Title pretty sums it all. Need some advice and some crazy ideas to try. Anyone?
p34c3m4k3r said:
Title pretty sums it all. Need some advice and some crazy ideas to try. Anyone?
Click to expand...
Click to collapse
I've done a fair bit of this stuff, and ended up having to send my phone into warranty before.
There is a program called OMAPFlash which motorola uses, and they send off the correct signed firmware onto the device. I was only able to get so far. Your device must have bricked when you were writing the mbmloader...
You need to write the mbmloader. Let me see if I can find anythign for you.
Who is the carrier of the phone?
danifunker said:
I've done a fair bit of this stuff, and ended up having to send my phone into warranty before.
There is a program called OMAPFlash which motorola uses, and they send off the correct signed firmware onto the device. I was only able to get so far. Your device must have bricked when you were writing the mbmloader...
You need to write the mbmloader. Let me see if I can find anythign for you.
Who is the carrier of the phone?
Click to expand...
Click to collapse
Thanks for the reply. I bought it unlocked. Managed to find omapflash, but only for windows. Did you find it for linux?
About the device...
- If I plug it in, the white light comes up, for sometime, then shuts off. During this period there is no activity on the usb bus.
- If I plug it in, and press power, the light shuts off and the unit starts being recognized as OMAP4430.
- I tried usbboot from the LG session, since there are some models that use the same cpu. No go. Couldn't upload the code.
- One thing to notice, the file called by OMAP MLO, that carries the signed code, is mbmloader_xx.bin. Tried also with usbboot. No go.
- Formating a 4GB SD with a GPT partition table and two partitions: FAT32 and EXT3 respectively, copying the mbmloader_hs.bin as MLO and mbm.bin as u-boot.bin, to the first partition and trying to boot. No go.
- Using a Windows pc with Windows XP SP3 and the Motorola suite + the OMAP driver, didn't do anything. The phone keeps reseting the bus and it's just recognized as a device without any communication ports.
I'm have some spare time & I will keep trying even the most crazy ideas. I don't think it's something so complex. I have a DD backup of some partitions by the way.
Peace.
I have restored a RAZR XT912 from such a state using the Linux omap_flash binary and a boot loader repair kit that includes the pbrdl.bin and brdl.bin needed to make the TI OMAP device be recognized by adb and then fast boot can flash the mbmloader.bin and mbm.bin.
These files are specific to the device and we have kits for the XT912, XT894, XT875 and XT862.
We do not have them for the XT910 unfortunately, and everything we know about them indicates they are hardware and boot loader revision specific files and not at all cross compatible. Given that you have no other choice and a completely bricked device, it may be worth considering trying the files anyway.
You seem very well versed in the techniques required and would have an excellent chance of success if it works at all.
You may want to use the mbmloader.bin and mbm.bin from available XML.zip firmware files that are current for your device as those will definitely be the right files for the phone rather than the XT912 versions. If you are lucky, the pbrdl.bin and brdl.bin maybe compatible and flash successfully.
The procedure is like that which you have attempted and much easier than trying uboot from sdcard, which would not work from my understanding.
You must have a factory cable though, to power the device directly and that initializes a timed event during which the TI OMAP device is presented to the usb interface.
You run lsusb to be sure its there and then quickly run the first command with omap_flash and then the subsequent commands with fast boot.
If you are successful you will see the boot loader come up after brdl.bin is flashed and then fast boot the mbmloader.bin and mbm.bin and reboot.
If you PM me I will send you links to the files.
Good luck! This should be very interesting, but I have my doubts that the RDL files will be compatible.
cellzealot said:
I have restored a RAZR XT912 from such a state using the Linux omap_flash binary and a boot loader repair kit that includes the pbrdl.bin and brdl.bin needed to make the TI OMAP device be recognized by adb and then fast boot can flash the mbmloader.bin and mbm.bin.
These files are specific to the device and we have kits for the XT912, XT894, XT875 and XT862.
We do not have them for the XT910 unfortunately, and everything we know about them indicates they are hardware and boot loader revision specific files and not at all cross compatible. Given that you have no other choice and a completely bricked device, it may be worth considering trying the files anyway.
You seem very well versed in the techniques required and would have an excellent chance of success if it works at all.
You may want to use the mbmloader.bin and mbm.bin from available XML.zip firmware files that are current for your device as those will definitely be the right files for the phone rather than the XT912 versions. If you are lucky, the pbrdl.bin and brdl.bin maybe compatible and flash successfully.
The procedure is like that which you have attempted and much easier than trying uboot from sdcard, which would not work from my understanding.
You must have a factory cable though, to power the device directly and that initializes a timed event during which the TI OMAP device is presented to the usb interface.
You run lsusb to be sure its there and then quickly run the first command with omap_flash and then the subsequent commands with fast boot.
If you are successful you will see the boot loader come up after brdl.bin is flashed and then fast boot the mbmloader.bin and mbm.bin and reboot.
If you PM me I will send you links to the files.
Good luck! This should be very interesting, but I have my doubts that the RDL files will be compatible.
Click to expand...
Click to collapse
Thanks a lot for your reply and the technical insights! I appreciate your effort.
:good:
Can you tell me the difference between those 2 files? brdl and pbrdl? Are those OMAP model specific?
Yesterday I was able to make omapflash in Windows recognize the device but I need the address of the mbmloader.bin and mbm.bin in the emmc. I think it's the only part missing in my puzzle. The omap4430, according to the specs, first looks for MLO and u-boot.bin when you turn it on. Is the cpu rom somehow modified to look for mbm and mbmloader, by motorola? Using a hex editor you can find the string "MLO" right in the beginning of "mbmloader_hs.bin" and "mbmloader_ns.bin". Does it mean anything related to this matter? I still don't know why motorola provides a secure and non-secure loaders with the firmware package of a phone that "theoretically" can't be unlocked.
I tried uart over the p2_stereo headphone port without success a couple minutes ago.
I will be looking for the service cable in case my battery drained bellow the specs for the flashing process.
Thanks for cellzealot and danifunker, for your replies and your time.
Peace.
PS: I searched for omap_flash binary for linux all over without success, let alone the source code, of course.
I think the OP has some good news to announce and will be posting up how he successfully repaired the bootloader on his XT910 using the files I sent him from the XT912 repair kit. This is very good news and will be very useful for other users with corrupt bootloader devices.
Thank you cellzealot, Once again a great contribution to the community from you !
Nice upload tutorial
Sent from my MZ601 using XDA Premium HD app
As is often the case with these things, many people had a hand in this solution and the files and methods came from various sources.
I think the number of people who manage to corrupt the bootloader is actually quite small, but it is nice to have the right tools and files to fix it if and when the situation arises.
The bootloader repair kit files themselves are Level 4 access Motorola internal files and the Linux binary was posted by a user in a thread on the Bionic XDA forum.
We originally received the level 4 repair kits in bare form without any instructions whatsoever nor the proper binaries to use, and we were rather confused as to what they were.
Being unfamiliar with the two critical components pbrdl.bin and brdl.bin, we assumed they were to be flashed in fastboot and the kits also included the allow_mbmloader_flashing_mbm.bin (which is not actually required to complete the procedure).
In light of all this and rampant rumors about an engineering bootloader that was unlockable, we very unwisely gave in to the temptation after examining them to imagine these were those secret files, and I quickly hosed a friend's Razr that he had lent me for testing GSM stuff on by writing the pbrdl.bin to the mbmloader partition with fastboot !
Fast forward months later after many attempts to recover the device with the Windows binaries and a set of instructions that we received after the fact, and finally the Linux binary surfaced in the Bionic thread and it all fell together.
The key is the Linux binary because the Win binaries and device interfaces are so glitchy. In 32bit Ubuntu everything just works and the timed event is just long enough to perform the required initial command with the omapflash-lnx binary that then allows adb and fastboot to do the rest.
So, as I said...many hands and many missteps later to arrive at success.
It's very gratifying that this can be applied to the XT910 as well and as I told the OP in PM, I would like to have him write up what he did in this case as it may differ somewhat from my experience.
I expect he will do that very shortly and we can post the files as well.
Good to know these files are applicable to RAZR XT910.
cellzealot said:
I think the OP has some good news to announce and will be posting up how he successfully repaired the bootloader on his XT910 using the files I sent him from the XT912 repair kit. This is very good news and will be very useful for other users with corrupt bootloader devices.
Click to expand...
Click to collapse
cellzealot, sorry for the delay and I didn`t forget the topic. Have been busy lately. I will update it later today.
Peace.
:good:
I created a specific topic on the "Development Section". Go take a look and leave some feedback if you like it.
Peace.
:good:
cellzealot said:
I have restored a RAZR XT912 from such a state using the Linux omap_flash binary and a boot loader repair kit that includes the pbrdl.bin and brdl.bin needed to make the TI OMAP device be recognized by adb and then fast boot can flash the mbmloader.bin and mbm.bin.
These files are specific to the device and we have kits for the XT912, XT894, XT875 and XT862.
We do not have them for the XT910 unfortunately, and everything we know about them indicates they are hardware and boot loader revision specific files and not at all cross compatible. Given that you have no other choice and a completely bricked device, it may be worth considering trying the files anyway.
You seem very well versed in the techniques required and would have an excellent chance of success if it works at all.
You may want to use the mbmloader.bin and mbm.bin from available XML.zip firmware files that are current for your device as those will definitely be the right files for the phone rather than the XT912 versions. If you are lucky, the pbrdl.bin and brdl.bin maybe compatible and flash successfully.
The procedure is like that which you have attempted and much easier than trying uboot from sdcard, which would not work from my understanding.
You must have a factory cable though, to power the device directly and that initializes a timed event during which the TI OMAP device is presented to the usb interface.
You run lsusb to be sure its there and then quickly run the first command with omap_flash and then the subsequent commands with fast boot.
If you are successful you will see the boot loader come up after brdl.bin is flashed and then fast boot the mbmloader.bin and mbm.bin and reboot.
If you PM me I will send you links to the files.
Good luck! This should be very interesting, but I have my doubts that the RDL files will be compatible.
Click to expand...
Click to collapse
cellzealot, I have a question here.
Would it be possible to use your repair kit for the XT912 to flash a new, freshly compiled mbmloader.bin in order to completely replace the locked Motorola bootloader with an unlocked version? I understand that the source for mbmloader.bin is available in the repo's -- I would think that it would be a simple matter to compile & package an unlocked version and use your low-level OMAP4 utility to flash it onto the phone, thereby replacing the locked bootloader with a new unlocked version.
Or is there an even lower-level bootloader embedded in the device that checks mbmloader.bin for security at boot time? If so, would it be possible to replace THAT lower-level bootloader with an unlocked version in similar fashion to what I described? I am pretty new to this, but to my way of thinking, there has to be a way to get around Motorola's cryptographic verification of succeeding bootloader stages.
I have an off-contract Verizon XT912, running 9.8.20-72_VZW_16, that I am using as a test-bed for a new ROM I want to develop that will contain native real-time RSA voice encryption built right into the image as a part of the kernel or using a kernel module; I need to get rid of Mororola's entire scheme of cascading locked bootloaders in order to have the freedom to do the development I want -- once I have it developed, I can later implement locking for security purposes in my own bootloader.
Do you see any way that what I described about replacing Motorola's locked bootloader(s) can be accomplished?
Thanks in advance for any help you may be able to offer!
xt862 (droid 3 Verizon) repair kit (pbrdl.bin and brdl.bin) pleeeeease
Hi dear Cellzealot,
You are my last hope to unbrick my xt862 which just repeatedly connects and disconnected via USB as OMAP4430 device. (what I can view via dmesg). Also it apparently responds on ./omapflash-lnx pbrdl.bin from razor repair kit by instantly stopping to connect-disconnect and leaving in disconnected state (i.e. no more usb device via dmesg or lsusb). Also above command returns "OK XXXX bytes sent" in command prompt (what is another indicator that hardware is alive and just waits for bootloader). But so far I have understood from your post - above files are specific for each device. I even contacted Motorolla US service centre but they refused me to provide above files saying they are not available publicly.
Thanks in advance,
With last hope,
Sergiy
PM sent with xt862 repair kit!
droid bionic bootloader repair kit
I tried repairing my bionic with the files I found on xda.. It boots to the AP fastboot screen but shows errors, cant flash with rsd lite. I would appreciate any help. thank you
pbrdl.bin for Defy (MB525)?
Hi Cellzealot and all,
I have a properly bricked Motorola Defy (MB525), which has a locked bootloader. Do you know if there's a signed pbrdl.bin (ie. USB 1st stage bootloader) in existence for this device? (I've tried sending it the droid file - it uploads OK but doesn't run).
Please could you point me in the right direction? Thanks!
(By the way, the Defy is an OMAP3630 device).
Related
First of all, ALL THE CREDITS go to CellZealot from TeamBlackHat !
This was only possible with the files that he provided!
I was just a simple "guinea pig" that killed a Razr testing theories about downgrading it back to Gingerbread ! :angel:
So lets, f.... do it.
<Warning> By continuing to read and deciding to start this procedure, YOU ARE ON YOUR OWN! I, CellZealot, TeamBlackHat & XDA-Developers WILL NOT be held responsible for any personal or material damage that might incur from the actions described here! That's your decision to go on, so deal with it! YOU ARE WARNED! <Warning>
Requirements:
- Stock ICS SBF fastboot firmware package. Google is your friend.
- a PC x86 computer with a usb port
- Linux operating system. (Ubuntu, Arch, Gentoo, Slackware, Debian, whatever distro you choose...)
- Linux O.S. knowledge. You must be familiar with the command prompt (Bash Shell) and the commands! That's up to you.
- This software package -> http://www.multiupload.nl/VL33M4I4A3
- The "fastboot" program from the Android SDK (latest version that you can find.)
- a software bricked Razr, that only shows itself as a "OMAP4430" device, under Win. "Device Manager", when plugged. Give it a try under a Windows computer, just to make sure.
- MicroUSB to USB cable. The one that came with your Razr.
- The Razr must be charge to the minimum required the bootloader to enable the flashing process. There are other ways to charge your phone without the stock charger. You can search here on XDA for it.
PS: The factory service cable, allows you to bypass the battery check, by allowing the Razr to receive 5v straight from the usb port. As per CellZealot explanation on third post.
Optional but HIGHLY RECOMMENDED !
- a Motorola Factory/Service Cable. You can build your own or buy one! I recommend buying from "TeamBlackHat" as they make high quality cables and adapters! If you prefer, you can just buy the adapter and use your own MicroUSB cable with it.
About the expected end result: your Razr in FastBoot mode, ready to be flashed with a stock firmware.
<Procedure>
- download the package "spyder_bl.7z" and unpack to a empty directory to avoid any confusion.
- you will end up with 3 files - "omapflash-lnx", "pbrdl.bin" & "brdl.bin"
- make the "omapflash-lnx" file executable
- plug the phone to pc and press the power button for 2 seconds, till it apears as a "Texas Instruments" device under the usb list (lsusb) or in the kernel log.
Now you must be quick and start typing in this order:
sudo ./omapflash-lnx pbrdl.bin
sudo ./fastboot flash brdl brdl.bin
You should get a "Okay" status on both of them.
Check your Razr screen and it shall be on "FastBoot AP Mode". From here, you can keep flashing on Linux or boot up Windows and use RSD, wich is more user friendly besides being GUI-Oriented.
Some facts about the 3 files: they are all "signed files" by Motorola, that's why it is safe to use. The OMAP4430 cpu on the Razr is factory programmed to only execute signed code, that's why we needed to find an exploit to execute unsigned code. Examples are the KExec, Boot Manager & Safestrat. All of them available here on XDA in their respective threads.
Peace.
:good:
PS: Do not thank me or my posts. This guide was only possible due to CellZealot support. You must thank him, if for some reason it helped you recover your phone. Copy that?
PS: Thanks also XDA-Developers for this amazing community!
EDIT: Corrected the part about the Factory Service Cable. It does not allow you to charge the Razr but rather supply the necessary juice for the phone to work without a minimum charge. Thanks again, CellZealot!!!
I've tried & failed to brick my phone~ It's now nearly impossible to brick this phone :good:
Just some notes from my journey,
pbrdl.bin only accept few commands... so no oem unlock
pbrdl.bin is 1st-loader for USB boot (mbmloader.bin is for NAND boot)
brdl.bin is just mbm.bin (motorola boot manager)
Thank you for the excellent writeup and for the recommendations for TBH Factory Cable/Adapters!
You are very welcome and congratulations on fixing your phone and being in a very exclusive club of users who have brought their devices back from the brink of the abyss...the truly bricked phone. Also big kudos for going to great lengths to research and attempt many complex means to fix a device you had broken yourself rather than returning it to your carrier under warranty. Your ultimate success is richly deserved.
A couple of points I wanted to clarify.
The Factory Cable/Adapter does not charge the device at all, but bypasses the battery and smart charging circuit altogether and powers the device directly by supplying +5v on pins 1 and 4. It will always power on the device no matter what state the battery is in or without a battery at all.
The other thing is that depending what the circumstances are that lead to the corrupt boot loader, restoring the device can be even easier and not require flashing the firmware.
In my case, I had specifically overwritten the mbmloader and as soon as I repaired that successfully the phone booted up perfectly fine and fully rooted with everything exactly as I had left it the night I hosed it!
cellzealot said:
Thank you for the excellent writeup and for the recommendations for TBH Factory Cable/Adapters!
You are very welcome and congratulations on fixing your phone and being in a very exclusive club of users who have brought their devices back from the brink of the abyss...the truly bricked phone. Also big kudos for going to great lengths to research and attempt many complex means to fix a device you had broken yourself rather than returning it to your carrier under warranty. Your ultimate success is richly deserved.
A couple of points I wanted to clarify.
The Factory Cable/Adapter does not charge the device at all, but bypasses the battery and smart charging circuit altogether and powers the device directly by supplying +5v on pins 1 and 4. It will always power on the device no matter what state the battery is in or without a battery at all.
The other thing is that depending what the circumstances are that lead to the corrupt boot loader, restoring the device can be even easier and not require flashing the firmware.
In my case, I had specifically overwritten the mbmloader and as soon as I repaired that successfully the phone booted up perfectly fine and fully rooted with everything exactly as I had left it the night I hosed it!
Click to expand...
Click to collapse
Thanks once again, my friend. Corrected as per your definition, the section about the FS Cable.
Peace.
:good:
Thank you for this valuable guide, it is a true unbricking solution for the RAZR. Some mirrors of the spyder_bl.7z file. Just in case
http://www.mediafire.com/?z5gp1ztvwj81qr4
http://www.4shared.com/archive/BtfH6ML8/spyder_bl.html
Sorry my english so bad
My droid razr can't to flash brdl.bin
Just show waiting device
How to fix it?
I'm has do all procedure...
Tq b4...
prue said:
Sorry my english so bad
My droid razr can't to flash brdl.bin
Just show waiting device
How to fix it?
I'm has do all procedure...
Tq b4...
Click to expand...
Click to collapse
Ehm...Why did you try this??? Have you read careful enough what this is about?? I'm pretty sure your problem can be solved much easier than this way. Depending on your problem you have with your device I suggest you to open up a new thread in general section (or Q&A Section) and ask for help. BUT:
Don't flash anything to your phone if you don't know exactly what you're doing!.
dtrail1 said:
Ehm...Why did you try this??? Have you read careful enough what this is about?? I'm pretty sure your problem can be solved much easier than this way. Depending on your problem you have with your device I suggest you to open up a new thread in general section (or Q&A Section) and ask for help. BUT:
Don't flash anything to your phone if you don't know exactly what you're doing!.
Click to expand...
Click to collapse
problem solved master
i'm forget to use latest version of fastboot
now mw droid razr has startup normaly
tq all...
but now get new problem device always on fastboot n show "recipe failed"
maybe you can help me 4 this case...
Have same problem with other omap device Huawei U9500 (OMAP4440), but your advice not working unfortunately.
After the message about sending a file, nothing happens, the phone to mode fastboot not pass.
Any advice?
Hi all! XT926 is here)
Tell me please can I restore bootloader on my xt926 through this method? Right now when i connect common usb cable to moto and type "lsusb" i see:
ID: 05c6:f006 Qualcomm, Inc.
But when I connect the cable on Windows, the device appears and disappears in the system (I can hear the sound) infinite time, until I remove the cable.
Hello everyone,
I've been tinkering with my kindle attempting to flash TWRP so I could flash other ROMs on my Kindle Fire HDX 7 (3rd generation) but I have seemed to soft brick the device after using unlock.bat from https://forum.xda-developers.com/kindle-fire-hdx/general/thor-unlocking-bootloader-firmware-t3463982/post70881555#post70881555
The unlock.bat was supposed to unlock my bootloader, but now the device won't power on. If I plug it into the windows a bunch of partitions appear and windows prompts me if I want to format the various drives. If I plug my kindle into Linux, the 7 (i think) partitions show folders various different system functions.
Someone wrote in a separate forum that it's possible to restore kindle if I using something called eMMC Raw tool, but didn't really give any clear instructions.
If anyone could help me recover my device, that would be greatly appreciated. Thank you.
For some reason I can't upload a picture of the various files in the partition.
Side note: could I theoretically put CM 12 or anything else on one of the partitions instead of the stock ROM?
Praxxer1 said:
Hello everyone,
I've been tinkering with my kindle attempting to flash TWRP so I could flash other ROMs on my Kindle Fire HDX 7 (3rd generation) but I have seemed to soft brick the device after using unlock.bat from https://forum.xda-developers.com/ki...r-firmware-t3463982/post70881555#post70881555
The unlock.bat was supposed to unlock my bootloader, but now the device won't power on. If I plug it into the windows a bunch of partitions appear and windows prompts me if I want to format the various drives. If I plug my kindle into Linux, the 7 (i think) partitions show folders various different system functions.
Someone wrote in a separate forum that it's possible to restore kindle if I using something called eMMC Raw tool, but didn't really give any clear instructions.
If anyone could help me recover my device, that would be greatly appreciated. Thank you.
Click to expand...
Click to collapse
Unlock.bat did not "soft brick" your device as the actions it performs are totally benign. More likely you got sloppy and flashed an incompatible aboot (via dd) or erased aboot and don't know how to recover. Me thinks it is the latter. Keep reading; you'll eventually stumble on posts that describe corrective actions. I will edit this post with a link as time permits.
You do not need "eMMC Raw Tool" whatever that is.
edit: https://forum.xda-developers.com/ki...ing-bootloader-firmware-t3463982/post75284993
Davey126 said:
Unlock.bat did not "soft brick" your device as the actions it performs are totally benign. More likely you got sloppy and flashed an incompatible aboot (via dd) or erased aboot and don't know how to recover. Me thinks it is the latter. Keep reading; you'll eventually stumble on posts that describe corrective actions. I will edit this post with a link as time permits.
You do not need "eMMC Raw Tool" whatever that is.
edit: https://forum.xda-developers.com/ki...ing-bootloader-firmware-t3463982/post75284993
Click to expand...
Click to collapse
Ah. I wish I had seen that thread before I started the process! You may be right about the compatible boot. I couldn't find the original aboot_vuln.mbn file mentioned in the thread I was following, but managed to find aboot.img file and flashed that hoping it was the same. I could have sworn though, that the device stopped working the second after I clicked the unlock.bat file (executed outside the fastboot screen), but could be wrong.
Only problem about the thread you linked, device isn't responding to any ADB or fastboot commands, but still shows that my PC recognizes the device as a fire device.
Thank you for your time, I'll keep reading through the thread you linked.
Praxxer1 said:
Only problem about the thread you linked, device isn't responding to any ADB or fastboot commands, but still shows that my PC recognizes the device as a fire device.
Click to expand...
Click to collapse
Likely a Windows driver issue. Suggest installing Motorola Device Manager here which includes composite USB drivers that work reliably with HDX devices. Need need to run MDM; just install it. After connecting the device you will need update the driver via Windows Device Manager. Bit of hit and miss with a non-functioning device. Cables and USB ports also play a huge role, especially with fussy bootloader/fastboot communications. Avoid external hubs, USB3 ports and add-on expansion cards. Change cables, ports, etc. Good luck.
Davey126 said:
Likely a Windows driver issue. Suggest installing Motorola Device Manager here which includes composite USB drivers that work reliably with HDX devices. Need need to run MDM; just install it. After connecting the device you will need update the driver via Windows Device Manager. Bit of hit and miss with a non-functioning device. Cables and USB ports also play a huge role, especially with fussy bootloader/fastboot communications. Avoid external hubs, USB3 ports and add-on expansion cards. Change cables, ports, etc. Good luck.
Click to expand...
Click to collapse
Thanks Davey, I'll definitely give it a try. Just as a bit more information on my situation, the device manager on windows does read Fire Device "ADB composite driver". I also have it connected to the PC using a Fastboot Cable. I will give all of this a try when I get home from work today.
If I am able to communicate with the device after installing the MDM drivers, should I attempt to restore the device? Or try to unlock and flash the stock ROM?
Praxxer1 said:
Thanks Davey, I'll definitely give it a try. Just as a bit more information on my situation, the device manager on windows does read Fire Device "ADB composite driver". I also have it connected to the PC using a Fastboot Cable. I will give all of this a try when I get home from work today.
If I am able to communicate with the device after installing the MDM drivers, should I attempt to restore the device? Or try to unlock and flash the stock ROM?
Click to expand...
Click to collapse
- dump the fastboot cable (all but useless on a HDX); this isn't a generic Android device
- ADB composite drivers come in many flavors; HDX bootloader only likes a few of them
- if/when you reestablish communication first step is to restore aboot and install TWRP; unlocking and ROM installation come later
- do not attempt to reinstall stock; frustration and heartache consume those who do
- again, this is not a run-of-the-mill Android gizmo; many of the tricks you learned in kindergarden do not apply to Amazon tablets
Davey126 said:
- dump the fastboot cable (all but useless on a HDX); this isn't a generic Android device
- ADB composite drivers come in many flavors; HDX bootloader only likes a few of them
- if/when you reestablish communication first step is to restore aboot and install TWRP; unlocking and ROM installation come later
- do not attempt to reinstall stock; frustration and heartache consume those who do
- again, this is not a run-of-the-mill Android gizmo; many of the tricks you learned in kindergarden do not apply to Amazon tablets
Click to expand...
Click to collapse
Lol I feel like I'm in kindergarten tinkering with this HDX. How do I restore aboot? clearly the image I flashed with was not the correct bootloader. Should I attempt to extract aboot from the stock ROM? Or would you be able to share you tool set/point me to a working link for aboot, TWRP, and ROMs (I've looked at 4 threads so far without working links)?
UPDATE: I managed to install the ADB MOT Composite driver, but still no response to simple ADB and Fastboot commands
Thanks again
Praxxer1 said:
Lol I feel like I'm in kindergarten tinkering with this HDX. How do I restore aboot? clearly the image I flashed with was not the correct bootloader. Should I attempt to extract aboot from the stock ROM? Or would you be able to share you tool set/point me to a working link for aboot, TWRP, and ROMs (I've looked at 4 threads so far without working links)?
UPDATE: I managed to install the ADB MOT Composite driver, but still no response to simple ADB and Fastboot commands
Thanks again
Click to expand...
Click to collapse
Not uncommon. Unfortunately, there is no 'fix script' moving forward as each situation is unique. If aboot is too damaged to support basic communication it's pretty much game over for the average laymen. You will need to comb the threads for information nuggets that may apply to your situation. Or cut your losses and move on. I am not big on trying to unbrick these pups unless one well versed in low level trouble shooting. Lousy ROI; has to be a labor of love including copious time researching, trying and (likely) failing. Good luck.
@draxie - for awareness; read back a few posts for context.
1-Click is your friend
Davey126 said:
Not uncommon. Unfortunately, there is no 'fix script' moving forward as each situation is unique. If aboot is too damaged to support basic communication it's pretty much game over for the average laymen. You will need to comb the threads for information nuggets that may apply to your situation. Or cut your losses and move on. I am not big on trying to unbrick these pups unless one well versed in low level trouble shooting. Lousy ROI; has to be a labor of love including copious time researching, trying and (likely) failing. Good luck.
@draxie - for awareness; read back a few posts for context.
Click to expand...
Click to collapse
Right... the symptoms described are the normal state of affairs
after 'fastboot erase aboot' and 'unlock.bat' does no such thing.
The post linked above and/or my original "Bulk mode" post both
have the necessary instructions to recover. Alternatively, 1-Click
can handle this, assuming access to either MacOS or Linux (for
the time being).
These tablets were sold with certain Vizio TVs in mid-2016 into 2017, primarily used for Smartcast to the TV.
They are now obsolete since Vizio released firmware for their TVs turning them into normal Smart TVs, requiring the owners of these TVs to get new remotes and the tablets stopped being useful for this function.
Here in 2019, one can buy these tablets, at the low price end, in working condition, for $25 (for the M series) to $40 (for the P series) shipped.
The specs are as follows:
XR6M10:
Snapdragon 410 1.2GHz quadcore APQ8016
2GB RAM
8GB Storage
1280x720 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
XR6P10:
Snapdragon 615 1.45GHz octocore APQ8039
2GB RAM
16GB Storage
1920x1080 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
Both tablets feature side-firing stereo speakers, a headphone jack, and NO cameras. The size of the tablet is comparable to the size of a Galaxy Note 9, give or take.
Both tablets came with Android 5.1.1, and OTA updates upgraded them to 6.0.1. There are ZERO available stock ROM files available for the tablets. I've tried sniffing the updater and they seem to go to a dead website.
The stock ROM is fairly clean, and only has the Vizio Smartcast app which needs disabling upon setting up. Aside from this, there is no other bloatware on the tablet to speak of after running a fine-tooth comb through the system apps. You get a clean and snappy tablet.
The problem:
There's no stock ROM file available, neither for Android 5.1.1 or for 6.0.1. Vizio does not have any sort of download for either on their site, nor did in the past. The updater checked a third-party website affiliated with Vizio to manage the tablet's updates, as it does with their TVs. Since the website is inert, it can be safely said that Vizio is no longer interested in their existence at all, especially since the warranty on every single one of these tablets is now up.
The tablet seems it can have the bootloader unlocked, the developer options has the toggle for that, but there's no way to get into fastboot. Holding VOL UP+DOWN+POWER at boot or sending the "adb reboot bootloader" command sends it into a "Qualcomm HS-USB QDLoader 9008" mode under USB. This, from what I understand, is behavior persistent with the locked bootloader, but I have no idea of how to get it out of this and just into fastboot. Stock recovery does not have a fastboot option either.
The desires list:
Have someone that knows the intricacies of the MSM8916 platform and the APQ8016/APQ8039 get their hands on these tablets
Get a ROM dump of both tablets in stock form so people with bricked tablets can flash them with it
Get Root (Patch level on the 6.0.1 stock ROM is from October 2016, shouldn't be hard)
Get the bootloader unlocked, somehow, and if not, figure a way to get something like Safestrap running on it if the out-of-the-box kernel allows for it
Custom ROMs? LineageOS would be sweet, especially with some of the tablet-specific fixes that have dropped in the past couple months overall.
so I ask: is there any interest in the freeing of these super cheap tablets? The price to spec ratio is not bad (once again, I got my 6M10 for $25 shipped, and the seller has like 7 more as of the time of this writing), and it doesn't seem like it would be all too hard to unlock the bootloader and get it rooted (at least, from my perspective, that of a novice in this specific hardware field). There are plenty of these in the wild in the hands of people that bought the TVs and plenty in the hands that bought them from ebay when the tablets became obsolete.
This link contains screenshots of CPU-Z and the About Tablet settings section from the tablet, uploaded to imgur. If anyone needs more information on this tablet that needs an app or adb command, I can make this happen.
Board Pic of the XR6M10, XR6P10 should be the same inside:
(click for larger image)
Update: I have temp root.
I have temp root!-the latest kingroot (NOT Kingoroot) APK seemed to have done the trick. I was able to fire up adaway and get the hosts file set up with adblocks to keep the thing safer.
The root is still temporary so it goes away after a reboot. The rooting process involves it doing the root process once, then rebooting, then failing, then you reboot once more, and then retry rooting from the app. From here, 80% of the time, it works and you're able to get temporary root for that boot session.
Once you're done with anything you need root for, you should reboot and then uninstall Kingroot, which you then need to deactivate the device administrator priveleges for, before it will allow you to cleanly uninstall it.
I also made a huge discovery that may turn out better for anyone that can help getting this thing properly rooted and the bootloader unlocked... it seems the file manager included in the stock ROM is v3.0.0 from Cyanogenmod 12.1.
This makes me think that the ROM creator either used that since it was opensource and readily available than come up with their own solution, or that this ROM has some cyanogenmod roots.
I also found this post from another Q&A thread in this section:
TheDrive said:
This device have made by Chinese/Indian company Borqs. The code name Bennu-M. Platform is Qualcomm APQ8016 (MSM8916 w/o modem). There should work standard method to bring EDL mode. Hold Vol+ and Vol- at power on (press power). Then connect to the PC. Thus device will stay look dead, however should be detected as Qualcomm QDLoader 9008 on the PC side. This is the factory described method.
You can flash factory firmware from this mode using external bootloader (programmer) for MSM8916 firehose protocol. This procedure is described in the thousands of manuals around the net. Qualcomm tools like QPST or QFIL can be used as good as many 3rd party utils to flash and manage any another available way. Many professional 'box' tools should support this device too but only as 'generic' msm8916 (if applicable).
However I can't find the firmware package for this device anywhere. You should ask and require the manufacturer/distributor to publish firmware, the source code and all the corresponding matherials to be able to flash and rebuild firmware from sources in any manner you want without any limitations as required by GNU/GPL free open source software licenses this firmware is obligated to.
Everyone who have the device working or software dead, can try to dump the current firmware and data, stored on the internal eMMC memory module in part(s) or in whole image using free QTools project utilities and suitable external bootloader with ability to dump eMMC, not only to flash as many factory supplied programmers do. There are programmer(s) for MSM8916 available in the project repo. Read and understand manuals carefully before trying anything!
There is definitely another ways to root, dump, flash, manage the device in any manner YOU WANT, not only the way you are "allowed" to use your own device by manufacturer/distributor. FTA!
You can root the device then dump all the multiple partition images manually (dd if=/dev/block/mmbblk0...... of=/sdcard/......) or using built custom recovery like CWM/TWRP for your device. Please note, kernel sources are important but not mandatory to build e.g. CWM. You can build one using CWM image from the similar device and the kernel (boot/recovery) image binaries from your device. There are good manuals and image repacking utils available around like e.g. AndImgTool.
There are the way to produce factory image from the eMMC/partitions dump(s). Use utils like R-Studio to dump particular partition images from the eMMC dump (it's like whole HDD or UFD image with all the sectors raw, one by one, w/o any modifications/compression/etc) Manuals / utils are avavailable to make e.g. sparse and xml scripts set which is flashable by the programmer in the EDL mode (i.e. from any damaged state, because EDL is built in to the PBL and masked to the internal CPU ROM, thus can not be damaged in any manner, except firing the CPU up).
You can also flash partition images from the more common Fastboot mode, unless eMMC GPT and bootloaders (SBL/RPM/TZ/ABoot) stay intact (logo showed). You can't dump from fastboot, which is common due to the (foolish) 'safety' requirements. It's security by obscurity and is definitely not for your favor, but for the corps control over you and force to send valuable private data to foreign clouds.
Please share eMMC full and/or partitions dumps using reliable 'neverending' file cloud/hosting since there is no factory firmware available yet (ever). I do not own this device and never seen being overseas, so I can't share.
Click to expand...
Click to collapse
This gives a little bit more information but seems to be more waffle than helpful. Still need someone, or some individuals, that can get one of these devices into their hands and work on a way to get the bootloader unlocked, the eMMC dumped, and ROMs going.
Update file?
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Sudosftw said:
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Click to expand...
Click to collapse
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Qiangong2 said:
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Click to expand...
Click to collapse
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Sudosftw said:
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Click to expand...
Click to collapse
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Qiangong2 said:
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Click to expand...
Click to collapse
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Sudosftw said:
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Click to expand...
Click to collapse
Hmmm. Which tablet do you have? The M or the P?
Qiangong2 said:
Hmmm. Which tablet do you have? The M or the P?
Click to expand...
Click to collapse
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Sudosftw said:
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Click to expand...
Click to collapse
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Qiangong2 said:
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Click to expand...
Click to collapse
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Sudosftw said:
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Click to expand...
Click to collapse
Hmmm. That's unusual. Are you running it in win 7 compatibility mode?
It would be nice to see community roms for these devices. I have the XR6P. If you need any info from this device, just tell me what to do.
I'm very interested in this as I have one of these tablets that I would like to use in my vehicle as a display for my piggyback ECU tuner. It doesn't currently support USB OTG, but I read that if I can gain root access I can add the file to give it USB Host functionality. Can anyone confirm this? I have tried several apps to get it rooted including Kingroot as you were able to get a temp root with that. Unfortunately Kingroot, as all the others I have tried, won't even install on the tablet. Again, I'm only looking to get this thing to be OTG capable. If anyone here has any suggestions, I would be very grateful! Thanks all!
I just bought an M remote to replace my broken P remote. My P remote had Android 6. My M remote has Android 5, and the OTA updater says there's no update. Any way to get Android 6 on this?
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
ALANCHONG said:
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
Click to expand...
Click to collapse
Hey. You can lay out the firmware for XR6M10
XR6M10 and XR6P10 firmware
konog said:
Hey. You can lay out the firmware for XR6M10
Click to expand...
Click to collapse
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
ALANCHONG said:
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
Click to expand...
Click to collapse
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
konog said:
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
Click to expand...
Click to collapse
Please check if the driver is installed
Hi
I just got a third LMX210 today to add to my collection. Lol really im just trying to solve a problem. I bought a ulma to replace cm and i came across a ulm model and decided to just replace my cm today. The problem is that all three of these phone which normally have easily unlockable bootloaders will not boot into fastboot. The fortune 2 will not even boot into recovery. They all will boot into a blank screen with the android robot and will boot into download mode.
The natural solution would be to install an older or even plain stock firmware. But say you dont have a windows 10 or Mac computer. I havent found a way to flash lg firmware using a linux distribution yet.
On the other phones i tried removing the laff partition to force the phone into fastboot by plugging into pc while holding the volume up button. This did nothing but repeat the logo until the button released.
Yes usb debugging was enabled and adb was used to try these procedures. The drones at lg know nothing and ask to send the phones in for repair.
Short of re-installing the stock firmware there has to be way to get past this. And to tell you the truth i dont have a way to flash the stock firmware so i dont even know if that will work.
Ok guys got any ideas?
Update.
Ok spent 4 hours on a windows pc today trying to flash firmware and install qcom drivers thinking the download errors were due to the drivers. Then at the last moments went to Tecknights page and downloaded and installed the lgup dual mode program.
So the bastitches of higher android office decided to screw everyone out of bootloader unlocking. The ARB numbers have recently (like in the past 3 months) been changed to 003. Meaning you cannot flash firmware with an ARB number lower than 003.
But that doesnt stop us completely. Two ideas initially popped into my head. Hex edit the .kdz so that the ARB number matches the phone. Or lol split the .kdz into its seperate partition images then wipe the partitions and use qdl or lgup to repair the now bricked phone. No device data no ARB no problem.
Im hoping the former works over the latter but ill keep you informed.
But really guys thats extreme and i cant see too many folks going through the wipe process to enable fastboot. So we have to find an easier way.
Is there any way to know what partition the ARB protection resides in? If those parts could be wiped im thinking it might fool the flashtool into thinking that there isnt any protection.
one of your devices is MTK isn't it? can't you use SP Flash Tool like for other Mediatek devices? you should be able to flash images to emmc_user with locked bootloader, for example boot, recovery, system, ... all you need is a correct scatter file (which you could create with WwR MTK)
So your saying finish porting my recovery and use sp flash tools to install it. See i have been curious about that procedure and how not having an unlocked bootloader would effect flAshing from recovery. I was thinking brick. But its worth a try if it wont brick and i get full Root with magisk. Ty
Btw when i was porting my recovery i ran into a rather large well too large problem. When i went repack using abdroid image studio which i have used in the past with out problem, it would not shrink the image back down even though i was only trading a few files. How do i fix that
start with readback boot / recovery. then try to unpack, so you will know the scatter is right (at least, for this partitions) or compare files with your already existing backup files
no problems here with unpacking/ repacking with AIK
IDEA:::: ok so for the Qcom boards i have a solution possibly. I know that the older software versions have working fastboot and recovery going and can be boot loader unlocked. That tells me that a fota uodate is screwing things up.
PROBLEM:::: ARB my fortune 2 will not let me install at all anything before ARB3.
ARB_location:::: bootloader
Solution:::: download and extract the stock .kdz for device with working features. Wipe parts bootloader and laf using qpst and reinstall. Solves two problems in one go. Allows fastboot and and bootloader unlock and future re-install of stock firmware
may work but remember your bootloader is locked and you need to by-pass this via testpoint (or at least previously enabled oem unlocking and don't lost these setting) otherwise sahara will fail
well it was an idea. I just did some fact checking and also looked at the files dumped from the .dz dump of the fortune 2 stock rom. PBL or primary bootloader cannot be removed or flashed according to a thread it is a pernanent installation.
But upon more reading i can flash my recovery and boot.img using qfil in qpst along witn every thing else. But i need to know wether qfil reads ARB info and if so where i can find it in the firmware so i dont flash that img but instead pull it from phone as is.
i would really like to know what the twitterpating deal is with these LMX210 phones. ok when i firsr got my fortune 2 i bought it for two reasons the rootability of the device and the fact that tje msm8937 board came pre-installed with otg software by default which in my eyes meant no more freaking computer to use adb.
Well it is all there the drivers the software. but guess what. it doesnt work. i have no idea whats stopping it all from working but even lsusb doesnt bring a twitch or hint of reading any thing over the usb.
does any one know how to fix this
Yo. There is definitely ways to flash on linux using virtual machines, wine etc to run windows apps but you got ahold of a windows box to use. IF it is in EDL mode (Qualcomm mode with a driver saying 9008 in it..) then there is still faith you can revive it. You will need the firmware dumped from someone then youll need to run a program creating XML files for the phones firmware parition files. Youll next need a firehose which is what they call the programmers for EDL that send through the commands and firmware in a low low level that these programs like LGUP just do not do yet (don't know why..... Im waiting for someone to program the LGUP dev version with an EDL mode using emmcdl along with a way to create XML files too. Who knows maybe it will happen if we bring it up enough. The hardest problem youll have is getting a proper emmc programmer for the phone. I can source a lot so if teknight doesnt have something to help with EDL just get ahold of me and ill see what I have and send you some stuff.
Man i have been trying to unbrick the LMX-210 CV1 devices since last year. Tek has nothing but supports the work in hope of finding a solution. I have a ton of fire hoses and saharas all of which have cost me nothing but frustration. I have almost every qpst made and have tried them all with my firehose and saharas. Thr only thing i havent done is pull the mbns off my phones and try them. Trust me system dumps are crap.
The only sign of life i came by was flashing an sd card with the gpt and then flashing each partition manually using ubuntu. In return i got the battery logo but thats it.
Would love to figure it out though
By the way I have been compiling kernels. I call it the jokerfish kernel. Its packed full of drivers and debugging features plus gpu idlers boosters and all those crazy fishy thIngs. Its got governors and wire guard. Otg support. Io schedulars and overclocks. Cpu hotplugging and fast charge.
Now i cant figure out how to get fast charge to work but its set up for msm-otg phy-msm-otg qpnp-smbcharger and smb135x.
All that and not a single panic to reboot in over a week and 1/2 which is how long its been compiled. I used tweaks from the dragonheart kernel source and ported them over and did a lil c++ magic.
It has kcal too but n0 app supports it. All kinds of media and sound codecs as well. You think it would be slow but my compiling and coding skills are as mad as me. Hahahaha.'
But dont Take my word for as the gentle over there on your couch. See that smile? Hes as happy as fish in a pond.
Just remember Duhjoker is in no way responsible for bricked devices so try it at the risk to yourself.
This particular fishy thingy works for msm8917 cv1 devices like aristo 2 and k8+ which have been tested by the madman himself.
If you like you could thank me but the permanent smiles on your faces will be just as loved.
lol so fast_charge is working on the kernel but you have to add a custom tunable to a kernel app to get it going. Just add the path
/sys/class/power_supply/usb/uevent
Then you will get a choice of values to manipulate
hi
the other day i tried to dd in a bootloader to add fastboot to my K8+ (2018) LMX210ULMA and wiped my preloader. The device uses an mt6750 chipset and i had made a back up so i have the approriate software to restore it, i even have the scatter file.
The problem is that there is no da_pl.bin file for lg phones to use sp flashtool, i have no download mode and no fastboot.
i have two pc`s one running ubuntu the other windows 7.
i would appreciate any help
any help at all
ok so ive found some versions of sp flash tool that are supposed to get around the authorization stuff and i have an auth file but i keep getting brom errors. the same one in fact. on linux ifs 0x00. ive been looking at and following the tutorials ivs made android rules and all kinds of things but i cant get it to flash. it started to befote i added the stuff in the tutorials. The red line would go acrross the bottom but now i just get the brom errots.
Thumb up for boldness... :good:
Now you have some interesting project there.
Keep us update if you manage to find out any solution.
No idea how to help but Good luck!
https://blog.hovatek.com/so-whats-all-this-talk-about-meditek-secure-boot-and-da-files/
https://ifindhub.com/download-mtk-secure-boot-da-loader-files-mtk-devices.html
ill get there eventually. I have been looking at all the config and ini files and i hate to say it but security might be essier than you think to overcome. just have to erase a few lines here and there and teplace some as needed. idk ty. Dont worry ill keep you guys posted
i really think sometime we over think and see past the easiest solutions. but what do i know im trying to flash an mtk preloader on an lg phone.
im actually trying to unbrick a few phones. two qc `s and the mtk. I kinda bricked one of my lmx210`s on purpose not thinking it would brick. well jokes on me.
Im have a couple questions maybe somebody can help with. In the past couple months on my journey through madness i have tried a few hindred different ways and more flashtools than you could imagine. So far nothing has worked but ive learned alot of theory.
so far though i know that the mtk board is in bootrom mode. We will get back to that as i have an idea....
ok on the qc boards we have the dreaded 9008 mode. I made some progress today. i wanted to see if the LMX210 could boot from SD card instead of the internal. I believe it can but im having trouble with what to do next. p
i used dd to flash the gpt on my sdcard then formatted the partitions to the proper filesystem. when i plugged it in to the usb it lit up but did not boot. But it lit up for the first time since bricking.
But it only lights up with usb plugged in. Add the batrery and it goes dead. It also doesnt show 9008 mode any more.
i went back and changed the boot and recovery images to reflect using the mmcblk system and now windows device manager can see it. But no boot. im wondering first if i might need a special boot loader to boit from sd and two if i might be able to use the same trick to get the mtk running
Some LG firmwares include some files for SPFT, like LGX240ARAT and LGX230HAT.
but do they work with MT6750? In LGX240ARAT there is a dll that mentions MT6755,
but not MT6750. Newer versions probably needed. Or maybe you could hack it. ??...
part of my problem is not knowing what scatter file to use. these phones have thier info all twaktup. the mtk gives several different board/chip types. like we have 6722, 6755, 6750, 6736 and so on. im pretty sure though its a 6750 board with 6755 chipset but do i use the scatter for the board or the chipset.
Ok idea!!
I can pick the phone up as bootrom mode on port in my ubuntu as /dev/ttyACM0.
That means i can write to it. How can i dd the preloader.bin to the right place on there
Duhjoker said:
Ok idea!!
I can pick the phone up as bootrom mode on port in my ubuntu as /dev/ttyACM0.
That means i can write to it. How can i dd the preloader.bin to the right place on there
Click to expand...
Click to collapse
As I don't know much about but have played a bit with these.
https://gitlab.com/zeroepoch/aftv2-tools
https://forum.xda-developers.com/hd...fire-hd-8-2018-downgrade-unlock-root-t3894256
And there is tools like eMMC Pro, etc. that might work too... ?
I think the m250 did answer to some handshake but there was some problems
because I didn't continue testing those py scripts...
I would try what I could read from it first. From those scatter files I guess that
preloader is on its own partition. The other one should start with partition table, pgpt .. ??
CXZa said:
As I don't know much about but have played a bit with these.
https://gitlab.com/zeroepoch/aftv2-tools
https://forum.xda-developers.com/hd...fire-hd-8-2018-downgrade-unlock-root-t3894256
And there is tools like eMMC Pro, etc. that might work too... ?
I think the m250 did answer to some handshake but there was some problems
because I didn't continue testing those py scripts...
I would try what I could read from it first. From those scatter files I guess that
preloader is on its own partition. The other one should start with partition table, pgpt .. ??
Click to expand...
Click to collapse
Hi,
If you can reach bootROM mode by pressing any of the volume keys while you connect the phone (Mediatek Inc. MT6627) you should be able write and read the EMMC with amonet.
The tool needs some modifications in order to make it work to MT6750. You can probably try with the mt6753 version which may work for MT6750:
https://github.com/Dinolek/amonet
For reference, use this commit:
https://github.com/R0rt1z2/amonet/commit/6b57d0a99f42739d3b3b2ce962b32ecb8fefd950
Contains all the stuff that needs to be edited in order to make it work for that phone
Regards!
Thank you i can give it a try. Its already in bootrom mode though and accepts the handshake. The problem is that the py command that flashes the preloader and stuff on it also wants to flash other stuff as well that i dont have or does not work with the board.
The py command needs to be modified to only flash the preloader, lk.bin, laf and twrp. If those items only could be flashed i could bring the rest of the device up using lgup
I have tried to modify the commands myself to include just those items but it errors. I dont know enough about the python language to be able to do it on my own.
Duhjoker said:
Thank you i can give it a try. Its already in bootrom mode though and accepts the handshake. The problem is that the py command that flashes the preloader and stuff on it also wants to flash other stuff as well that i dont have or does not work with the board.
The py command needs to be modified to only flash the preloader, lk.bin, laf and twrp. If those items only could be flashed i could bring the rest of the device up using lgup
I have tried to modify the commands myself to include just those items but it errors. I dont know enough about the python language to be able to do it on my own.
Click to expand...
Click to collapse
PM me if you need help editing the python script
Regards.
I really appreciate your offer for help. I was looking at the reference for porting and now that i can see the things that would need changing why not go ahead and unlock the bootloader while we are at it. We could save a ton of devices and at the same time give them th3 extra value of being able to twrp and root them.
I have been looking for some way to unLock the bootloader on these phones for days and though it will be some work being able to reflash the preloader AND unlock the bootloader which was my main intent when i bricked it would be worth the extra effort.
Rortiz2 said:
PM me if you need help editing the python script
Regards.
Click to expand...
Click to collapse
I couldnt post the main.py script in the pm but i can attach it here. Thank you so much.
Here is the raw preloader extracted using salt on my pc.
Ok so i went through your source code for the meizu m2 amonet to match it with source code for the mt6750 and i only had to change a couple things. Its pretty much identical to the commit you pointed me too.
As far as i can see your amonet should work just fine with the sp200/lm-x210ulma boards. I did add my .img files to the bin folder though.
Any way i keep getting errors.
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 501, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
During handling of the above exception, another exception occurred:
Rortiz2 said:
Hi,
Contains all the stuff that needs to be edited in order to make it work for that phone
Regards!
Click to expand...
Click to collapse
Hi,
Didn't continue experiments but now also @Duhjoker might be interested about this last new development...
[EXPLOIT] [BOOTLOADER] Mediatek based LG K10 2017 M250 bootloader secure boot bypass. by @OficerX
https://forum.xda-developers.com/lg-k10/how-to/exploit-mediatek-based-lg-k10-2017-m250-t4183545
MT6755 and MT6750 are essentially the same, MT6750 is cheaper and slower version of MT6755, these are compatible, you can use tools for 6755 on 6750.
Here (https://github.com/arturkow2000/lgk10exploit) you have tools that can help you flash preloader (write_boot0.py), these should work on your device.
Open config.py set BR_DEV_PATH to /dev/ttyACM0
then write: python write_boot0.py --brom path_to_your_preloader_bin
This is slow process, may take few minutes (you will see progress while flashing).