Hi Everyone,
Well I have an OBI SJ-1-5 SmartPhone which is not working now as I was trying to Flash a Stock ROM via SP Flash Tool.
I was trying to unlock the bootloader via "fastboot oem unlock" command in fastboot mode. The result was "ok". This device also has "allow bootloader to be unlocked" feature in developer options which was set to "on" while I was doing it. During the process of unlocking it shows some warning message that whole device would be reset, I agree and continue. After which it got stuck and I've to use "fastboot reboot" command, which result in continuous boot loop. Then i was not able to go into recovery or do anything.
I then do some google fu and found Stock ROM which aren't compatible to the device as it was showing the error "PMT has changed for the ROM". Which i sort out somehow. In the mean time I forget to unchecked the "Preloader" option, and unfortunately the new Stock ROM* has incompatible preloader with my Device. Resulting in a Complete Brick of my SmartPhone giving me "BROM ERROR: S_FT_ENABLE_DRAM_FAIL (0xFC0)" error both while doing "Format whole Flash" and "Format whole flash except Bootloader", even "Download" option gives me the same error.
Fortunately I have another pair of same Model so I thought to Dump the Stock ROM including the preloader files and Update my brick cellphone with it. I know the procedure of "Readback", so to grab the "scatter" file I used "MTKdroidTools" which again unfortunately unable to create the "root shell" for my device neither I was able to save the scatter file(the save button was disabled) because my device is MediaTek 6580 which is unsupported to use with "MTKdroidTools". My other cellphone is not Rooted and Rooting is the whole reason I now have a Brick Cellphone so I am not gonna take risk again doing something with that new device .
Which leave me the last option of Using a Hardware Device like "Magic Box" or "Volcano Box" to DUMP firmware. And that I don't have and neither I can somehow get my hands onto it.
But I "think" I can get my cellphone back to life if I would find a ROM of a device with Similar board id and Flash its ROM using (Format+Download). After that it would allow me to use "Auto Format except Bootloader". After which I could flash the ROM that was giving me (0xFC0) error (without ticking the preloader).
Details of SJ1-5
Chipset: MediaTek 6580
Root : No
Build Number : Obi_SJ1-5_B1B8_Ver3.6
Kernal Version : 3.10.72
Android Version : 5.1
Android Security Patch Level : 2016-01-01
*The ROM I tried : Obi_SJ1.5_MT6580_5.1_v1.7.1_151014_144940
I hope someone can provide me the DUMPed Stock ROM from a working Device. I would really appreciate that. And please let me know if there is any other Method that I missed. Sorry for my bad English.
Thank you all in Advance.
Same problem here. As always with mtk phones it is problematic and very risky to find working/compatable scatter and rom. Same story, flashed wrong preloader and now the phone in boot loop. Thinking to connect directly to a serial but i need a correct rom for a start. If anyone has a dumb of this phone please contact me at [email protected]
Related
Dear Esteemed XDA members,
I have spent literally days of testing and researching to try and unbrick my phone. Friends and family have seen my obsession with trying to fix this, some even offering to buy me a new phone!!!! But this ain't about money - this is about having control of my damn device!!! I'm usually pretty good with trying to solve this kind of stuff, but this time I'm truly stumped (and desperate, and obsessed!). I have come to the conclusion that it's directly related to ARM Trusted Firmware. Here are the details of my "journey" to date... please read it, and if you know how to fix it, please share!!! then I can get my life back!!!! Before I go any further, I am certain that my problem was initially triggered by doing an official update on a rooted phone. So to avoid experiencing the same problem I'm about to describe, it's best to unroot and relock your device before loading new official firmware.
I have a Huawei Honor 4x (Che2-UL00, with Kirin 620 chipset) with an unlocked bootloader. Recently, I tried to manually upgrade from Kitkat (emui3.0) to Lollipop (emui3.1), using the official update.app from huawei's website (image was good - I checked the hash). To load the update.app, I used the official huawei recovery. The progress bar went to roughly 90% and then hung. Upon restarting my phone, it went into rescue mode with the following error: Func NO : 15 (bl31 image) Error NO : 1 (security verify failed).
Interestingly, I looked closely at the fastboot.img files for kitkat Vs lollipop (I got the image files by using HuaweiUpdateExtractor). I noticed that only the lollipop fastboot image contains this error message text. Also, bl31 is related to ARM trusted firmware, for more info search for BL31 (Secure Monitor) on google, or see bl31_main.c in the Trusted Firmware source code. So it seems that the lollipop image is using the full ARM trusted firmware, an extra layer of security which is preventing the (unlocked) bootloader from allowing me to load into recovery. I think this is the core problem, and I think there is a way to solve it but I just don't have a deep enough understanding to get there. Below I'll explain each step I went though and provide some additional diagnostic info:
1. First step was to access recovery mode (Vol UP + power). This failed and resulted in same bl31 error message.
2. Second step was to try and update again using the three-button force update (Vol Up + Vol Down + Power). It vibrates once after a few seconds, and freezes with the logo screen with the red light flashing. As an experiment, I tried this without the SDCARD and noticed it vibrated almost instantly, which suggests that it does try to load something from the SDCARD when inserted. I didn't get any further in this mode.
3. Final step I tried was to load into fastboot (Vol Down + Power). This worked and I got into a special "Rescue&Fastboot" mode. First thing I tried was to manually downgrade to kitkat by flashing the kitkat images using the fastboot flash command. The images boot.img, system.img, recovery.img flashed successfully. cust.img simply failed. I desperately wanted to flash the kitkat fastboot.img which doesn't contain the trusted firmware bl31 image stuff, but fastboot replied: FAILED (remote: Command not allowed). In fact, many of the fastboot commands fail with this same error message, even though there is the "PHONE unlocked" writing in red on my phone screen. With the limited command set available (even fastboot oem device-info is not allowed!), here is the diagnostic info I was able to get:
a) fastboot oem check-rootinfo
(bootloader) old_stat: RISK
(bootloader) now_stat: SAFE
(bootloader) change_time: 1452356543
I think this change from RISK to SAFE is the core of my problem. the change_time is from several days ago when I attempted to update. I think it reflects the trusted firmware state (I'm guessing here, as I can't find documentation for these commands).
b) fastboot oem backdoor info
(bootloader) FB LockState: LOCKED
(bootloader) USER LockState: UNLOCKED
I think that FB LockState: LOCKED means that fastboot is locked (guessing again, can't find documentation!), which explains why many of the commands fail.
c) fastboot oem check-image
(bootloader) secure image verify successfully
I think this checks the recovery image, because when I flash a different recovery, this signature check fails
d) fastboot getvar rescue_phoneinfo
rescue_phoneinfo: Che2-UL00 V100R001CHNC00B365
This appears to be the ROM version at the time of purchase.
e) fastboot oem get-build-number
(bootloader): Che2-UL00 V100R001CHNC00B384
This actually corresponds to the build number of kitkat I was using just before the failed upgrade to lollipop.
f) fastboot oem relock mycode
FAILED (remote: root type not allowed).
I tried this just to see if it wold relock. I'm not sure what the error means, but I do not that this command failed with signature verify fail if i change the recovery image.
Here are the questions I want to ask:
1. Can I force the device to flash a new image? I can't get into recovery or have full access to fastboot commands due to the trusted firmware stuff. And as I mentioned earlier the three button trick fails with a freeze at the logo screen. It appears that I need to do this using a means other than fastboot. The only interface I have is Android Sooner ADB Interface. adb devices renders nothing. Only fastboot finds a device.
2. Can I somehow make the "security verify check" pass so that I don't get that bl31 error? I'm not sure exactly which images this bl31 thing is trying to verify! Perhaps some combination of images from the new lollipop stuff I tried to flash and the kitkat build I had running previously?
3. Can somehow disable all this Trusted Firmware stuff??
4. Any other suggestions???
This is driving me to the brink on insanity!!! Gotta figure it out!! Thanks for reading and trying to help!
Hi,
Did anyone solve this problem?
I'm facing the exact same situation.
Che2-UL00 too.
Thanks in advance!
prezident36 said:
Hi,
Did anyone solve this problem?
I'm facing the exact same situation.
Che2-UL00 too.
Thanks in advance!
Click to expand...
Click to collapse
I still find it hard to believe this problem absolutely cannot be solved. However, I took it to a Huawei service center and they weren't able to unbrick it either. They had to replace the mainboard, which seems like a complete waste. Cost around $50, so not the end of the world but still annoying.
Anyway, screw this whole "trusted firmware" rubbish. I'm the owner of the device, yet I'm not "trusted".
hello, i have exactly the same problem!
---------- Post added at 10:58 PM ---------- Previous post was at 10:41 PM ----------
Where do i get the replacement mainboard from?
Me too, upgrading kitkat to lollipop. Now facing that rescue error.
My Honor 4X is unlock bootloader and root before upgrading lollipop,
Hello everyone.
I have something fun for you : Someone gave me a phone (apparently bought on amazon to some dodgy reseller), and it appears to be some kind of chinese fake Goophone or something. I was asked to make the phone usable, because right now, no Play Store, Chinese apps, can't change the keyboard layout...
I've made an album with some pics, but I can't post it directly since this is a new xda account, so please go to the imgur website and add "/a/heFVk" to the address to check it out. You can notice the fake Iphone 6 id on the back, or the "32GB Space" in the parameters when actally there is only 1GB. I love it.
So here's my problem : There was no recovery, I tried to flash one (well, a lot actually) but the phone won't boot on it (if I try, it'll stay stuck on the splash screen 4G+ Volte, and I have to remove the battery to make the phone boot again).
If I try to go on the bootloader, I'll get a blackscreen with just a little red text "fastboot mode".
With the fastboot commands, I can detect the device, flash a recovery, reboot, but if I try "fastboot oem device-info" or "fastboot oem unlock", I only get 3 dots ("...") and nothing happens.
I don't have a device name (well, the brand and model are both "4G+", lulz) and I have absolutely no idea if I can / how to flash another rom on it.
Right now, the phone is still working, but is not usable (well, except if you are chinese with low standards I guess?)
If anyone got any ideas how to proceed to get the recovery working, and what kind of rom I could flash on the phone, that would be amazing.
Thanks in advance !
You have fastboot mode! Also, enable usb debugging in settings (check online for guides if you are not sure on how to do that). Check that adb recognizes your device and just sideload the apk. If that doesn't work, hop into fastboot, run fastboot oem unlock to unlock your bootloader and try flashing gapps. Good luck!
Basic device info
Model Number : PB1009
Android Version : 7.0
Kernel Version: 4.4.22
Build Number : PB1009_20170912
Hey so i need literally any way to root this tablet, ive been able to unlock the bootloader (easiest bootloader on the planet) but havent been able to find a compatable twrp.
i just need a custom recovery that will work or p much any root ideas, i would consider a full custom firmware as well.
i considered compiling a twrp but i dont know how i would get the source files for it...
Kenvarus said:
Basic device info
Model Number : PB1009
Android Version : 7.0
Kernel Version: 4.4.22
Build Number : PB1009_20170912
Hey so i need literally any way to root this tablet, ive been able to unlock the bootloader (easiest bootloader on the planet) but havent been able to find a compatable twrp.
i just need a custom recovery that will work or p much any root ideas, i would consider a full custom firmware as well.
i considered compiling a twrp but i dont know how i would get the source files for it...
Click to expand...
Click to collapse
how did you unlock bootloader and did you ever figure out how to root it? going through same thing now.
Kind of an old thread and old device now, but I own one myself (branded Packard Bell) and just figured this all out, so here goes:
Root
This one is really easy now thanks to a MediaTek flaw. Just go to https://github.com/JunioJsv/mtk-easy-su, download the latest release, install the APK on the device, and run it by opening the app and pressing the button in the lower-right corner (still works on this since the latest security patch level AFAIK is from 2017). Note that this gives root temporarily, so you will need to run it again after reboot if you want root again.
Bootloader Unlock
When Kenvarus said "easiest bootloader on the planet", I took a guess at the method and it worked:
Back up any important data on your tablet, as this will factory reset it.
Install ADB and Fastboot on your computer if they are not installed, including drivers. For Fastboot (as that can be tricky sometimes), it "just worked" for me and I think Windows used an Amazon driver I had installed for my KF2. YMMV.
If you haven't already, enable Development Settings by going to Settings->About tablet and tapping the build number 7 times.
Go to Settings->Developer options (switch them on if they're off) and enable the "OEM unlocking" toggle.
In the same menu, enable "USB debugging" if it is not enabled already.
Connect the tablet to your computer, confirming the authorization prompt that pops up if it wasn't connected before. Check whether the connection is good with the "adb devices" command if needed.
Run the command "adb reboot bootloader", this gave me a blank screen.
Use the "fastboot devices" command to make sure the Fastboot connection works.
Run the command "fastboot oem unlock".
Press Volume Up when the text-mode confirmation screen pops up on the tablet.
Once the unlock procedure is complete, reset the tablet. You should see text on your bootscreen saying "Orange State" and a factory reset on the first reboot if it worked.
WARNING: I highly recommend charging your battery to be at least 10-20% filled before doing this. I stupidly did this at 1% battery thinking "it's plugged in anyway" and had quite the time rebooting after unlocking the bootloader (I thought it was bricked for a good hour or so, only after walking away for 20 minutes to eat dinner did I see that the battery was now at 20% and I could boot the tablet).
After unlocking the bootloader and temp-rooting it with the above app, I was able to use Magisk to patch the boot image (using dd to shuttle the files to and from /dev/block/mmcblk0p10, use "strings saved_boot_partition_name|head -n1" and check for "ANDROID!" to make sure it's the right partition) and I now have persistent root after all these years (note that Direct Install in Magisk doesn't work here). I'd definitely be interested in a custom recovery and/or ROMs for this device, but I'm not holding my breath (I'd take a crack at it if I knew better how to do it, but I have near-zero experience with ROM development and so far have only recompiled existing ROMs for a few phones).
I buy a phone from Ebay, i flashed the phone with wrong rom's in Smart Phone Flash Tool. then i flashed the phone i check the Bootloader off. so i don't flash the preloader.
I searched around and i found close to the phone and it was MT6735M without error in Smart Phone Flash Tool. But the phone still does not boot up, without success.
I asked on this forum i another topics, he help me to get preloader.bin out of my phone, now i have the preloader.bin.
What the problem i can't found the right rom right now.
The name is: (GSM UNLOCKED 4G LTE 6.29" Waterdrop Screen Smart Phone Android 9 Fingerprint ID) from Ebay
i get confused:
Before i flash the Phone it says (MT6595)
I got booted it op in mode: and it says (MT6735)
The buyer says (MT6575)
WwR MTK says: CPU type: (MT6752)
Can some one help me with the right rom? i hope you also not get confused as i am. Tell me if you need more info about the topic.
Hi folks,
my trusty S3 (SM-T825) got broke unexpectedly. It showed "100% battery" in the morning but was unresponsive. A forced shutdown did reboot the device up to the logo-screen - from where it rebooted again. So obviously it's stuck in a boot loop.
Unfortunately, it does not enter "recovery" either (home) (up) (power). However, it DOES enter "ODIN mode" (home) (down) (power). There it shows me that FRP Lock and OEM lock both are still active. This is no wonder as it caught me unprepared. FRP lock wouldn't be a problem, as I'm the owner of the account and can supply credentials once it boots up again.
Everywhere it is STRONGLY advised to turn off OEM lock before flashing anything to not make it even worse. This renders the device essentially dead, right?
The device is still as original as it can be.
Any chance I can revive it or does that more look like a mainboard problem?
I already have ODIN and I even have an actual 4-part "Original ROM" for my region (Samfw.com_SM-T825_ATO_T825XXU3CTD1_fac.zip), but maybe TWRP and Lineage would be the better options.
Before I just go and make things worse, I'd like to ask for a qualified advice ;-)
smallfreak said:
...... There it shows me that FRP Lock and OEM lock both are still active. This is no wonder as it caught me unprepared. FRP lock wouldn't be a problem, as I'm the owner of the account and can supply credentials once it boots up again.
Everywhere it is STRONGLY advised to turn off OEM lock before flashing anything to not make it even worse. This renders the device essentially dead, right?
Click to expand...
Click to collapse
Afaik you should be able to flash stock with OEM lock active BUT idk if FRP will block flashing process.
If that happens it's imo afterwards in the same state as before so at least it won't worsen it.
Gonna loose all your data anyhow.
Got Smartswitch? This might help as well.
smallfreak said:
....... I already have ODIN and I even have an actual 4-part "Original ROM" for my region (Samfw.com_SM-T825_ATO_T825XXU3CTD1_fac.zip), but maybe TWRP and Lineage would be the better options.
Click to expand...
Click to collapse
You can't replace recovery without OEM unlock.
smallfreak said:
Before I just go and make things worse, I'd like to ask for a qualified advice ;-)
Click to expand...
Click to collapse
Dunno if I'm qualified enough
Next turn ...
I tried flashing TWRP into the AP slot with SamFW FRP-Tool (ODIN). This worked so far but got me a note on the tablet "custom recovery blocked due to FRP lock".
Checking boot on the tablet - as before. Boot loop.
Next turn ...
Code:
Select file AP_T825XXU3CTD1_CL17011592_QB30231355_REV00_user_low_ship_MULTI_CERT_meta_OS9.tar.md5
Select file CP_T825XXU3CTA1_CP14962504_CL17011592_QB28791445_REV00_user_low_ship_MULTI_CERT.tar.md5
Select file CSC_ATO_T825ATO3CTD1_CL18361310_QB30233690_REV00_user_low_ship_MULTI_CERT.tar.md5
Reading... OK
Detect mode: Download mode
Model : SM-T825
Bit : 4
Unique number : CBJ100915EAF124
Storage : 32
Vendor : SAMSUNG
Disk : BJNB4R
Firmware : https://samfw.com/firmware/SM-T825/
Analyze files...
Flashing with SAMSUNG Mobile USB Modem (COM5)
Flash failed
Flash time: 00:47
Reading... FAIL
unchecking CP and CSC, leaving only AP.
Code:
Analyze files...
Flashing with SAMSUNG Mobile USB Modem (COM5)
Flash failed
Flash time: 10:00
Reading... FAIL
Reboot tablet in download-mode, next turn: Try BL + AP:
Code:
Select file BL_T825XXU3CTD1_CL17011592_QB30231355_REV00_user_low_ship_MULTI_CERT.tar.md5
Reading... OK
Detect mode: Download mode
Model : SM-T825
Bit : 4
Unique number : CBJ100915EAF124
Storage : 32
Vendor : SAMSUNG
Disk : BJNB4R
Firmware : https://samfw.com/firmware/SM-T825/
Analyze files...
Flashing with SAMSUNG Mobile USB Modem (COM5)
Checking file BL_T825XXU3CTD1_CL17011592_QB30231355_REV00_user_low_ship_MULTI_CERT.tar.md5
Checking file AP_T825XXU3CTD1_CL17011592_QB30231355_REV00_user_low_ship_MULTI_CERT_meta_OS9.tar.md5
Flashing (1/20) emmc_appsboot.mbn.lz4 OK
Flashing (2/20) lksecapp.mbn.lz4 OK
Flashing (3/20) xbl.elf.lz4Flash failed
Flash time: 01:26
Tablet moans about
SW REV CHECK FAIL : [lksecapp] Fused -1 > Binary 0
Click to expand...
Click to collapse
So maybe the firmware revision is different to the currently installed one? The latest file is from 2020 and since I did the usual OTA updates, this should be the version installed. But even if not, it sould not matter to upload a newer one, right?
Anything I can check?
So then obviously "Game Over"
Another piece of expensive waste that otherwise could have served well for years to come. Yes I know, selling something just once is an inferior business model to repeatedly draining my account for the same service.