts are stored, databases, etc. This area if erased losses all your user installed apps, settings, etc. A factory data reset erases this area.
user.img - This is the remaining NAND space and is set aside as the Internal SDcard.
Please note, many APPs like games, etc store stuff here! Erasing this you can lose data! This is also erased on a factory reset.
So based on the above what parts are a stock ROM?
Loader.bin
parameter
boot.img
kernel.img
misc.img
recovery.img
system.img
As you can see a stock ROM is just that! No user data!
Erasing NAND with the flash tool and flashing a stock ROM gives you a empty like new device as if you just bought it.
OK so some basics there. Now let’s look at the parameter file.
It's important because we will be using this to DUMP NAND memory.
I do not need to make you an expert on this but you need to know a few things.
If we look at this area of a parameter file, you will see the partitions I listed above!
Both the ones that hold a stock ROM images as well as ones that are created to be used by the system.
Here is an example of a parameter file for a kitkat ROM.
[email protected](misc),[email protected](kernel),[email protected](boot),[email protected](recovery),[email protected](backup),[email protected](cache),[email protected](userdata),[email protected](metadata),[email protected](kpanic),[email protected](system),[email protected](user)
So what do those number mean in from of each partition name like boot for instance?
First all these numbers are in hex. Second the numbers are blocks of 512 bytes!
let's look at boot..
[email protected](boot)
The first number 0x00006000 is the size of the partition.
The second number 0x0000a000 is the offset into the NAND chip from 0 location (start of the NAND chip).
But remember all these numbers are in 512 blocks.
If you wanted to know the size in bytes then do this math in your PC calculator.
REMEMBER to have the calculator set to HEX!!!
Enter 6000 and now multiply by 200 (fyi 200 hex is 512 decimal).
You will get C00000. Want to see that it decimal? In the calculator just click Dec and it will convert it!
So what we have is 12,582,912 bytes! Basically that is 12 megabytes.
Alright you can do that same math if you wanted to know the offset into NAND in decimal bytes.
Why is all this important? Well if gets you up to speed later when we calculate internal SDcard.
You don't need to know this but it might help you understand if you were to do things on your own.
___________________________________
Instructions for dumping....
Before we begin let’s get familiar with the tool.
In the download run the ROM_Dumper_Tool.exe.
When it opens you will notice 3 tabs at the top.
Download image - this is for flashing ROMs
Upgrade Firmware - this is for lashing single .img ROMs. I won’t be going into this area for as we don’t use it for dumping.
Advanced Function - This is for dumping and doing some NICE stuff! We will be in here all the time for this procedure.
Note: Anytime we dump a partition the tool always makes a file called ExportImage.img in a folder called Ouptut.
So every time we dump a different partition it will overwrite that file unless we rename them first!
Don't forget that please.
OK first lets dump the basic flashable ROM:
To do ANY dumping we need to dump the parameter file of the ROM from NAND.
Why? because we need the start (offset) and count (size) of the partition or we can’t dump anything.
1) Click the advance functions tab.
2) At the bottom is the "export image" button and to empty boxes, Start and Count.
3) To get the parameter file put a 0 in the start box and a 2 in the count.
4) Now press the export image button.
5) Now we need to make this a real parameter file! Rename the file to parameter.txt
6) We need to clean it up a bit. Open in Windows note pad ONLY!!! Do not open in MS word or anything else or it won’t work!
Also you may need to turn on word wrap to see everything (format menu, select word wrap checked).
7) The first line you will see something like this:
PARMi FIRMWARE_VER:4.1.1
Delete all the junk in front of the word FIRMWARE so it looks like this now:
FIRMWARE_VER:4.1.1
8) clean up ending junk. At the end you will see this word:
(user)
After it will be some junk. Delete everything after (user) including any blank space.
When done make sure to hit enter once so there is a new line after (user)
9) Save the cleaned up parameter file but leave it open as we need it to continue.
Now let’s start dumping!
We will do system.img to start with as an example.
1) Look at the parameter file and find (system) and the numbers before it. Example:
[email protected](system)
REMEMBER the number before @ is the COUNT and the number after the @ is the START!
2) Copy the number after the @ example: 0x00484000 into the start box of the advanced tab in the tool.
3) Copy the number before the @ example: 0x00180000 into the count box of the advanced tab in the tool.
4) Press the export image button and wait for it to complete.
5) Go into the Output folder and rename the file ExportImage.ing to system.img
Now we just repeat the steps 1-5 above for
misc.img
kernel.img
boot.img
recovery.img
backup.img (This can be optional but do it anyway especially if this is a first REAL stock ROM dump as we may need it).
Remember to always use the numbers in front of each name! Don't forget to change those or you won’t have a good dump.
Also remember after each dump, to rename ExportImage.img to the proper name of the image you dumped!
Each time you press Export Image, it will overwrite the existing ExportImage file unless you rename it!
When you’re done you should have the basic ROM dump.
misc.img, kernel.img, boot.img, recovery.img, system.img, and backup.img.
You can now use the flash tool 2.1 or the flash tool 1.37 to flash these.
_________________________________
Dumping userdata, cache, metadata, kpanic:
For a user backup the above 4 should be dumped.
We will start with userdata
This is basically the same as above except can take longer depending on how big your user data partition is.
This will be larger than any other partition so far as most devices have at least 1GB or more!
1) Again look at the parameter file and find (userdata) and the numbers before it. Example:
[email protected](userdata)
REMEMBER the number before @ is the COUNT and the number after the @ is the START!
2) Copy the number after the @ example: 0x00080000 into the start box of the advanced tab in the tool.
3) Copy the number before the @ example: 0x00400000 into the count box of the advanced tab in the tool.
4) Press the export image button and wait for it to complete.
5) Go into the Output folder and rename the file ExportImage.ing to userdata.img
Again repeat above for cache, kpanic, metadata.
if your parameter file does not have metadata then no need to dump this as it does not exist.
Remember only KitKat ROMs have this so do not worry if you don’t have it.
_________________________________
Finally to the hardest part but it is not really that hard. Dumping "user" which is internal SDcard.
Note: if you have a 32GB NAND or something large like that, this might not be worth your time!
Just back up internal SDcard another way (file copy) as it will probably be faster.
One way I like to do it is turn on MASS Storage in settings and enable USB to the PC.
Then I just copy the files to the PC.
For restore after flashing a ROM and userdata, I do the same thing and copy the files back to internal sd BEFORE running any apps that need that data on internal SDcard!
Dumping 32GB and flashing a large internal SDcard takes a LONG TIME! If most of your internal SDcard is empty,
dumping and flashing still writes ALL 32GB anyway so it's a waste of time to do this unless you have a LOT on internal SD.
So there is a trade-off... YOU decide which best works for you!
*********
So to back this area up we have to work some things out.
You will notice the parameter file for (user) has no SIZE number just the offset!
Example: [email protected](user)
the [email protected] simply says to use the remaining NAND as all of user (internal SDcard).
Thus to dump it we must calculate the size! To do this we must know how big our NAND chip is.
First put the number after the @ into the start box so we don't forget example: 0x00604000
This is just like the other parts we did above. We need the start point for user (internal SDcard).
Now let’s find out the size of the NAND chip.
In the advanced tab click the Read Flash Info button.
On the right it will display information but we are interested in this:
Flash Size: XXXXX MB
Where XXXXX is the size of your flash chip "page" size.
For instance my "other androidrk3066 device" says 8192 MB.
BUT WAIT! We also have to see how many pages of NAND we have.
Look at the line Flash CS:
If yours has a 0 then that is all you have 8GB
If CS says something like 0 1 2 3 (That’s 4 pages)
Then you have 4 pages of 8GB or 32GB NAND. If it says 0 1 then you have 2 pages or 16GB NAND and so on.
So whatever your size is multiple that by number of pages!
Example my "other rk3066 android device" stick says:
Flash Size 8528 MB
Flash CS: 0
Thus my full NAND size is 8528 as there is only 1 page
(yes the 0 is a page! The first page starts at 0 and a 1 is the 2nd page).
My "other rk3066 android device" says this:
Flash Size 8192 MB
Flash CS: 0 1 2 3
Thus I would take 8192 and multiply by 4 pages = 32768 MB NAND size.
So we now have our total NAND size!
Now a little more math but easy if you follow my instructions.
First we must make the size in MB a REAL GB number (not a MB number in 1000's).
I am going to use 8192 MB (8GB) NAND as an example. (It only had 1 page e.g. Flash CS: 0)
1) Open your PC calculator and again make sure it is set to programmer mode!
2) Make sure your set to Dec (decimal) not Hex mode!!!
2) Type in your NAND size you read or calculated with pages from the tool. My example 8192.
3) Multiply that by 1024. My example 8192 x 1024 = 8388608
4) Now do that one more time and multiply 8388608 by 1024. My example 8388608 x 1024 = 8589934592
5) Now divide this number by 512. My example 8589934592 / 512 = 16777216
So you know what all this math did was take the proper number of bytes and divide them into 512 blocks.
This is what is needed by the flash tool and parameter file!
6) Now press the Hex button on the left of the calculator to convert this to a hex number. My example came to 1000000 Hex.
7) OK now we know the total size of our NAND chip in 512 byte blocks in Hex format!
8) Now take this number and subtract the "start" that what was shown in the parameter file.
In my example parameter file I had [email protected](user) so my start is 604000 (we don’t use the beginning 0's).
So again my example 1000000 - 604000 = 9FC000
We now have our user (internal SDcard) size! It is 9FC000 in hex!!!
9) Enter this number into the count box of the tool. Again my example is 9FC000
BUT we need to enter it in the format the tool needs and that is hex!
Just add the 0x at beginning of the number so the tool knows it's hex. Again my example is now 0x9FC000
Just a note: 0's in front of any hex number are ignored. So 0x009fc000 is the same as 0x9fc000.
10) Make sure as I said above, you also entered the start number! Again in my example 0x00604000
11) Press the export image button and wait for it to finish. Depending on size this could be a long time!
12) Done forget to rename the ExpoertImage.img to user.img!
We are DONE! We now have a flashable FULL backup of the entire NAND chip!
What you should have in the output folder, if you did everything above dumping EVERYTHING is:
parameter.txt
backup.img
boot.img
cache.img
kernel.img
kpanic.img
metadata.img (optional if you had that and were on KitKat)
misc.img
recovery.img
system.img
user.img (internal SDcard)
userdata.img
__________________________________
Flashing your dump:
OK so now you have dumped the ROM and other items and you want to flash them back.
Well we can’t use the 2.1 RK tool! Why? Because it has 2 bugs in it.
1) Flashing userdata. It works but will error at 50% every time.
It actually does flash 100% but due to a math bug in the program it counts to 50% instead of 100%.
2) It won’t flash user (internal SD). If you try it says it did it but it doesn’t.
It returns success instantly so obviously it doesn’t flash anything.
If you did not backup user (Internal SD) then feel free to flash with the 2.1 tool and you will be OK even with the error at 50%.
However I setup the old 1.37 flash tool for you. All of the lines for each image is there.
I even have them checked by default for you.
In the download there is a flasher tool folder. Just run the flash tool from there.
Uncheck anything you didn’t backup or items you don’t want to flash.
Note: if you leave something checked you did not backup or the .img is not in the Output folder, you will get an error.
I left boot loader unchecked as there is no reason to flash that!
OK so that’s it!
Specs!
In case somebody not know what device is about: Turbo-X, 10.1", 1280 x 800 pixels resolution, IPS panel, Front Camera 0.3 Mp, Back Camera 2.0, Android 4.1 Jelly Bean, CPU - Dual Core ARM Cortex A9 at 1.5 GHz, Internal Storage 16 GB, RAM -1 GB, WiFi, Bluetooth, Mini HDMI, Micro usb 2.0 host, microSD card slot, Li-Ion 6600 mah with Android 4.1.1, 3.0.8+ Kernel !
Battery
Also for those who have some problem with battery i found this one that is even better then original HERE
Some other toolkit that i find!
Special thanks to Zeus and Faheem! With their tools you can Check Device, Wipe data, fastboot wipe, Reset user lock, Reset gmail, Reboot device, Fix camera, install usb driver and many other cool stuff!
HERE
My dear friend Seby, i can help you without any problem and maybe we can open a new development thread for this old tablet because i already did a custom rom with a great help from a greek friend Panagiotis! So we will talk in PM about that!
Hello,can i have more information about this rom?
I must fix my brother's tablet ,stuck on bootloader.
It's exactly the same model as the author's of the current thread.
does anybody know how to enter fastboot mode in a turbox hive iii tablet it stuck in boot logo screen and i cannot do anything. If there is something I can do please tell me.
thanks