Related
Hi,
New NSS beta is available for download. It will implement installing and restoring
of the bootloader as single click solution. Although the Qcom loader could be
installed via normal flashing, it is much easier this way. Also recovery is intended
to save manual hex editing or cmd line commands.
1. Download the new version
2. Extract to a folder, start the program
3. Insert the 2 loaders in \loaders\special\wp7\ - the qualcom file: RM803_12w07_prod_generic_nokia_osbl.esco,
posted by xorizont here , second file: RM803_11w48_prod_raw_nokia_osbl.bin attached (unzip first)
4. Go to Flashing->WP7 Tools
You are ready to play. Quick description:
- Read PMM button - reads the PMM partition with Nokia specific values(product
code, MAC addresses, et), you can edit in the boxes
- Write PMM button - writes back to the partition a selected value (via Update
checkbox)
Install button - use this to quickly install Qcom loader on 710(no way to load on
800 as the cert is checked)
Parse FS button - you can use this to test NSS partition parser and compare
against 3rd party tool, to make sure something catastrophically wrong will not
happen during recovery
Restore button - This will attempt to recover the Nokia production loader (so called DLOAD)
via raw NAND write into partition 2 of the connected phone. Make
sure you start in Normal mode as NSS will need to check phone type and battery
value (to make sure wrong file is not written to 800, or if the battery is critically
low)
Please keep in mind, this is a Beta version, it has been tested only on one phone
and is possible to be a major phone killer, so thread lightly. It is offered as it is,
with the hope of being useful, and I can't be held responsible for fatal results.
My best recommendation is to check the partitions after write/recovery with
3rd party tool and make sure all is ok before restarting the phone power. All this
until some recovery method is found (if somebody has found flashing routines in
SECBOOT or other loader, pls PM me).
BR, Chris
Thanks for this nice tool!
I just wanted to stress that:
- Read PMM button - reads the PMM partition with Nokia specific values(product
code, MAC addresses, et), you can edit in the boxes
- Write PMM button - writes back to the partition a selected value (via Update
checkbox)
Click to expand...
Click to collapse
Are only possible when the phone has the qualcomm loader right? Because only then it's possible to overwrite the values using the NAND access mode (Qualcomm MSD).
Hi,
Yes, only in NAND mode, on phones that have it. If you have Nokia DLOAD loader
and not hacked phone, you can only read those value via JSON call to NCSD appl.
There isn't any method coded to change them in Normal mode(at least i did not
find one yet).
BR
Bph&co said:
Hi,
Yes, only in NAND mode, on phones that have it. If you have Nokia DLOAD loader
and not hacked phone, you can only read those value via JSON call to NCSD appl.
There isn't any method coded to change them in Normal mode(at least i did not
find one yet).
BR
Click to expand...
Click to collapse
It's good to see there is now a userfriendly way of doing stuff like this. Thanks again
now all we need is a tool to write an .nb file with one click. can one do it?
mariosraptor said:
now all we need is a tool to write an .nb file with one click. can one do it?
Click to expand...
Click to collapse
To be honest i have no idea how that exactly works - is there a need for a file
system parser and proper replacing of a file, or just writting to a const location
in the last partition.
The mount never worked on my Ubuntu install(and i am complete Linux newbie).
Bph&co said:
To be honest i have no idea how that exactly works - is there a need for a file
system parser and proper replacing of a file, or just writting to a const location
in the last partition.
The mount never worked on my Ubuntu install(and i am complete Linux newbie).
Click to expand...
Click to collapse
Thanks God. there is someone else like me in linux.( humor, no offense ofcourse ;-) )
mate i have no idea how it works. nobody wants to write a very accurate tutorial.
not being able to flash the custom rom was the reason that i reverted my bootloader.
To unlock bootloader I used to NCS and firmware posted by xorizont. So how make connection under Windows7 before flash xorizont's firmware if Nokia is in DLOAD mode?
this is very helpfull for many people to get to qulcomm on 710!
+1
So You are able to load Qualcomm B. via NSS even if on the moment I have got DLOAD?
Hi,
New Beta - 0.47.1 - with ability to write moded OS files(.nb).
OS File button - select .nb file
Write OS button - loads the file onto the last partition (change to OSBL mode first)
As with the previous beta - make sure you check the partion parser for errors.
Write will be verified, but not the exact write address, so maybe good to have a
look with WinHex before restarting the phone.
BR
Already a new version, you're working hard man! ;-)
So if i understand correctly, you have automated the process of 'block writing' (which without this tool requires using dd) the created custom roms to the correct partition on the Lumia?
Of course this requires Qualcomm bootloader; for the 710 your tool can load this even if the phone currently has the newer Nokia DLOAD.
Hi,
Yes, i work even in my sleep Right now killing myself with the baseband diss, but
decided to have a break and make this.
It seems the OsBuilder creates raw partition image, to fit exactly into the OS part
of the NAND chip. So all i do is open the usb device as physical disk, parse the
partition structure and do a low level read/write to absolute addresses.
Yes, it is mostly for 710, but write OS function should be working for 800 with
Qcom loader too, just can't test it as i don't have such phone.
Also the Install/Recovery should work forever on a 710, unless Nokia/MS release
some updated bootloader that somehow prevents loading of the signed Qcom
loader and the user does a full flash (or via sneak Zune update) and overwrite
the current DLOAD loader.
BR
Bph&co said:
Hi,
New Beta - 0.47.1 - with ability to write moded OS files(.nb).
OS File button - select .nb file
Write OS button - loads the file onto the last partition (change to OSBL mode first)
oh man you are a superstar. you did what i said it was missing. no more (hopefully) screwd phones.
@Mods please make this sticky.
Click to expand...
Click to collapse
Amazing tool!
I just used it to load Full Unlock Image for Lumia 710 by lucifer3006!
No more linux stuff needed, this is great and almost one-click windows solution!
Thank you!
When we talking about copy moded nb file into partition You mean sdx9 is default partition?
Hi,
The sdb thingi is something from Linux. On low level there are 4 primary partitions
in MBR, all the rest are logical, so the last entry in MBR points to the first logical one,
that for itself contains primary part and next one is logical as well. The last entry
in this linked list is the OS partition.
BR
1. OK I went through this. Tell me please how is possible to unlock bootloader if Lumia is in DLOAD mode? NSS can't reconized WP in this mode.
2. In case of relocking bootloader did I need copy Your specific RM803_11w48_prod_raw_nokia_osbl.bin or download an from navifirm?
I hope it's add backup and restore the "DPP.BIN" function!
like this!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Thank you very much!
djtonka said:
1. OK I went through this. Tell me please how is possible to unlock bootloader if Lumia is in DLOAD mode? NSS can't reconized WP in this mode.
2. In case of relocking bootloader did I need copy Your specific RM803_11w48_prod_raw_nokia_osbl.bin or download an from navifirm?
Click to expand...
Click to collapse
Hi,
1 - Maybe you have Zune running and NSS can't open the port ? Use the kill Zune
services option in NSS please
2 - Yes this specific loader is needed (its extract from an original file) and is hash
checked before writting to the second partition to prevent dead phones
BR
Without wasting anytime, I would straight go to the main topic.
P.S - Boot Logo NOT to be confused with Boot Animation.
P.P.S - This is for Samsung Devices only.
What is param.lfs?
Well, it is one of the files found in the stock firmware (tar.md5) file. Looks like it contains various images used by bootloader or kernel. (It may contain other functionalities also, but its what I can tell you because it is what I have understood by exploring it).
Where can I find param.lfs?
In stock firmware, just browse its contents using WinRAR or 7zip etc. It will look like :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is there inside param.lfs?
There are many jpg files which is used by bootloader. (Once you go through them, you will find relevance). It will look like :
How is param.lfs related to boot logo?
If you explore param.lfs, you will find a file called logo.jpg. Thats it, the BOOT LOGO.
Is Samsung showing its 'class' here again?
Well, in various other phones, the boot logo is present in the root folder of ramdisk, however, in this case, boot logo is compressed inside param in respective partition. Changing boot logo in other devices seems pretty easy, but in this case, the param block must be decompressed, then make necessary changes and then recompress it back.
But the good thing is that, images are present in simple jpg format in our case, but in others, they are in .rle format, which is needed to be converted to jpg for modification. It is obviously possible through certain tools.
About the boot logo changing utility, the main job was done by the OP of this thread. My job was to identify correct partition and make necessary changes in the script.
Installation :
1. Flash it using CWM v6.
2. Now reboot to recovery (option in Advanced Menu).
3. Once you reboot to recovery again, now perform normal reboot.
The zip file has stock image, so if you modify, mod that very image. The image must be of 240x320 resolution and of 72DPI. Also the file name must be logo.jpg
Download : Here
In case you mess up, you should be able to use button combos.
Will this work with SMP -900 Samsung Galaxy Note pro 12.2?
corphish said:
Without wasting anytime, I would straight go to the main topic.
P.S - Boot Logo NOT to be confused with Boot Animation.
P.P.S - This is for Samsung Devices only.
What is param.lfs?
Well, it is one of the files found in the stock firmware (tar.md5) file. Looks like it contains various images used by bootloader or kernel. (It may contain other functionalities also, but its what I can tell you because it is what I have understood by exploring it).
Where can I find param.lfs?
In stock firmware, just browse its contents using WinRAR or 7zip etc. It will look like :
What is there inside param.lfs?
There are many jpg files which is used by bootloader. (Once you go through them, you will find relevance). It will look like :
How is param.lfs related to boot logo?
If you explore param.lfs, you will find a file called logo.jpg. Thats it, the BOOT LOGO.
Is Samsung showing its 'class' here again?
Well, in various other phones, the boot logo is present in the root folder of ramdisk, however, in this case, boot logo is compressed inside param in respective partition. Changing boot logo in other devices seems pretty easy, but in this case, the param block must be decompressed, then make necessary changes and then recompress it back.
But the good thing is that, images are present in simple jpg format in our case, but in others, they are in .rle format, which is needed to be converted to jpg for modification. It is obviously possible through certain tools.
About the boot logo changing utility, the main job was done by the OP of this thread. My job was to identify correct partition and make necessary changes in the script.
Installation :
1. Flash it using CWM v6.
2. Now reboot to recovery (option in Advanced Menu).
3. Once you reboot to recovery again, now perform normal reboot.
The zip file has stock image, so if you modify, mod that very image. The image must be of 240x320 resolution and of 72DPI. Also the file name must be logo.jpg
Download : Here
In case you mess up, you should be able to use button combos.
Click to expand...
Click to collapse
Will this work with Samsung galaxy note pro 12.2 ?
corphish said:
Without wasting anytime, I would straight go to the main topic.
P.S - Boot Logo NOT to be confused with Boot Animation.
P.P.S - This is for Samsung Devices only.
What is param.lfs?
Well, it is one of the files found in the stock firmware (tar.md5) file. Looks like it contains various images used by bootloader or kernel. (It may contain other functionalities also, but its what I can tell you because it is what I have understood by exploring it).
Where can I find param.lfs?
In stock firmware, just browse its contents using WinRAR or 7zip etc. It will look like :
What is there inside param.lfs?
There are many jpg files which is used by bootloader. (Once you go through them, you will find relevance). It will look like :
How is param.lfs related to boot logo?
If you explore param.lfs, you will find a file called logo.jpg. Thats it, the BOOT LOGO.
Is Samsung showing its 'class' here again?
Well, in various other phones, the boot logo is present in the root folder of ramdisk, however, in this case, boot logo is compressed inside param in respective partition. Changing boot logo in other devices seems pretty easy, but in this case, the param block must be decompressed, then make necessary changes and then recompress it back.
But the good thing is that, images are present in simple jpg format in our case, but in others, they are in .rle format, which is needed to be converted to jpg for modification. It is obviously possible through certain tools.
About the boot logo changing utility, the main job was done by the OP of this thread. My job was to identify correct partition and make necessary changes in the script.
Installation :
1. Flash it using CWM v6.
2. Now reboot to recovery (option in Advanced Menu).
3. Once you reboot to recovery again, now perform normal reboot.
The zip file has stock image, so if you modify, mod that very image. The image must be of 240x320 resolution and of 72DPI. Also the file name must be logo.jpg
Download : Here
In case you mess up, you should be able to use button combos.
Click to expand...
Click to collapse
Thanks for the help it did really worked on my samsung Galaxy Star Duos. :laugh::laugh::good:
But as I'm new to these forum so I don't know how to donate. can suggest me how to dontate so that I can donate you .
May I use this zip for my experiment on S5 Snapdragon and S4
Can't work on s5 snapdragon,I can't find any .ifs file in the stock firmware
Sorry for my bad English.
cwyj said:
Can't work on s5 snapdragon,I can't find any .ifs file in the stock firmware
Sorry for my bad English.
Click to expand...
Click to collapse
Snapdragon use splash.img which is easiest to edit than others ???
Hi. Got my A40 rooted and wasen't happy about the look of the boot logo & warning text, so I did some changes to it.
WARNING:
THIS WILL TRIP KNOX SO DON'T FLASH UNLESS YOU KNOW WHAT YOU'RE DOING.
THIS IS MEANT FOR USERS THAT UNLOCKED BOOTLOADER AND GOT KNOX WARRANTY BIT BLOWN ALREADY
UPDATE, TWRP METHOD
----------------------------------------------------------------------------------------------------------------------------------------------
Now with warning (booting_warning.jpg) completly removed so that we can use full screen custom logos.
1/ Flash "View attachment A405-red_warn_remover.zip".
2/ Reboot to recovery.
3/ Flash "View attachment A405_logo_leafes.zip"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
----------------------------------------------------------------------------------------------------------------------------------------------
Wanna make your own logo mod?
Make sure that the images you're doing has the same characteristics as the original files.
Raplace the images in "A405_logo_leafes.zip" and rename the zip to whatever fits.
Edit the "ui_print" in the update-binary if you wish, but please keep the credit to @moluntic for this awesome script.
(Original thread):[Tutorial][Boot Logo Changer]
read the info there as you can easily brick your phone if it's done wrong.
Remember that param partition acts as an image cache for bootloader and is indeed part of the bootloader partitions.
With that said, please don't share files unless you've tested it yourself first.
----------------------------------------------------------------------------------------------------------------------------------------------
OLDER METHOD:
Original ---> Changed to:
Original---> Changed to:
This blacked out so that it won't show on the black logo background.
Unzip View attachment SM-A405FN-param_mod.tar.zip and put the tar.md5 in AP slot in Odin. Connect phone in download mode and start flash.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Hi
To flash this do we need to reset/wipe after? I spent already too much time customizing this device, don't wanna do everything all over again
The warning that warns about booloader and asks to press power couldn't also be blackened or even replaced it with something nicer ((maybe text in black "Custom firmware initializing" ))? If I don't press power device continues boot anyway after a few seconds.
Can you give any tips, or any special care when creating/modified bootlogo? Or, if you have time to make more versions it will be appreciated
Many thanks.
Please do for TWRP
Got no feedback, so I decided to create my own bootlogo and sucessfully flashed it using Odin.
Even put the Magisk logo on it :laugh:
A quick how-to using Windows:
You know the drill, if you manage to damage your device when doing this, it's your own fault!
1. Download the firmware for your device from your preferred server (samfrew updato , select region, version), alternatively jump to the end for faster approach, but you may need knowledge described in next steps anyway
2. Have installed 7zs
3. Right-click the firmware file > 7Zip ZS > Open Archive > then double-click (dc) file that starts "BL.." > again dc param.bin.lz4 > again dc param.bin > extract all files
4. Files to customize are:
booting_warning.jpg
logo.jpg
svb_orange.jpg
Use favorite image editor (Paint works!)
Make sure you keep the default resolution and do not create much bigger files than the originals, a little bit smaller or bigger it's okay, but not too much.
5. Again using 7zs create a tar archive format with the files you edited and the rest you have extracted before, name the archive param.bin (literal, NOT param.bin.tar)
(7Zip ZS > Add to Archive > Archive Format: tar > Archive (name): param.bin)
6. And then again, create another tar file with the param.bin in it (archive name may be anything)
7. Using Odin, load the tar file you created on the previous step to the AP slot, connect the phone in download mode and flash
Alternatively, to save data and time download bootlogo mod from first post, just extract files, edit and repack again using similar manner as described above
(in the end you should have a file with tar extension instead of MD5 because archive does not have MD5 checksum attached, so Odin will not check data integrity)
I tried to load file but says error binary is invalid
Sparko612 said:
I tried to load file but says error binary is invalid
Click to expand...
Click to collapse
What are you trying to do? Flashing bootlogo mod from first post or creating your own?
pomaxa said:
Please do for TWRP
Click to expand...
Click to collapse
I've been working some more on this "project" and twrp flashable is working. I will upload tomorrow hopefully.
I managed to remove the black warning as well so that we can have full screen custom logos, like this:
There will be two zip's to flash the first time.
One with stock param, but witout the "red warning" and one zip to finally change the logo / svb_orange by unpacking param in device and replace the images inside.
This will be easier, as we from there on only have to replace two images in a zip to get new flashable logo.
Have already done
pomaxa said:
Have already done
Click to expand...
Click to collapse
Guess I was late then
Anyway, I've updated OP with new method, files and instructions.
tys0n said:
I managed to remove the black warning as well so that we can have full screen custom logos, like this:
View attachment 4846485 View attachment 4846487
Click to expand...
Click to collapse
Couldn't we had 'fullscreen custom logos' before?
Why did you choose to leave the message of the "svb_orange"? We all know bootloader is unlocked, message is useless and undesirable since boot continues anyway after a few secs (no need to press power).
Anyway, that's what I've done on mine, replaced it with a nice screen, acting as second (boot)logo.
Tony il Capo said:
Couldn't we had 'fullscreen custom logos' before?
Why did you choose to leave the message of the "svb_orange"? We all know bootloader is unlocked, message is useless and undesirable since boot continues anyway after a few secs (no need to press power).
Anyway, that's what I've done on mine, replaced it with a nice screen, acting as second (boot)logo.
Click to expand...
Click to collapse
That message doesn't really bother me so I just kept it.
We could have used full screen, but it would have looked like this cause the image is still there, just blacked out.
tys0n said:
We could have used full screen, but it would have looked like this cause the image is still there, just blacked out.
View attachment 4847521
Click to expand...
Click to collapse
Yes, of course, I forgot that it just gets overlayed on top of logo image, because my logo is mainly black and booting_warning is black too, it's there but invisible.
Tony il Capo said:
What are you trying to do? Flashing bootlogo mod from first post or creating your own?
Click to expand...
Click to collapse
Sorry I was trying to flash mod from first post
Thanks
Sent from my SM-A305GT using XDA Labs
Tony il Capo said:
Got no feedback, so I decided to create my own bootlogo and sucessfully flashed it using Odin.
Even put the Magisk logo on it :laugh:
A quick how-to using Windows:
You know the drill, if you manage to damage your device when doing this, it's your own fault!
1. Download the firmware for your device from your preferred server (samfrew updato , select region, version), alternatively jump to the end for faster approach, but you may need knowledge described in next steps anyway
2. Have installed 7zs
3. Right-click the firmware file > 7Zip ZS > Open Archive > then double-click (dc) file that starts "BL.." > again dc param.bin.lz4 > again dc param.bin > extract all files
4. Files to customize are:
booting_warning.jpg
logo.jpg
svb_orange.jpg
Use favorite image editor (Paint works!)
Make sure you keep the default resolution and do not create much bigger files than the originals, a little bit smaller or bigger it's okay, but not too much.
5. Again using 7zs create a tar archive format with the files you edited and the rest you have extracted before, name the archive param.bin (literal, NOT param.bin.tar)
(7Zip ZS > Add to Archive > Archive Format: tar > Archive (name): param.bin)
6. And then again, create another tar file with the param.bin in it (archive name may be anything)
7. Using Odin, load the tar file you created on the previous step to the AP slot, connect the phone in download mode and flash
Alternatively, to save data and time download bootlogo mod from first post, just extract files, edit and repack again using similar manner as described above
(in the end you should have a file with tar extension instead of MD5 because archive does not have MD5 checksum attached, so Odin will not check data integrity)
Click to expand...
Click to collapse
Thank you Bro !!
It works like a charm.
Very happy with this mod
Fred.
i know how to make it work with Odin but i was wondering if with the stock recovery it's possible to sign an update.zip containing this mod....
i tried an old zip signer with no luck ( probably it was with an old Android version).
tys0n said:
OLDER METHOD:
View attachment 4790669 Original ---> Changed to: View attachment 4790670
View attachment 4790672 Original---> Changed to: View attachment 4790673
View attachment 4790671
This blacked out so that it won't show on the black logo background.
Unzip View attachment 4790675 and put the tar.md5 in AP slot in Odin. Connect phone in download mode and start flash.
Click to expand...
Click to collapse
Hello. I installed this patch last july (release without leaves):
- is that version (no-leaves) still available / usable with ASJ firmware ?
- in general, how could I revert mod to the original ? Flashing full stock firmware doesn't affect bootloader area, it seems
I don't have TWRP so I'm talking about Odin releases
Thanks a lot for your work
tys0n said:
[...]
Click to expand...
Click to collapse
Hi tys0n, nice work!! Could that procedure (or something similar) also work for a A70 (SM-705FN/DS) with TWRP?
Swordfishx86 said:
Hi tys0n, nice work!! Could that procedure (or something similar) also work for a A70 (SM-705FN/DS) with TWRP?
Click to expand...
Click to collapse
Twrp with an update.zip style
Or flash with Odin
Perhaps files and directories are différents...
Envoyé de mon SM-A405FN en utilisant Tapatalk
fredapied said:
Perhaps files and directories are différents...
Click to expand...
Click to collapse
There is no param.bin in the BL-file of A70s firmware ...
I am trying to Flash my OPPO A5S CPH1909 To Downgrade ColorOS. The new ColorOS security patch removed my ROOT and now I'm troubling to root my phone again. I am trying to FLASH ROM to downgrade My ColorOS.
1ST I was download Lower Version ColorOS then try to Install it using recovery mode but phone says you are trying to install older version.
THEN
I was download ROM(FLASH FILE) and MSM DOWNLOAD TOOL v4 but this flashing tool not detect any ports - I'm stuck here now
I'm Using :-
Windows 10 Enterprise LTSC
MSI Gaming Pro Motherboard
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
theRiyazSaifi said:
I am trying to Flash my OPPO A5S CPH1909 To Downgrade ColorOS. The new ColorOS security patch removed my ROOT and now I'm troubling to root my phone again. I am trying to FLASH ROM to downgrade My ColorOS.
1ST I was download Lower Version ColorOS then try to Install it using recovery mode but phone says you are trying to install older version.
THEN
I was download ROM(FLASH FILE) and MSM DOWNLOAD TOOL v4 but this flashing tool not detect any ports - I'm stuck here now
I'm Using :-
Windows 10 Enterprise LTSC
MSI Gaming Pro Motherboard
Click to expand...
Click to collapse
I've faced a similar problem an this is how i solved it .DOWNGARDED FROM A.41 FIRMWARE TO A.34
download:
1) sp flash tool
2)oppo A5S firmware (should be software flashable not OTA ZIP)
3) oppo opf file extractor
4) oppo DAA&SLA BYPASS TOOL
5)MEDIATEK DRIVERS
6)oppo a5s da file
7)python
Battery should be sufficiently charged .
in the downloaded firmware extract the big file with the .opf extension using oppo opf extractor, make sure you select your phone type as mtk to get firmware with scatter file.
install python and run the bat file in the oppo DAA&SLA BYPASS TOOL folder this will diasble security allowing you to use custom DA.Assuming you have installed mediatek device drivers the python program will connect to your phone but you have to switch it off first.
Press both volume butttons at the same time and connect it to pc
once the program has ran succsessfully close the window. DO NOT DISSCONECT THE PHONE FROM PC
OPEN sp flashtool and the device manager loader the scatter file from the firmware you extracted and the custom da. use DOWNLOAD OPTION untick the FOLLOWING file to prevent errors while flashing "opporeserve2".
check in device manager the comport to which the phone is connected in the options tab of the sp flash tool open and click on connection adjust the comport N.O to the one of the phone
press start to begin flashing and wait for the process to finish
NB: FIRMWARE CAN BE FOUND VIA GOOLE
DAA&SLA BYPASS TOOL
-https://romprovider.com/bypass-daa-sla-protection-oppo/
oppo opf file extractor
-https://www.martview-forum.com/threads/ofp-file-extractor-without-any-device.39292/(FILE requires registration its free also turn off antivirus)
sp flashtool and da file
-https://mega.nz/file/otAiUL6I#47l3iSgfWhMv-Iq1SygVsPZhDdbRPaeMHCobCqV2gXg
tutorial for reference
A)how to flash the phone
-https://www.youtube.com/watch?v=PMZYmszOcN0
-https://www.youtube.com/watch?v=cnqDxfvEnaA
B)how to extract firmware
-https://www.youtube.com/watch?v=qoK-K4XwlVM&t=0s
DISCLAIMER:you do this at your own risk AM NOT RESPONSIBLE IF YOU BRICK YOUR PHONE.
open the above links and understand every thing and watch all videos closely FOR BEST RESULTS
GOODLUCK
sammy_craig35 said:
I've faced a similar problem an this is how i solved it .DOWNGARDED FROM A.41 FIRMWARE TO A.34
download:
1) sp flash tool
2)oppo A5S firmware (should be software flashable not OTA ZIP)
3) oppo opf file extractor
4) oppo DAA&SLA BYPASS TOOL
5)MEDIATEK DRIVERS
6)oppo a5s da file
7)python
Battery should be sufficiently charged .
in the downloaded firmware extract the big file with the .opf extension using oppo opf extractor, make sure you select your phone type as mtk to get firmware with scatter file.
install python and run the bat file in the oppo DAA&SLA BYPASS TOOL folder this will diasble security allowing you to use custom DA.Assuming you have installed mediatek device drivers the python program will connect to your phone but you have to switch it off first.
Press both volume butttons at the same time and connect it to pc
once the program has ran succsessfully close the window. DO NOT DISSCONECT THE PHONE FROM PC
OPEN sp flashtool and the device manager loader the scatter file from the firmware you extracted and the custom da. use DOWNLOAD OPTION untick the FOLLOWING file to prevent errors while flashing "opporeserve2".
check in device manager the comport to which the phone is connected in the options tab of the sp flash tool open and click on connection adjust the comport N.O to the one of the phone
press start to begin flashing and wait for the process to finish
NB: FIRMWARE CAN BE FOUND VIA GOOLE
DAA&SLA BYPASS TOOL
-https://romprovider.com/bypass-daa-sla-protection-oppo/
oppo opf file extractor
-https://www.martview-forum.com/threads/ofp-file-extractor-without-any-device.39292/(FILE requires registration its free also turn off antivirus)
sp flashtool and da file
-https://mega.nz/file/otAiUL6I#47l3iSgfWhMv-Iq1SygVsPZhDdbRPaeMHCobCqV2gXg
tutorial for reference
A)how to flash the phone
-https://www.youtube.com/watch?v=PMZYmszOcN0
-https://www.youtube.com/watch?v=cnqDxfvEnaA
B)how to extract firmware
-https://www.youtube.com/watch?v=qoK-K4XwlVM&t=0s
DISCLAIMER:you do this at your own risk AM NOT RESPONSIBLE IF YOU BRICK YOUR PHONE.
open the above links and understand every thing and watch all videos closely FOR BEST RESULTS
GOODLUCK
Click to expand...
Click to collapse
Do you have any ideas to unlock bootloader of this phone
Thago said:
Do you have any ideas to unlock bootloader of this phone
Click to expand...
Click to collapse
I posted and tagged you in the other thread on how to unlock the phone
Do you have any idea on how to patch the boot image with magisk?
theRiyazSaifi said:
Încerc să-mi flash OPPO A5S CPH1909 pentru a downgrade ColorOS. Noul patch de securitate ColorOS mi-a eliminat ROOT și acum îmi fac probleme să-mi rootez telefonul din nou. Încerc să FLASH ROM-ul pentru a downgrade My ColorOS.
În primul rând, am descărcat versiunea inferioară ColorOS, apoi am încercat să o instalez folosind modul de recuperare, dar telefonul spune că încercați să instalați o versiune mai veche.
APOI
Am descărcat ROM(FLASH FILE) și MSM DOWNLOAD TOOL v4, dar acest instrument intermitent nu detectează niciun port - am rămas blocat aici acum
Eu folosesc :-
Windows 10 Enterprise LTSC
Placa de baza MSI Gaming Pro
Click to expand...
Click to collapse
Hi, where did you get the login and password from msm tools?
sammy_craig35 said:
I've faced a similar problem an this is how i solved it .DOWNGARDED FROM A.41 FIRMWARE TO A.34
download:
1) sp flash tool
2)oppo A5S firmware (should be software flashable not OTA ZIP)
3) oppo opf file extractor
4) oppo DAA&SLA BYPASS TOOL
5)MEDIATEK DRIVERS
6)oppo a5s da file
7)python
Battery should be sufficiently charged .
in the downloaded firmware extract the big file with the .opf extension using oppo opf extractor, make sure you select your phone type as mtk to get firmware with scatter file.
install python and run the bat file in the oppo DAA&SLA BYPASS TOOL folder this will diasble security allowing you to use custom DA.Assuming you have installed mediatek device drivers the python program will connect to your phone but you have to switch it off first.
Press both volume butttons at the same time and connect it to pc
once the program has ran succsessfully close the window. DO NOT DISSCONECT THE PHONE FROM PC
OPEN sp flashtool and the device manager loader the scatter file from the firmware you extracted and the custom da. use DOWNLOAD OPTION untick the FOLLOWING file to prevent errors while flashing "opporeserve2".
check in device manager the comport to which the phone is connected in the options tab of the sp flash tool open and click on connection adjust the comport N.O to the one of the phone
press start to begin flashing and wait for the process to finish
NB: FIRMWARE CAN BE FOUND VIA GOOLE
DAA&SLA BYPASS TOOL
-https://romprovider.com/bypass-daa-sla-protection-oppo/
oppo opf file extractor
-https://www.martview-forum.com/threads/ofp-file-extractor-without-any-device.39292/(FILE requires registration its free also turn off antivirus)
sp flashtool and da file
-https://mega.nz/file/otAiUL6I#47l3iSgfWhMv-Iq1SygVsPZhDdbRPaeMHCobCqV2gXg
tutorial for reference
A)how to flash the phone
-https://www.youtube.com/watch?v=PMZYmszOcN0
-https://www.youtube.com/watch?v=cnqDxfvEnaA
B)how to extract firmware
-https://www.youtube.com/watch?v=qoK-K4XwlVM&t=0s
DISCLAIMER:you do this at your own risk AM NOT RESPONSIBLE IF YOU BRICK YOUR PHONE.
open the above links and understand every thing and watch all videos closely FOR BEST RESULTS
GOODLUCK
Click to expand...
Click to collapse
The link that I've downloaded the rom ( oppostockrom.com) tells me to untick the preloaded.bin before flashing and then flash it without the other files , but some guys ( like you ) says not to flash opporeserve2
WHAT SHOULD I DOOOOOOO
Fredo2 said:
Hi, where did you get the login and password from msm tools?
Click to expand...
Click to collapse
Pass : te123
I just received an Ulefone armor 18t and I'm trying to get the phone rooted through a magisk patched boot image. Whenever I attempt to flash the patched image, the phone always ends up bootlooping and gives me the 'android system may be corrupt' message. I've tried flashing an empty vbmeta in order to try to disable secure boot, but it still isn't working.
Does anyone have any other suggestions or have any ideas as to what could be causing my phone to not boot?
Posted this on reddit; just reposting this for more exposure
EDIT: I managed to root my phone by patching my boot.img with an older version of magisk (24.3) and then updating to v25 after.
I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?
foamrotreturns said:
I used Magisk 24.3 to patch my boot.img per your suggestion, but when I flashed it, something went wrong and now I'm stuck in a boot loop. Factory reset doesn't help, and I can't get into fastboot either. How did you get out of your boot loop?
Click to expand...
Click to collapse
Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:
Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options
I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"
If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"
Have you tried flashing boot.img in fastboot to sort out bootlooping?
I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.
This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.
Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?
Generic123. said:
Are you the guy that replied to me on the reddit thread? Sorry about the slow replies but I put a response in that should help hopefully. I'll repost it here just in case:
Well, to get back into fastboot, I had to hold the power button until it shuts off and spam the volume up button super fast until you see either the recovery or the boot selection options
I should mention that the process is super finicky and you'll most likely fail a couple of times. I don't remember needing a vbmeta to root the device but i did try one here, using this command (in the bootloader, not fastbootd): fastboot flash --disable-verity --disable-verification vbmeta "name of vbmeta"
If that doesn't work, you can try using the stock vbmeta with the command above, or try this command with the stock or null vbmeta: fastboot flash vbmeta "name of stock or empty vbmeta"
Click to expand...
Click to collapse
Yes, I was the person replying to you on Reddit. Thank you again for the help over there.
wenyendev said:
Have you tried flashing boot.img in fastboot to sort out bootlooping?
Click to expand...
Click to collapse
The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.
foamrotreturns said:
I managed to get it booting again, but I'm now dealing with an entirely different problem. The FLIR camera is highly unstable (it frequently crashes, and sometimes stops working completely until I reboot the phone), and I cannot get the infrared image to line up with the camera image. I've tried the automatic calibration and the image realignment utility. No matter what I do, the infrared image is always way too big to line up with the camera image.
This only started happening after I flashed the phone back to "factory" using the ROM provided by Ulefone on their Google Drive. The ROM that was on the phone when it arrived didn't have any problems, but I don't have a backup of that because I assumed that it would be the same as what I could get from Ulefone. But the ROM that Ulefone provides has a bunch of weird stuff, like a red "未写入google key 和tee key" watermark on the screen that can only be removed by running a command in a root adb shell, as well as this thing with the FLIR camera.
Anyone know where I can get a copy of the ROM that was actually installed on the phone when it shipped, as opposed to the one provided by Ulefone on their Google Drive?
Yes, I was the person replying to you on Reddit. Thank you again for the help over there.
The problem was that I couldn't even get to fastboot. The device was softbricked. I had to use SP Flash Tool to get it back into a condition where I could even use fastboot at all.
Click to expand...
Click to collapse
I am no specialist in unbricking devices. But you may try as follows
- Download the ROM, GApps (Optional), Magisk (Optional).
- Wipe System, Data, Dalvik, Cache.
- Flash the ROM, GApps (Optional), Magisk (Optional).
- Reboot and Enjoy.
I tried to root mine, but I was unsuccessful.
I used mtkclient to pull out the boot_b.img and vbmeta_b.img from my device. Having these backups were helpful to get me out of bootloops.
I tried 3 different magisk versions: 24.3, 25.2, and a patched version linked in mtkclient's github readme.
I also tried the vbmeta recommendations described by OP in this thread, but I still could not get myself past the 'android system may be corrupt' loop.
I reverted my boot and vbmeta partitions back to the version I backed up via mtkclient, and escaped the bootloop. But no root.
Interestingly, the checksum of the boot_b.img in my phone does not match the checksum of the boot.img provided in Ulefone's official release. I am assuming my phone received an OTA update while the version in the Ulefone official GoogleDrive remained old, but I was not able to track down a changelog for rom updates/release history.
Unsure what to try next, open to ideas.
Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.
914mrx said:
Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.
Click to expand...
Click to collapse
I checked the Mega link you provided, and the latest version for the Power Armor 18T is the same as in the Ulefone Google Drive location. I did not compare checksums though, so I cannot confirm the content is identical.
Where did you find this mega folder link? Any chance Ulefone also publishes a changelog or provides older firmware releases in the same location you found the Mega link?
Hello, found this link on 4PDA a long time ago, about the others questions i don´t know. Sorry.
I spent whole night doing everything but all failed. Unlocked OEM and Usb debugging enabled, tried kingroot, vroot, supersu, downloaded drivers and everything...but somehow I couldn't get through any of it.
Any idea anyone how to do this?
Here's why the phone is not being rooted as per the customer service.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
914mrx said:
Hello, try this page i think the firmware is more update (have all models), is also from Ulefone.
454.93 GB folder on MEGA
905 files and 654 subfolders
mega.nz
I have donwload a new firmware to my Armor X7 Pro and is very stable.
Click to expand...
Click to collapse
hello,
i download ROM file from mega. I have SPMDT tool. Scatter files can be to set. DA files is not correct to select. What is wrong?
Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.
914mrx said:
Hello, i don´t know, there is also a video and a instruction sheet, as I said on Armor 7 Pro everything went well 100%.
Click to expand...
Click to collapse
Hello,
I am solved problem with upgrade. Now have problem with FLIR kamera. No have icon for start IR camera. I can't start it.I think that new upgrade no made for all ulefone model.
How is Foamrotreturns solved problem with FLIR camera?
Samo-z said:
Hello,
I am solved problem with upgrade. Now have problem with FLIR kamera. No have icon for start IR camera. I can't start it.I think that new upgrade no made for all ulefone model.
How is Foamrotreturns solved problem with FLIR camera?
Click to expand...
Click to collapse
Were you able to root the phone and flash custom ROM?
I am trying to rot my mediatek device following the instruction on this page:-
Unlock Bootloader on MediaTek Devices using MTKClient
In this comprehensive tutorial, we will show you detailed steps to unlock the bootloader on your MediaTek device using MTKClient.
Everything has went smooth but I am getting I/O error and I am not sure how do i unlock bootloader, and hnce install TWRP to install a better ROM.
Here is the log:-
Port – Device detected
Preloader – CPU: MT6877(Dimensity 900)
Preloader – HW version: 0x0
Preloader – WDT: 0x10007000
Preloader – Uart: 0x11002000
Preloader – Brom payload addr: 0x100a00
Preloader – DA payload addr: 0x201000
Preloader – CQ_DMA addr: 0x10212000
Preloader – Var1: 0xa
Preloader – Disabling Watchdog…
Preloader – HW code: 0x959
Preloader – Target config: 0xe0
Preloader – SBC enabled: False
Preloader – SLA enabled: False
Preloader – DAA enabled: False
Preloader – SWJTAG enabled: False
Preloader – EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader – Root cert required: False
Preloader – Mem read auth: True
Preloader – Mem write auth: True
Preloader – Cmd 0xC8 blocked: True
Preloader – Get Target info
Preloader – BROM mode detected.
Preloader – HW subcode: 0x8a00
Preloader – HW Ver: 0xca00
Preloader – SW Ver: 0x0
Preloader – ME_ID: 32993668EB4B4D231D8C1EBAAE7B7B58
Preloader – SOC_ID: 70D2AEEC41FAFC8277AC77DAC843F110913450DFDAC62279F70FD82135670657
DA_handler – Device is unprotected.
DA_handler – Device is in BROM-Mode. Bypassing security.
PLTools – Loading payload from mt6877_payload.bin, 0x264 bytes
PLTools – Kamakiri / DA Run
Kamakiri – Trying kamakiri2..
DeviceClass – USBError(5, ‘Input/Output Error’)
Traceback (most recent call last):
File “C:\Python 3.10.9\mtk”, line 814, in
mtk = Main(args).run(parser)
File “C:\Python 3.10.9\mtkclient\Library\mtk_main.py”, line 615, in run
mtk = da_handler.configure_da(mtk, preloader)
File “C:\Python 3.10.9\mtkclient\Library\mtk_da_cmd.py”, line 101, in configure_da
mtk = mtk.bypass_security() # Needed for dumping preloader
File “C:\Python 3.10.9\mtkclient\Library\mtk_class.py”, line 155, in bypass_security
if plt.runpayload(filename=self.config.payloadfile):
File “C:\Python 3.10.9\mtkclient\Library\pltools.py”, line 102, in runpayload
if self.kama.payload(payload, addr, True, exploittype):
File “C:\Python 3.10.9\mtkclient\Library\kamakiri.py”, line 139, in payload
if self.exploit2(payload, addr):
File “C:\Python 3.10.9\mtkclient\Library\kamakiri.py”, line 117, in exploit2
ptr_send = unpack(“<I", self.da_read(self.mtk.config.chipconfig.send_ptr[0][1], 4))[0] + 8
TypeError: a bytes-like object is required, not 'NoneType'
What do i do now? I've followed all the steps, not sure why is it giving I/O error. I tried with second usb on other port but got the same message.
Kindly suggest how to rectify this.
My device is Ulefone Armour 18t, Processor: MediaTek Dimensity 900
Phone tech specs:-
Ulefone Power Armor 18T
Please help.. :-(
Kind Regards
Hitanshu Gaur
Generic123. said:
I just received an Ulefone armor 18t and I'm trying to get the phone rooted through a magisk patched boot image. Whenever I attempt to flash the patched image, the phone always ends up bootlooping and gives me the 'android system may be corrupt' message. I've tried flashing an empty vbmeta in order to try to disable secure boot, but it still isn't working.
Does anyone have any other suggestions or have any ideas as to what could be causing my phone to not boot?
Posted this on reddit; just reposting this for more exposure
EDIT: I managed to root my phone by patching my boot.img with an older version of magisk (24.3) and then updating to v25 after.
Click to expand...
Click to collapse
Hi mate, I patched the boot.img of the official ROM with Magisk after installing it on the phone and then selecting 'install' button and selecting boot.ing file of the official ROM and it was successful. But what do I do next? How do I root the phone after this?
hitanshugaur said:
Hi mate, I patched the boot.img of the official ROM with Magisk after installing it on the phone and then selecting 'install' button and selecting boot.ing file of the official ROM and it was successful. But what do I do next? How do I root the phone after this?
Click to expand...
Click to collapse
Here a complete how to https://www.droidwin.com/patch-stock-boot-image-flash-magisk/
joke19 said:
Here a complete how to https://www.droidwin.com/patch-stock-boot-image-flash-magisk/
Click to expand...
Click to collapse
I have been able to do everything, now the instructions in the last one are confusing.
Step 2A and 2B are causing confusion and hence a bootloop error.
In 2A he is asking to 'copy' the patched file to the platform-tools folder and the file as per him is stored by the name of magisk_patched.img whereas in reality when I did it was saved as magisk_patched._1vjUh.img. I have copied this to the platform-tools folder as directed
In 2B he is asking to patch again with a newer version and yet again as per him that file will be saved as magisk_patched.img too. Now how can one folder have two files with the exact same name?
Now the confusion is: Does he want us to 'cut paste' the patched image from the older version to the platform-tools folder and rename it to magisk_patched.img ; and leave the new version's patched file in the phone's internal memory and rename that one too magisk_patched.img as well?
If this is done then won't there be a conflict while rooting? because two patched .img are from different versions of a software?