LG G6 TestPoints for EDL Mode (9008) - LG G6 Guides, News, & Discussion

Simple af. Just short them.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
For incase that doesn't work;

One question can we make lg g6 go to edl mode using edl cable? I don't want to open the device and make a mess

Ashley david said:
One question can we make lg g6 go to edl mode using edl cable? I don't want to open the device and make a mess
Click to expand...
Click to collapse
I tried it (shorting GND with DATA -) not working.

badmaan said:
Simple af. Just short them.
For incase that doesn't work;
Click to expand...
Click to collapse
It works! My phone was 100% dead and now I am in Qualcomm 9008 mode! (using the test points under the flash)
unfortunately it seems to be another dead path with this phone. No firehose and no xml to flash with QFIL

I have hoses but i don't think any are the proper ones. I can get my software/hardware to load some but not perform any operations with one hose and the other nothing at all.

try using the firehose from here. https://forum.xda-developers.com/t/lg-g6-unbrick-new-method.3935924/
i had been given a dead G6 no partitions (fried) and none of the tools work for reflashing. found a bunch of tools to use in Linux since the drivers/windows kept reseting the connection every time i plugged in and was getting no response so it always ended up in failure. (Note if really is dead bricked as mine was you literally have to pull the pins and get back to edl using the test points every time for each operation as it resets and stops responding after each)
Managed to create proper rawprogram0-6.xml using https://github.com/ANEP-ET/kdztools
unkdz -f myfile.kdz -x
undz -f kdzextracted/myfile.dz -c
undz -f kdzextracted/myfile.dz -r
(creates rawprogram xml files for each primary_gpt file you likely have)
cp rawprogram*.xml dzextracted/
make sure to edit all the separate rawprogram files and edit the files to match the letters associated with the extracted files in dzextracted.
for example in rawprogram1.xml prefix all the files listed in there with B.
for rawprogram2.xml prefix all the files listed in there with C.
and so on. BUT do not rename the first file, rawprogram0.xml does not need to append A. to it as the first one did not get created as such.
tried this tool where it was getting the phone was getting detected properly and the programmer file was uploaded but it was iffy to get it to do anything but cool tool and lots of programmer files with it https://github.com/bkerler/edl
what finally worked with my newly created rawprogam files and the programm was using Qualcoms qdl tool (requires compiling it in Linux, port on github) from here https://github.com/andersson/qdl
by doing
qdl --storage ufs prog_ufs_firehose_lge_g6.elf rawprogram0.xml
and repeat for all the rawprogram files 0 through 6 (or however many there was autogenerated) you generated from above making sure to pull the battery and force it back into edl mode if its reseting the connection afterward like it did for me. Note the name for the firehose there might be something else for you just replace the name with the right file.

Oh i forgot that you probably need to patch the kdztools from https://github.com/ANEP-ET/kdztools because it may fail on newer files the PR for the patch is on the patch already on there a PR #1 @ https://github.com/ANEP-ET/kdztools/pull/1

Lastly before i forget this as well run qdl from within the dzextracted directory so i can find all the bin/image files enumerated in the rawprogram xml files that you copied over into and flash them properly.

draekko said:
try using the firehose from here. https://forum.xda-developers.com/t/lg-g6-unbrick-new-method.3935924/
i had been given a dead G6 no partitions (fried) and none of the tools work for reflashing. found a bunch of tools to use in Linux since the drivers/windows kept reseting the connection every time i plugged in and was getting no response so it always ended up in failure. (Note if really is dead bricked as mine was you literally have to pull the pins and get back to edl using the test points every time for each operation as it resets and stops responding after each)
Managed to create proper rawprogram0-6.xml using https://github.com/ANEP-ET/kdztools
unkdz -f myfile.kdz -x
undz -f kdzextracted/myfile.dz -c
undz -f kdzextracted/myfile.dz -r
(creates rawprogram xml files for each primary_gpt file you likely have)
cp rawprogram*.xml dzextracted/
make sure to edit all the separate rawprogram files and edit the files to match the letters associated with the extracted files in dzextracted.
for example in rawprogram1.xml prefix all the files listed in there with B.
for rawprogram2.xml prefix all the files listed in there with C.
and so on. BUT do not rename the first file, rawprogram0.xml does not need to append A. to it as the first one did not get created as such.
tried this tool where it was getting the phone was getting detected properly and the programmer file was uploaded but it was iffy to get it to do anything but cool tool and lots of programmer files with it https://github.com/bkerler/edl
what finally worked with my newly created rawprogam files and the programm was using Qualcoms qdl tool (requires compiling it in Linux, port on github) from here https://github.com/andersson/qdl
by doing
qdl --storage ufs prog_ufs_firehose_lge_g6.elf rawprogram0.xml
and repeat for all the rawprogram files 0 through 6 (or however many there was autogenerated) you generated from above making sure to pull the battery and force it back into edl mode if its reseting the connection afterward like it did for me. Note the name for the firehose there might be something else for you just replace the name with the right file.
Click to expand...
Click to collapse
Good to hear that there is some hope, i bricked my G6 (h870) 2 months ago while in download mode the laptop turn off. I tried the new unbricked method but got same issue of connection reset. Will try this and update. Also can you share rawprogram xmls please.

kurogami555 said:
Good to hear that there is some hope, i bricked my G6 (h870) 2 months ago while in download mode the laptop turn off. I tried the new unbricked method but got same issue of connection reset. Will try this and update. Also can you share rawprogram xmls please.
Click to expand...
Click to collapse
Nope it was an H873 canadian model. You can make your own using the kdz for your model as i described though.

draekko said:
try using the firehose from here. https://forum.xda-developers.com/t/lg-g6-unbrick-new-method.3935924/
i had been given a dead G6 no partitions (fried) and none of the tools work for reflashing. found a bunch of tools to use in Linux since the drivers/windows kept reseting the connection every time i plugged in and was getting no response so it always ended up in failure. (Note if really is dead bricked as mine was you literally have to pull the pins and get back to edl using the test points every time for each operation as it resets and stops responding after each)
Managed to create proper rawprogram0-6.xml using https://github.com/ANEP-ET/kdztools
unkdz -f myfile.kdz -x
undz -f kdzextracted/myfile.dz -c
undz -f kdzextracted/myfile.dz -r
(creates rawprogram xml files for each primary_gpt file you likely have)
cp rawprogram*.xml dzextracted/
make sure to edit all the separate rawprogram files and edit the files to match the letters associated with the extracted files in dzextracted.
for example in rawprogram1.xml prefix all the files listed in there with B.
for rawprogram2.xml prefix all the files listed in there with C.
and so on. BUT do not rename the first file, rawprogram0.xml does not need to append A. to it as the first one did not get created as such.
tried this tool where it was getting the phone was getting detected properly and the programmer file was uploaded but it was iffy to get it to do anything but cool tool and lots of programmer files with it https://github.com/bkerler/edl
what finally worked with my newly created rawprogam files and the programm was using Qualcoms qdl tool (requires compiling it in Linux, port on github) from here https://github.com/andersson/qdl
by doing
qdl --storage ufs prog_ufs_firehose_lge_g6.elf rawprogram0.xml
and repeat for all the rawprogram files 0 through 6 (or however many there was autogenerated) you generated from above making sure to pull the battery and force it back into edl mode if its reseting the connection afterward like it did for me. Note the name for the firehose there might be something else for you just replace the name with the right file.
Click to expand...
Click to collapse
Good solid info. Thanks

draekko said:
try using the firehose from here. https://forum.xda-developers.com/t/lg-g6-unbrick-new-method.3935924/
i had been given a dead G6 no partitions (fried) and none of the tools work for reflashing. found a bunch of tools to use in Linux since the drivers/windows kept reseting the connection every time i plugged in and was getting no response so it always ended up in failure. (Note if really is dead bricked as mine was you literally have to pull the pins and get back to edl using the test points every time for each operation as it resets and stops responding after each)
Managed to create proper rawprogram0-6.xml using https://github.com/ANEP-ET/kdztools
unkdz -f myfile.kdz -x
undz -f kdzextracted/myfile.dz -c
undz -f kdzextracted/myfile.dz -r
(creates rawprogram xml files for each primary_gpt file you likely have)
cp rawprogram*.xml dzextracted/
make sure to edit all the separate rawprogram files and edit the files to match the letters associated with the extracted files in dzextracted.
for example in rawprogram1.xml prefix all the files listed in there with B.
for rawprogram2.xml prefix all the files listed in there with C.
and so on. BUT do not rename the first file, rawprogram0.xml does not need to append A. to it as the first one did not get created as such.
tried this tool where it was getting the phone was getting detected properly and the programmer file was uploaded but it was iffy to get it to do anything but cool tool and lots of programmer files with it https://github.com/bkerler/edl
what finally worked with my newly created rawprogam files and the programm was using Qualcoms qdl tool (requires compiling it in Linux, port on github) from here https://github.com/andersson/qdl
by doing
qdl --storage ufs prog_ufs_firehose_lge_g6.elf rawprogram0.xml
and repeat for all the rawprogram files 0 through 6 (or however many there was autogenerated) you generated from above making sure to pull the battery and force it back into edl mode if its reseting the connection afterward like it did for me. Note the name for the firehose there might be something else for you just replace the name with the right file.
Click to expand...
Click to collapse
Ok, so i tried this method in Ubuntu but Qdl just waits for EDL device nothing happens. I check the attached usb devices there it shows that Qualcomm 9008 is connected but Qdl script doesn't detect it. Some help please.

kurogami555 said:
Ok, so i tried this method in Ubuntu but Qdl just waits for EDL device nothing happens. I check the attached usb devices there it shows that Qualcomm 9008 is connected but Qdl script doesn't detect it. Some help please.
Click to expand...
Click to collapse
did you reset the device by pulling the battery and putting it back into edl mode for each time you ran qdl? if you don't it won't work as the connect resets every time and will stop communicating after each command sent. Also make sure you have the right programmer file.

draekko said:
did you reset the device by pulling the battery and putting it back into edl mode for each time you ran qdl? if you don't it won't work as the connect resets every time and will stop communicating after each command sent. Also make sure you have the right programmer file.
Click to expand...
Click to collapse
yes, i removed battery again and again short circuited the edl pin the device immediately gets detected as Qualcomm 9008 in usb list but the Qdl script still shows waiting for Edl device.

If you use the programmer file with this tool at https://github.com/bkerler/edl does it show the cpu/serialnumbers/other info when trying to get a partitions list or other commands? If not either the programmer file is wrong or the device is too dead to respond.

draekko said:
If you use the programmer file with this tool at https://github.com/bkerler/edl does it show the cpu/serialnumbers/other info when trying to get a partitions list or other commands? If not either the programmer file is wrong or the device is too dead to respond.
Click to expand...
Click to collapse
what command should i run to check if the firehose is good or not ?

kurogami555 said:
what command should i run to check if the firehose is good or not ?
Click to expand...
Click to collapse
try anything that reads data, try printpgt for example. If it doesn't list the cpu type and serial number it means you have the wrong programmer file for your device. Note that it may fail to actually print any data as it failed on mine but will show the SN/cpu information with the right one.

draekko said:
try anything that reads data, try printpgt for example. If it doesn't list the cpu type and serial number it means you have the wrong programmer file for your device. Note that it may fail to actually print any data as it failed on mine but will show the SN/cpu information with the right one.
Click to expand...
Click to collapse
Sorry for this but i don't get how to use this edl script it's too complicated. Can you please check whether the firehose i attached is good or not. Please.

kurogami555 said:
Sorry for this but i don't get how to use this edl script it's too complicated. Can you please check whether the firehose i attached is good or not. Please.
Click to expand...
Click to collapse
I can't do that the phone is sealed up now and can't be thrown back into edl mode.
Try the loaders github repo for edl, 0005f0e100310000_2cf7619a278d2607_fhprg_peek.bin should theoretically be the right one. https://github.com/bkerler/Loaders
If you install the edl tool per instructions it should include that file as well.
If that fails might be totally bricked or require one of the boxes to revive it.

draekko said:
I can't do that the phone is sealed up now and can't be thrown back into edl mode.
Try the loaders github repo for edl, 0005f0e100310000_2cf7619a278d2607_fhprg_peek.bin should theoretically be the right one. https://github.com/bkerler/Loaders
If you install the edl tool per instructions it should include that file as well.
If that fails might be totally bricked or require one of the boxes to revive it.
Click to expand...
Click to collapse
What I do not understand is that how to use firehose in that EDl script. After I connect the phone in edl mode than what ?

Related

error: cannot load 'unlock_code.bin'

I get this error every time when using htc dev boot unlocker. error: cannot load 'unlock_code.bin'
any ideas please
Is the unlock_code.bin file in the same directory as all the other unlock files?
still wont work
My Unlock_code.bin file is in the same file as the fastboot, yet it still wont load...
UPDATE
FIXED: had to change the directory in Command Prompt from c:\user to the location of the .bin file.
Duckvdm said:
My Unlock_code.bin file is in the same file as the fastboot, yet it still wont load...
UPDATE
FIXED: had to change the directory in Command Prompt from c:\user to the location of the .bin file.
Click to expand...
Click to collapse
finally something worked for me
blackbolo said:
finally something worked for me
Click to expand...
Click to collapse
I have the same problem, exactly like the op posted, but I did change the directory to the same one where the unlock bin file was which also included the 3 files that htcdev.com/bootloader told me to put in there (such as fastboot)
But still doesn't work. In fact I can provide a screenshot clearly showing the directory where the unlock file and other files are, aswell as my command prompts and errors.
Please help me don't disregard my post : P I have been trying to figure this out for hours, I even called htcdev support and they couldn't help, told me to ask in forums LOL? why is there a support number if they won't help?
pontypool said:
I have the same problem, exactly like the op posted, but I did change the directory to the same one where the unlock bin file was which also included the 3 files that htcdev.com/bootloader told me to put in there (such as fastboot)
But still doesn't work. In fact I can provide a screenshot clearly showing the directory where the unlock file and other files are, aswell as my command prompts and errors.
Please help me don't disregard my post : P I have been trying to figure this out for hours, I even called htcdev support and they couldn't help, told me to ask in forums LOL? why is there a support number if they won't help?
Click to expand...
Click to collapse
*facepalm* Um Sir, if your fastboot, adb, and UNLOCK_TOKEN files are all in the folder "aaa" why are you directing your command prompts to the non-existent "abd" folder? In your case the very first thing you should be typing into the command prompt is: cd E:\aaa Now you can actually execute fastboot commands because that is where all the files are.
JnNn98 said:
*facepalm* Um Sir, if your fastboot, adb, and UNLOCK_TOKEN files are all in the folder "aaa" why are you directing your command prompts to the non-existent "abd" folder? In your case the very first thing you should be typing into the command prompt is: cd E:\aaa Now you can actually execute fastboot commands because that is where all the files are.
Click to expand...
Click to collapse
my mistake. i had two folders aaa and abd with identical files. but the error still remains nevertheless, as seen in the new screenshot
it's just a stupid mistake of mine. i didnt put the CD part in.. i assume that was for people who had the files on a cd.
* walks away in shame *
pontypool said:
my mistake. i had two folders aaa and abd with identical files. but the error still remains nevertheless, as seen in the new screenshot
it's just a stupid mistake of mine. i didnt put the CD part in.. i assume that was for people who had the files on a cd.
* walks away in shame *
Click to expand...
Click to collapse
So does it work now? BTW "cd" is just something you would type when you have to change the directory in the cmd, it actually has nothing to do with actual CD's (Compact Discs)
---------- Post added at 03:38 PM ---------- Previous post was at 03:22 PM ----------
pontypool said:
my mistake. i had two folders aaa and abd with identical files. but the error still remains nevertheless, as seen in the new screenshot
it's just a stupid mistake of mine. i didnt put the CD part in.. i assume that was for people who had the files on a cd.
* walks away in shame *
Click to expand...
Click to collapse
So does it work now? BTW "cd" is just something you would type when you have to change the directory in the cmd, it actually has nothing to do with actual CD's (Compact Discs)
JnNn98 said:
So does it work now? BTW "cd" is just something you would type when you have to change the directory in the cmd, it actually has nothing to do with actual CD's (Compact Discs)
---------- Post added at 03:38 PM ---------- Previous post was at 03:22 PM ----------
So does it work now? BTW "cd" is just something you would type when you have to change the directory in the cmd, it actually has nothing to do with actual CD's (Compact Discs)
Click to expand...
Click to collapse
yes it works now. I realise now, but at the time I assumed it was a suggested directory if the files are stored on a cd.
Unknown error
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
E:\Documents and Settings\MovilSol#2\Desktop>fastboot flash unlocktoken unlock_code.bin
error: cannot load 'unlock_code.bin': Unknown error
Please help me! D:
That should be a capital U in Unlock_code.bin
Sent from my Evo 3D CDMA using xda premium
xion009 said:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
E:\Documents and Settings\MovilSol#2\Desktop>fastboot flash unlocktoken unlock_code.bin
error: cannot load 'unlock_code.bin': Unknown error
Please help me! D:
Click to expand...
Click to collapse
Try to generate the Unclock_code.bin from htcdev website again.
Replace the new file in the fastboot directory . It should work .
XDA-Dev. said:
Try to generate the Unclock_code.bin from htcdev website again.
Replace the new file in the fastboot directory . It should work .
Click to expand...
Click to collapse
I already tried to generate the unlock_code.bin alot of times in htcdev and none works /:
error
Duckvdm said:
My Unlock_code.bin file is in the same file as the fastboot, yet it still wont load...
UPDATE
FIXED: had to change the directory in Command Prompt from c:\user to the location of the .bin file.
Click to expand...
Click to collapse
yes thanks for that mate was getting same eror so i dropped the 2 files into the path that command prompt was displaying
Help Im having the same problem
Im using a window pc runing windows 8. I have done everthing gotten the .bin file and now i get cannot load 'unlock_code.bin
Thank you! This fixed my issue, though it was a small blow to my ego (seems obvious in retrospect). Still having trouble actually rooting my phone, but at least I'm closer now?
Use kingoroot in fastboot mode no need unlock code.bin
Try it
Can't get my Unlock_code.bin to initiate
I have all my files in one folder and I still cannot get this last step to initiate and I am meet with the following
Johns-MacBook-Pro:~ johnsummersjr$ Users/johnsummersjr/Desktop/Android/fastboot flash unlocktoken Unlock_code.bin
-bash: Users/johnsummersjr/Desktop/Android/fastboot: No such file or directory
Johns-MacBook-Pro:~ johnsummersjr$
/Users/johnsummersjr/Desktop/Screen Shot 2015-11-30 at 9.59.55 PM.png
HTC BootLoader Via Macbook pro
JohnSnow2015 said:
I have all my files in one folder and I still cannot get this last step to initiate and I am meet with the following
Johns-MacBook-Pro:~ johnsummersjr$ Users/johnsummersjr/Desktop/Android/fastboot flash unlocktoken Unlock_code.bin
-bash: Users/johnsummersjr/Desktop/Android/fastboot: No such file or directory
Johns-MacBook-Pro:~ johnsummersjr$
/Users/johnsummersjr/Desktop/Screen Shot 2015-11-30 at 9.59.55 PM.png
Click to expand...
Click to collapse
UPDATE 12/3/15
I got everything into one directory and entered: /Users/johnsummersjr/Desktop/HTC\ Unlock\ BootLoader/adt-bundle-mac-x86_64-20140321/sdk/platform-tools/fastboot unlocktoken Unlock_code.bin. Yet I am met with the following
Johns-MacBook-Pro:~ johnsummersjr$ /Users/johnsummersjr/Desktop/HTC\ Unlock\ BootLoader/adt-bundle-mac-x86_64-20140321/sdk/platform-tools/fastboot unlocktoken Unlock_code.bin
usage: fastboot [ <option> ] <command>
commands:
update <filename> reflash device from update.zip
flashall flash boot + recovery + system
flash <partition> [ <filename> ] write a file to a flash partition
erase <partition> erase a flash partition
format <partition> format a flash partition
getvar <variable> display a bootloader variable
boot <kernel> [ <ramdisk> ] download and boot kernel
flash:raw boot <kernel> [ <ramdisk> ] create bootimage and flash it
devices list all connected devices
continue continue with autoboot
reboot reboot device normally
reboot-bootloader reboot device into bootloader
help show this help message
options:
-w erase userdata and cache (and format
if supported by partition type)
-u do not first erase partition before
formatting
-s <specific device> specify device serial number
or path to device port
-l with "devices", lists device paths
-p <product> specify product name
-c <cmdline> override kernel commandline
-i <vendor id> specify a custom USB vendor id
-b <base_addr> specify a custom kernel base address. default: 0x10000000
-n <page size> specify the nand page size. default: 2048
-S <size>[K|M|G] automatically sparse files greater than
size. 0 to disable
Fixed
cal4877 said:
I get this error every time when using htc dev boot unlocker. error: cannot load 'unlock_code.bin'
any ideas please
Click to expand...
Click to collapse
use fastboot folder provided by htc
you can find it on htc site
first select your device for unlocking bootloder then on next page there have given steps 1,2,3..
on the last there will be fastboot downloading links :good:
It will absolutely solve your problem

[Q/A]Coolpad 5560s - MegaThread: We are now ROOTED.

Coolpad 5560s - MegaThread: Info / Root
We are now ROOTED. I think we are the first too.
If you have any additional info, binaries, etc -- feel free to contribute!
USE AT YOUR OWN RISK
*** UPDATE ***
Fellow XDA'r stevenmirabito put together an all-in-one tool! If you wanna dig into the technical stuff follow directions below if not... check out his post!
*** UPDATE ***
USE AT YOUR OWN RISK​
Updates:
17 Feb 2015
The fun begins ...
---> USE AT YOUR OWN RISK --->​DOWNLOADS:
ALL TOOLS AND DOCUMENTS ARE for non-commercial, personal, and educational use only.
You assume all risks and liabilities.​<--- USE AT YOUR OWN RISK <---​​
Big thank you to: stevenmirabito, keebler64,.. and all the other folks that contributed.
Proof of Concept
Code:
- Root is pre-cooked into the image.
- Root survives reboot.
- Note that the superuser daemon is.. rigged into one of the init.qcom.post-boot.sh files -- may break things. :P
[U]Removed:[/U]
- system/priv-app/Cota*.apk/odex
- system/app/CP_*.apk/odex
- system/etc/security/otaupdates.zip.
- system/etc/ recovery-data.dat (not the exact name -- but removed)
[U]Added: [/U]
- system/app: fdroid.apk, es file manager.apk
- system/xbin/su, system/bin/su (linked), /system/app/Superuser.apk ---> Clockworkmod's Superuser. :)
[U]BUGFIX for Proof-Of-Concept:[/U]
- From: stevenmirabito: --> see [URL="http://forum.xda-developers.com/showpost.php?p=58913680&postcount=55"]post #55[/URL]. <--- the Setup Wizard was disabled.. somehow... :P
It does work.. you can dump the partitions.. and it [U]appears[/U] that you *can* write to the boot/recovery.
HOWTO: Creating your own a custom system.img for flashing with the sda-flashtool
Code:
# Remove the following hex sequences from the stock system.img
# These are the only thing that stop the image from being a normal ext4 raw image.
"30 3C 38 30 30 30 30 30 2E 2E 2E 2E" (Three total)
"30 30 32 39 3D 39 36 38 2E 2E 2E 2E" (One)
# Convert the now fixed system.img to a raw ext4 image to mount using simg2img (linux or possibly windows)
simg2img system.img system.raw
# Mount the raw image using loop (linux)
mkdir rawsystem
mount -t ext4 -o loop system.raw ./rawsystem/
# When you are finished making changes - create a new_system.img using the 4096 sparse format.
make_ext4fs -s -l 1024M -b 4096 -a system new_system.img rawsystem/
# move the new_system.img to the sda-flashtool directory (in windows) :)
# run sda-flashtool
sda-flashtool
# note that the sda-flashtool takes care of the injecting the headers --- even with file size changes..
# semi-major bug right now is the new_system.img needs to be at least 600mb. Will be fixed soon?..
# Have fun!
Recovery / Fastboot Modes
Code:
[I]Recovery Mode[/I]
Power-off, Pull Battery, Press VOL UP & VOL DOWN then Hold Power until Logo. Release Power. Recovery Mode should start in 5-10 seconds.
[I]Fastboot Mode[/I]
Power-off, Pull Battery, Connect USB to computer, Screen should read: "FASTBOOT".
To enable developer options / ADB Debug
Code:
Menu -> Settings -> System -> About Phone -> Tap the 'Build Number' about 5-10 times -> a Message should pop up 'you are now a developer'
OTA / Calling home urls to block in your router (stock image)
Code:
*51coolpad.com, *izatcloud.net, *cootek.com, and *coolpadfuns.com << OTA test server.
Old Root / Progression Log -- moved here for clarity
Code:
16 Feb 2015
[LIST]
[*] System images now flashable. :D
[/LIST]
11 Feb 2015
[LIST]
[*] New Header calculations now verified against all the known stock headers. :good:
[*] Footers: 2 bytes of :confused:
[/LIST]
10 Feb 2015
[LIST]
[*][STRIKE]The headers are back on the todo list.[/STRIKE] FIXED. :)
-Due to the way Bless (hex editor) formats its conversion table, it appeared like the images headers first 4 bytes were converted to a hex string which became the 2nd set of 4 bytes and those bytes summed to the 2e 2e 2e 2e. It looked like it was a simple subtraction/mask issue. Its a bit more. :/
-[STRIKE]Also it appears that both the bootloader and the recovery have a seperate ramdisk partition which is an overlay(?) and so it needs to be flashed as well.[/STRIKE]
[*][STRIKE] Figured out the Headers. Now to the footers.[/STRIKE]
[*] Now able to transfer data w/o being timed out.
[*] Very close to a working custom flash tool.
[/LIST]
06 Feb 2015
[LIST]
[*] More OTA servers to block: *51coolpad.com, *izatcloud.net, *cootek.com, and *coolpadfuns.com << OTA test server.
[/LIST]
28 Jan 2015
[LIST]
[*] Posted older CPB file format found on google translate.
[*] [URL]https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.in189.com%2Fforum.php%3Fmod%3Dviewthread%26tid%3D814196&edit-text=&act=url[/URL]
[*] [STRIKE]Posted a method that would easily brick the phone, but does allow flashing recovery.[/STRIKE] <--- don't do this.. very possible to brick the modem areas of the phone. What you are actually doing when using this method is transferring the remaining bytes of a modem/sbX transfer .. that was already in progress.
[*] University started up so been a bit busy.
[/LIST]
16 Jan 2015
[LIST]
[STRIKE][*] Alright well, found a method that may end up working... I was able to flash the stock 5560s CPB without bricking my 5560s. :D[/STRIKE]
[*] At this point it looks like we either need to create a custom system image w/ SuperUser.apk and busybox pre-installed OR we need to create a custom CWM for the coolpad 5560s.
[STRIKE][*] It appears that as a part of the process of flashing the CPB, we can override the recovery.img with another recovery.img BUT we'd have to create a custom CWM. If we have enough information about the partition layouts.. hopefully.. a non-bricking custom recovery.img can be created. :D[/STRIKE]
[*] REF: [url]http://modaco.com/topic/373530-guide-ygdp-tool-for-flashing-stock-42-44-roms/[/url]
[/LIST]
16 Jan 2014
[LIST]
[*][STRIKE]Tested some (Chinese?) 5217 rooting methods on the 5560.. nothing worked so far.[/STRIKE]
[*]Per suggestions below-- tested a ton of modstrings for towelroot. -- Was unable to gain even temporary root. :/
[*]A fellow XDA'r (Dunno if he wanted pub credit or not) got the CPB file.. poking it with a stick. :)
[/LIST]
08 Jan 2014
[LIST]
[*]Testing some of the other coolpad rooting tools on the 5560.
[*]Tried: SRSRoot v1.7.3, Root Genius v1.9.6.. no luck.
[/LIST]
24 Dec 2014
[LIST]
[*]Xmas time-- gonna be outta it for a few days.
[*]Phone is vulnerable to CVE-2014-7911 - Not sure if helpful, as CVE-2014-7911 crashes JVM. It may be possible to take over one of the factory apks that does have root permissions and inject SU. :)
[/LIST]
22 Dec 2014
[LIST]
[*]Couldnt use the 9976A rooting method-- couldnt pull the MTK scatter. Hmm.
[*]Theres an internal test server but the apk is passworded-- messn around with it.
[/LIST]
20 Dec 2014
[LIST]
[*]Discovered some [B] Coolpad / 5560s Dialer Codes[/B]
[*]*#*#*20060606*#*#* -> EngMode -> Phone Settings -> [B][COLOR=Red]ENABLE Download Mode[/COLOR][/B]
[*]*#*#*9527*#*#* -> FactoryTest -> Some interesting things here..
[*]*#*#*4636*#*#* -> Testing -> Phone Info -> Just like the HTC Hidden Diag Screen, can turn off Radio / set prefered network type.
[/LIST]
slashdevandroid said:
Hi all, my question is... does anyone have any rooting experience with the Coolpad 5560S'? Also-- If you have any additional information on these phones feel free to respond as well!
Click to expand...
Click to collapse
I don't have much experience, but just got one of these and would like to root it so I hope you get some replies. Thanks.
If you manage to find anything out about this I am super interested. Just got one because... why not, it was 10 bucks lol. If you need a guinea pig im down.
Hope we can find root for this phone soon, many are trying current root tools, but none are working, I have tried like 5-6 different ones so far, none working as of yet. im sure in a few more days - someone will have an update on there tool for this to be rooted.
Nevermind.
I have 4 of them now, so hope we can find a way to root them soon, I also wanted to get the bootloader unlocked if possible.
NeoGodSpeed said:
I have 4 of them now, so hope we can find a way to root them soon, I also wanted to get the bootloader unlocked if possible.
Click to expand...
Click to collapse
Opened up one of my 5560s' (Arise) and it looks like it's almost identical to the Coolpad 5217 which happens to have a root and various ROMs available to download. I don't have much time available to start porting ROMs, but someone here might go ahead and give it a look. I'll try to find some time later today to post photos of the PCB.
keebler64 said:
Opened up one of my 5560s' (Arise) and it looks like it's almost identical to the Coolpad 5217 which happens to have a root and various ROMs available to download. I don't have much time available to start porting ROMs, but someone here might go ahead and give it a look. I'll try to find some time later today to post photos of the PCB.
Click to expand...
Click to collapse
That would be great
Have you tried towelroot?
towelroot does not work just tried it
I've been playing around with this device and I figured I would share the progress I've made. I also obtained the CPB file (along with the official USB drivers) from Coolpad and was able to extract it with YGDP, the result of which can be found at the link below:
https://drive.google.com/folderview?id=0B4t9dt63rRpXaHo0XzNqVy1WT00&usp=sharing
Based on the extracted boot.img and the partition information pulled from a running phone I attempted a build of CWM for the 5560S - which can also be found at the link above. I haven't had any luck getting YGDP to flash the custom recovery.img and attempting to flash it via Fastboot hangs on "Writing..." Perhaps someone with a little more time on their hands will be able to get this working.
A few notes:
Coolpad uses a custom USB device ID that is not recognized by the fastboot command automatically. You must use the following flag while issuing fastboot commands:
Code:
fastboot -i 0x1EBF <command>
Attempting to flash the stock CPB file via YGDP will result in a "soft-brick" where the phone will hang on a screen that says "1. modem" with up/down on the side. You can access the phone via ADB in this mode and issue the following command to reboot normally (which differs from the advise you may find online for other Coolpad models):
Code:
adb reboot system
Attempting to replace the recovery.img in the temporary folder YGDP creates (which only happens after modifying its configuration for the phone) does not seem to cause it to flash the custom image instead, unlike other Coolpad models
Attempting to replace the recovery.img in the CPB file with the custom recovery.img in a hex editor causes YGDP to complain about the checksum not matching. I'm not sure where this checksum is stored or if it's modifiable.
Hope this helps! :fingers-crossed:
Has anyone figured this I out yet?
Just wondering if root is available yet?
stevenmirabito said:
Attempting to flash the stock CPB file via YGDP will result in a "soft-brick" where the phone will hang on a screen that says "1. modem" with up/down on the side. You can access the phone via ADB in this mode and issue the following command to reboot normally (which differs from the advise you may find online for other Coolpad models):
Code:
adb reboot system
Attempting to replace the recovery.img in the temporary folder YGDP creates (which only happens after modifying its configuration for the phone) does not seem to cause it to flash the custom image instead, unlike other Coolpad models
Attempting to replace the recovery.img in the CPB file with the custom recovery.img in a hex editor causes YGDP to complain about the checksum not matching. I'm not sure where this checksum is stored or if it's modifiable.
Hope this helps! :fingers-crossed:
Click to expand...
Click to collapse
Awesome! TYVM!
I soft-bricked my 5560 as well-- ended up using adb's shell to reboot into the stock recovery, clear both the data and cache, then rebooted and.. it started up fully stock with no issues that I can see..
Quick question -- how did you get the YGDP to actually extract the *.imgs? Using procmon I've seen YGDP read from the CPB but never write to any files..
Coolpad 5560S Pics
Here are some crappy pics of the insides, I didn't see any specific headers for any UART or JTAG, but they could be multiplexed with other pins. I'll get around to actually desoldering the RF shields some day and using the Nikon D90 for the pics instead of the iPhone.
i.imgur.com/8Ywkt0l.jpg
i.imgur.com/UUiyKXa.jpg
i.imgur.com/EnVfhWM.jpg
i.imgur.com/M2XzlCi.jpg
i..imgur.com/8Ywkt0l.jpg
slashdevandroid said:
Awesome! TYVM!
I soft-bricked my 5560 as well-- ended up using adb's shell to reboot into the stock recovery, clear both the data and cache, then rebooted and.. it started up fully stock with no issues that I can see..
Quick question -- how did you get the YGDP to actually extract the *.imgs? Using procmon I've seen YGDP read from the CPB but never write to any files..
Click to expand...
Click to collapse
The XML config for the phone that presumably tells YGDP how to flash it is stored in dProdRes.dll. Using Resource Hacker or another resource editing application you can edit the XML value for UnzipCPB to "1" in the 5560S section, which causes YGDP to extract (more accurately "split" since the file isn't compressed in any way) the CPB file into the DownloadFiles directory. I've added my modified version of dProdRes.dll to the Google Drive folder referenced above - the md5sum for the original file should be 1041E39DF18B86E9945B4A8601E6ACD7 and the modified file should be E3C5538235B0742425B84D97DF066972.
keebler64 said:
Here are some crappy pics of the insides, I didn't see any specific headers for any UART or JTAG, but they could be multiplexed with other pins. I'll get around to actually desoldering the RF shields some day and using the Nikon D90 for the pics instead of the iPhone.
i.imgur.com/8Ywkt0l.jpg
i.imgur.com/UUiyKXa.jpg
i.imgur.com/EnVfhWM.jpg
i.imgur.com/M2XzlCi.jpg
i..imgur.com/8Ywkt0l.jpg
Click to expand...
Click to collapse
Awesome ty!
stevenmirabito said:
The XML config for the phone that presumably tells YGDP how to flash it is stored in dProdRes.dll. Using Resource Hacker or another resource editing application you can edit the XML value for UnzipCPB to "1" in the 5560S section, which causes YGDP to extract (more accurately "split" since the file isn't compressed in any way) the CPB file into the DownloadFiles directory. I've added my modified version of dProdRes.dll to the Google Drive folder referenced above - the md5sum for the original file should be 1041E39DF18B86E9945B4A8601E6ACD7 and the modified file should be E3C5538235B0742425B84D97DF066972.
Click to expand...
Click to collapse
Outstanding -- thanks for the explanation.
Playing around a bit today noticed:
-YGDP ignores the unzipped files and procmon shows even if YGDP unzips the CPB it still simply reads from the CPB. Tried playing around with the downmod="" section in the XML but YGDP still ignores the zips.
-Did notice that a few of the other coolpads had custom CPB's that only had the recovery in them. Perhaps its time to reverse engineer a file format..
slashdevandroid said:
Did notice that a few of the other coolpads had custom CPB's that only had the recovery in them. Perhaps its time to reverse engineer a file format..
Click to expand...
Click to collapse
I noticed that too, and it seems that the community for other models had figured out how to do exactly that. Unfortunately, I couldn't find any documentation or tutorials online and didn't receive a response from the one or two people that I contacted.
stevenmirabito said:
I noticed that too, and it seems that the community for other models had figured out how to do exactly that. Unfortunately, I couldn't find any documentation or tutorials online and didn't receive a response from the one or two people that I contacted.
Click to expand...
Click to collapse
Same.. We'll keep lookin!
Ty again for all your input in this.. sometimes we all have a bit of the puzzle.
Why cxant anyone figure this out?
It seems that since this is a excellent phone that can literally be purchased for $9.99 at King Soopers, that a lot of people would have them even if just for a backup phone. I figured there would be a lot of ROM's, Recovery's, ect... ANYONE, PLEASE HELP US!!!:good:

Note 8 N950U QDL9008 / EDL Mode - Unbrick Rom is HERE

This is not for soft bricked devices.
This is for hard bricked devices that cant go into recovery or download mode.
This is for devices on the Version 2 Bootloader like samfail v2 or any normal V2 bootloader.
It may work on other bootloader versions with some modification.
If you have a hard bricked device let me know and I will help you test this.
I don't want to just post the files and have people cause bricks by flashing this to non-v2 bootloaders.
People with other versions of the bootloader and a bricked device let me know and we will test some things.
If you need this let me know and we will do some testing.
How to Unbrick
First you need to install the drivers for QDL.
Option A is to install QPST.
I think then the drivers will automatically install in windows when you connect a device in edl mode.
Or you can manually choose the driver to install if you know how.
I will upload both.
Get the device in EDL mode.
It might go automaticall (hopefully).
If not you need a EDL Cabel or Deep Flash Cable.
Theres instruction around how to make one.
After device is in edl mode and connected to the computer open windows device manager.
Under Ports you should see .
https://photos.app.goo.gl/ibD8KYy9GVQFvJheA
I doubt you will see Portable Devices. I have it because of a special sd card.
After you see Qualcomm-HS-USB QDloader under ports your ready to unbrick.
Copy the N950U2 FOLDER TO C:\ ON YOUR COMPUTER.
Open command prompt as administrator.
In search bar in windows type cmd
Right click on command prompt and run as administrator.
cd to the n950u folder
Code:
cd c:\N950U2
https://photos.app.goo.gl/VzJjwsU6NWLdyDCc6
type
Code:
N950U2_Recovery.bat
You should get this window.
https://photos.app.goo.gl/F7hcuPCCqrci9A1KA
type the com port of your edl device and hit enter.
Be sure to copy the log in the terminal window and save it to share with us later.
Heres the files.
https://www.mediafire.com/file/9bb4vgx1kmir4gz/QPST.2.7.472_2018.zip/file
https://www.mediafire.com/file/eo9wcbtdle1xsc8/Qualcomm_Drivers_QDLoader.zip/file
https://www.mediafire.com/file/dfzy3zo8ibrh1p7/Unbrick-Samsung-Qualcom-9008-Files.zip/file
After the flash completes the phone should boot to download mode.
If not try to boot it to download mode.
Look at secure boot status and all of that when you boot to download mode.
If you dont see it power the device off then reboot into download mode again.
Were looking for any change in the bootloader status.
Maybe the edl bootloader is unlocked.
After that its just normal flash by ODIN back to whater you were on.
PLEASE REPORT BACK YOUR EXPERIENCE WHEN YOU DO THIS.
Note I had screenshots but there not showing. Ill try to fix them. Just Click the links for now.
link not working
can you redo the link for the last download please
lilbowza1985 said:
can you redo the link for the last download please
Click to expand...
Click to collapse
All links are working for me.
If you are going to flash the EDL let me know.
I would be grateful to help you see what the state of the edl bootloader is.
Possibly unlockable!!
Please update to BL v5 if possible.
Hey I just gave it a shot to the steps and it did not work. I think maybe because my n8 has a higher BL version, I think v5 actually. Thanks for the post. Hope you could help out updating the recovery to a BL v5. Here are the logs I got.
Input Port Number[1~300,x:Exit]:10
10
Start Recovery.
emmcdl.exe -p COM10 -f prog_ufs_firehose_8998_ddr.elf -MemoryName ufs -SetActivePartition 1 -x rawprogram0.xml -x rawprogram1.xml -x rawprogram2.xml -x rawprogram3.xml
Version 2.10
Downloading flash programmer: prog_ufs_firehose_8998_ddr.elf
Successfully open flash programmer to write: prog_ufs_firehose_8998_ddr.elf
Expecting SAHARA_END_TRANSFER but found: 0
!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Programming UFS device using SECTOR_SIZE=4096
<?xml version = "1.0" ?><data><configure MemoryName="ufs" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>

ERROR: No response to configure packet
Status: 21 The device is not ready.
Finish!!
I got the same error,
I got the same error.......
Can i use this for g892u rev 3
BigCountry907 said:
All links are working for me.
If you are going to flash the EDL let me know.
I would be grateful to help you see what the state of the edl bootloader is.
Possibly unlockable!!
Click to expand...
Click to collapse
my phone cant turn on,i cant go to recovery mode and download mode,what i must do?
plz help
qban-it-solution said:
Hey I just gave it a shot to the steps and it did not work. I think maybe because my n8 has a higher BL version, I think v5 actually. Thanks for the post. Hope you could help out updating the recovery to a BL v5. Here are the logs I got.
Input Port Number[1~300,x:Exit]:10
10
Start Recovery.
emmcdl.exe -p COM10 -f prog_ufs_firehose_8998_ddr.elf -MemoryName ufs -SetActivePartition 1 -x rawprogram0.xml -x rawprogram1.xml -x rawprogram2.xml -x rawprogram3.xml
Version 2.10
Downloading flash programmer: prog_ufs_firehose_8998_ddr.elf
Successfully open flash programmer to write: prog_ufs_firehose_8998_ddr.elf
Expecting SAHARA_END_TRANSFER but found: 0
!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Programming UFS device using SECTOR_SIZE=4096
<?xml version = "1.0" ?><data><configure MemoryName="ufs" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>

ERROR: No response to configure packet
Status: 21 The device is not ready.
Finish!!
Click to expand...
Click to collapse
i have same problem..
Note 8 Bricked after using COMBINATION_FA71_N950USQU5ARJ1_CL13942288_QB203914 89_REV00
seansha said:
i have same problem..
Click to expand...
Click to collapse
Did you get an answer? I can't find a firmware that will work! I'm totally bricked
I flashed this:
COMBINATION_FA71_N950USQU5ARJ1_CL13942288_QB20391489_REV00_user_mid_noship_MULTI_CERT.tar
And i was bricked after.
m4r20 said:
Did you get an answer? I can't find a firmware that will work! I'm totally bricked
I flashed this:
COMBINATION_FA71_N950USQU5ARJ1_CL13942288_QB20391489_REV00_user_mid_noship_MULTI_CERT.tar
And i was bricked after.
Click to expand...
Click to collapse
I am having the same problem and I was working off of the guide to install EDL and Root the Phone Here: https://forum.xda-developers.com/galaxy-note-8/development/root-t3942403
I have been searching for a way to resolve the same behavior and found this post. I noticed the original Guide I followed did not have me install any Qualcomm drivers, I am HOPING to do so using the ones provided here may fix things.
I am also not really happy with the CMD script they used in both this and the other method, it makes the process harder by using a setp to pause at the end instead of a pause or something obvious and by setting the max lines on the CONsole to 40 which over-flowed my screen, so I had to comment it out. Also not sure why they didn't just list the ports in a menu and have you choose or try to guess for you based off how they get it. But thats just somme griping.
I am HOPINNG that the FACTORY BINARY >>>>>> screen I get to in my phone is "EDL" it's unclear to me from the info on these sites, rooting guides have continued to become less clear over the years assuming everyone knows every step like the back of their hands.
im stuck here too. its like I have no bootloader, and I cant flash. no download mode, no recovery. No light when I plug it in to charge...just upload mode. the phone was on BL 6.
Bricked here as well...Same error with failed to load flash programmer..Still stabbing at it with no results as of yet.
please keep me in the loop
Surgeman said:
Bricked here as well...Same error with failed to load flash programmer..Still stabbing at it with no results as of yet.
Click to expand...
Click to collapse
A lot of people don't listen or read anything and @BigCountry907 specifically said this is for bootloader version 2 and it might work for others with "SOME MODIFICATION" but anyone with common sense would know this isn't going to work on version 5 of the bootloader!!
MrMike2182 said:
A lot of people don't listen or read anything and @BigCountry907 specifically said this is for bootloader version 2 and it might work for others with "SOME MODIFICATION" but anyone with common sense would know this isn't going to work on version 5 of the bootloader!!
Click to expand...
Click to collapse
I beg the differ....I have actually got it to flash using the old bootloader jig for the older Notes..But it won't repair the eMMC portion...
@MrMike
Check PM
Sent from my SM-N975U using Tapatalk
My phone is currently the same. If only I could get into edl mode, it would be fixed. But I don't know how to get into edl mode using only hardware
Can I ask a question. A HOW TO exactly would be awesome. Ok I have Sm-N950U running 7.1.1 you know with the 80% only battery. All runs great. Its the Snapdragon version. HOW can I get it back to before I got it this way. Before I did all this it had.. I forget V6..somthing.
Or can you point me to somewhere that really explains this. Getting it to 7.1.1 seem easy vs now trying to get it back.
Thanks
Hi @BigCountry907, i used your method n950u2 with QFIL on my n950w (N950WVLS7DTA1) by enter EDL mode, but got no luck.
Below is the log of QFIL:
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\KN\AppData\Roaming\Qualcomm\QFIL\COMPORT_6
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\temp\n950w\UnbrickQC-9008\N950U2\prog_ufs_firehose_8998_ddr.elf
21:19:39: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
21:19:39: ERROR: function: sahara_main:924 Sahara protocol error
21:19:39: ERROR: function: main:303 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
Finish Download
I also tried with eMMC Dongle app but no luck also.
Loading GUID Partition Table
EMPTY SKIPPING
=> it's mean the main partition is corrupted
Would you mind help me by teaching me the correct way to booting from sdcard then repartition the main Qualcomm’s memory?
The problem of brick: i messed up the Qualcomm’s partition while playing around with "boot.img dqmdbg.img.ext4 storsec.mbn msadp.mbn apdp.mbn sec.dat recovery.img NON-HLOS.bin xbl.elf tz.mbn abl.elf bksecapp.mbn keymaster.mbn cmnlib64.mbn rpm.mbn hyp.mbn cmnlib.mbn devcfg.mbn pmic.elf adspso.bin modem.bin" then flash with Oddin via BL slot.
Many thanks and best regards!

EDL TEST PINS MOTO G9 POWER

I'm looking to pinout both test pins. I bought this phone a few days ago. I unlocked it with TWRP, I looked at the possibilities. I made a mistake with TWRP by switching the system to sideload B (I chose between A and B) and the system refused to start. I do not have access to the bootloader with the buttons. I only enter QDLoader HS-USB Driver mode working. I read the instructions on how to make a blank flash. I took the 18 files out of the phone and made a new blank flash for this model - moto g9 power / but in the end it gives me an error. Now I'm looking for a solution. - "C: \ Documents and Settings \ Administrator \ Desktop \ MOTO G9 POWER blankflash \ Blankflash for G9 POWER>. \ Qboot.exe blank-flash Motorola qboot utility version 3.86 [0.000] Opening device: \\. \ COM4 [0.000] Detecting device [0.000] ... cpu.id = 333 (0x14d) [0.000] ... cpu.sn = 2936128399 (0xaf01c38f) [0.000] Opening singleimage [0.000] Loading package [0.000] ... filename = pkg.xml [0.000] Loading programmer [0.000] ... filename = programmer.elf [0.000] Sending programmer [0.156] Handling things over to programmer [0.156] Identifying CPU version [0.156] Waiting for firehose to get ready [3.297] ... SM_KAMORTA_H 1.0 [3.297] Determining target secure state [3.297] ... secure = yes [3.375] Configuring device ... [3.391] Flashing GPT ... [3.391] Flashing partition with gpt.bin [3.406] Initializing storage [3,484] ... blksz = 512 [37.016] Re-initializing storage ... [37.016] Initializing storage [37328] Flashing bootloader ... [37.344] Flashing abl_a with abl.elf [37.344] partition abl_a not found! [37.359] ERROR: do_package () -> do_recipe () -> do_flash () -> pt_find () -> not found [37.375] Check qboot_log.txt for more details [37.375] Total time: 37.375s FAILED: qb_flash_singleimage () -> do_package () -> do_recipe () -> do_flash () -> pt_find () -> not found "the last message puzzles me. I want to transfer the system to sideload A again, so I have to reset the device firmly. Are there people familiar with the possibilities?
2 I built a blankflash for the Moto G8
1 How To Blank Flash & Fix/Repair Hard Bricked Motorola Devices/Moto G8+|Tutorial Get It Working Again - YouTube
Version Bootloader MBM-3.O-cebu retail 232f3ba894-201209
motostockrom.com/motorola-moto-g9-power-xt2091-3
I'm looking to pinout both test pins.
Have you tried using LMSA?
It recovered a dead phone for me once.
Rescue and Smart Assistant (LMSA)
Also, I too once accidentally switched slot to B, and system didn't boot. However, I was able to get into fastboot mode and switch by entering the command to switch slots.
https://support.lenovo.com/bg/en/downloads/ds101291 i saw this but my computer is 32 bit / i am looking for the program qualcomm edl mode flash tool or something like Axon10Pro_ (More) _EDL_Tools_v1.1d because i want to make active a siteloader because i saw that this can be done not so difficult otherwise for edl pinout I saw how it works and no problem
man88nam said:
https://support.lenovo.com/bg/en/downloads/ds101291 i saw this but my computer is 32 bit / i am looking for the program qualcomm edl mode flash tool or something like Axon10Pro_ (More) _EDL_Tools_v1.1d because i want to make active a siteloader because i saw that this can be done not so difficult otherwise for edl pinout I saw how it works and no problem
Click to expand...
Click to collapse
qualcomm edl mode flash tool / Axon10Pro_ (More) _EDL_Tools_v1.1d
In those .XML files, can you delete the line that says "abl" and try again?
I will do, but these files can be downloaded according to the instructions on how to make closed files extracted from the phone itself
https://www.reddit.com/r/MotoG/comments/k73n66
I downloaded from the bootloader 18 files that are original, this is in connection with blank flash, where in the end there is an error, because eight made active "B" sector instead of A
I removed the ABL file from the XML, but the error remains, plus the message for a missing ABL file ELF
[ 37.297] file abl.elf not found in singleimage.bin!
[ 37.297] ERROR: do_package()->do_recipe()->do_flash()->not found
[ 37.297] Check qboot_log.txt for more details
[ 37.297] Total time: 37.297s
I'm just looking for an EDL program that works similar to this command line Set Bootable Partition- Slot A / run_AB-partition-swap - but here it wants some text file for the presence of a port, port_trace.txt
I'm sorry, I can't help further here. Even though the active slot is B, the partition abl_a should exist and should be flashable regardless. It looks as though there isn't such a partition at all, which I don't even know how that happened.
The tool which you are using is correct, it's doing its job properly. Are you sure you have the right firmware version and software channel? Because bootloader.img differ depending on the firmware version and the carrier. I'd also suggest downloading from https://mirrors.lolinet.com/firmware/moto/cebu/official/, instead of the link you mentioned, motostockroms.
Also, try asking in this Telegram group: https://t.me/lolinet. There are people on there who are more knowledgeable, maybe they can help.
After trying the firmware image from lolinet and trying the process again with that firmware, I'd try to get into bootloader mode once again through power buttons, and if that doesn't work, send the phone into the service center.
Motorola_Moto_G9_Power_XT2091-3_RETUK_CEBU_RETAIL_QZC30.Q4-22-57_10_by_(motostockrom.com) With the TWRP program I chose with active slot B / I don't know if it deleted the content from slot A of the bootloader. By the way, I downloaded the original product firmware XT2091-3 according to the instructions for this, which I get when I try blank flash / I have no idea what to do, so I'm looking for a program "qualcomm edl mode flash tool" and I constantly get Indian sites with dangerous behavior.
I thank you for your time
Hey,
Today I found EDL points for Moto G9 power. Infact im also facing firmware issue.
I accidentally locked bootloader with stockrom again trying to unlock but not working.
Causing No valid OS to boot.
if i try unlock again showing message like " enable OEM unlocking in developer options"
unfortunately not podsible. But still waiting for proper EDL flash tool.
feel free to guide if any one got resolution.

How To Guide [GUIDE] [T220/T225] Flash a GSI on the A7 Lite (without TWRP)

Hi everyone, this is a short guide on how to flash a GSI on the A7 Lite (without TWRP).
Its a nice little tablet for the price but it doesn't have a very powerful SOC and for me the One UI is barely usable on this device. The launcher and the whole system UI feel extremely laggy, but apps generally run fine.
I tried phhusson's custom Android 12 GSI and the device was almost resurrected. Much much less UI lag and the battery life is the same as stock ROM. The only thing i found not working is MTP but i don't need it.
Since i saw a couple users here asking about GSIs i decided to make a very simple guide.
As always do this at your own risk. You may brick your device. You will void your warranty.
Follow the guide only if you know what your are doing. Read each step carefully and avoid copy pasting stuff randomly.
I won't go deep into details as i believe you should have some basic knowledge if you decide to do this.
The procedure sould work for both T220 and T225 (i tested it on a T220).
I did this on Windows using WSL for some of the steps.
Sources​
Thanks to @kkoo and @Brepro1 for the useful info
- https://forum.xda-developers.com/t/...sing-odin-without-twrp-phh-lineageos.4114435/
- https://forum.xda-developers.com/t/...r-img-and-flashing-our-modifications.4196625/
Requirements​
- Unlocked bootloader
If you haven't done this already follow the steps in parts 1-2 from:
[TUTORIAL] How To Unlock & Root Tab A7 Lite T220/T225, & Install LSPosed, Magisk, Mods
While some of these instructions are copied from other sources, I combined all the different things I learned, because no one guide was sufficient, and all needed additional info, so I expanded it all to one place. Part I is partly from...
forum.xda-developers.com
- Latest official ROM
I used T220XXU1AVE1 for EUX region
Samsung Galaxy Tab A7 Lite Firmware Download SM-T220 Free Download
Samsung Galaxy Tab A7 Lite Firmware Download SM-T220 Free Download ⭐ Official and fast update ⭐ Max speed and free download ⭐ Best Samsung Galaxy website
samfw.com
- Download your preferred GSI
I used AOSP 12.1 v414 with gapps from phhusson
Releases · phhusson/treble_experimentations
Notes about tinkering with Android Project Treble. Contribute to phhusson/treble_experimentations development by creating an account on GitHub.
github.com
- Clean vbmeta.img from Google
https://dl.google.com/developers/android/qt/images/gsi/vbmeta.img
Tools​
- lz4
Releases · lz4/lz4
Extremely Fast Compression algorithm. Contribute to lz4/lz4 development by creating an account on GitHub.
github.com
- simg2img
[DEV][Tools] simg2img for Windows
Hello, although I'm working in Linux (VM too) I rewrote the SIMG2IMG so far for Windows (PE32, x86) Usage: simg2img.exe -i -o Optional: -d for debugging messages, listing all chunks of the image...
forum.xda-developers.com
- lpunpack and lpmake
[GUIDE] OTA Tools LPUnpack
Please see this URL https://android.googlesource.com/platform/build.git/+/eec4a7cba4face3370acb6293ab357879920b467 and this for more information. Hi everyone. I'm surprised I havent seen a thread about ota tools yet and lpunpack. This zip file...
forum.xda-developers.com
- tar-md5-script-tool
Use the attached tar-md5-script-tool.zip
Steps​
1. Extract official ROM files (BL, AP, CP, CSC)
2. Extract AP .tar.md5
3. Decompress the extracted super.img.lz4
Code:
lz4 -d super.img.lz4 super.img
4. Convert the sparse super.img
Code:
simg2img super.img super.ext4.img
5. Unpack super.ext4.img
Code:
lpunpack super.ext4.img
I got 4 partitions in my image (should be the same for all T220/T225 ROMs):
- odm.img
- product.img
- system.img
- vendor.img
6. Replace system.img with your GSI (rename it to system.img)
7. Get the size of all partitions and the size of the original super.ext4.img (not the sparse super.img)
Code:
stat -c '%n %s' IMG_FILE.img
8. Repack super.img
Code:
lpmake --metadata-size 65536 \
--super-name super \
--metadata-slots 2 \
--device super:ORIGINAL_SUPER_IMG_SIZE \
--group main:SUM_OF_ALL_PARTITIONS_SIZES \
--partition odm:readonly:ODM_PARTITION_SIZE:main \
--image odm=./odm.img \
--partition product:readonly:PRODUCT_PARTITION_SIZE:main \
--image product=./product.img \
--partition system:readonly:SYSTEM_PARTITION_SIZE:main \
--image system=./system.img \
--partition vendor:readonly:VENDOR_PARTITION_SIZE:main \
--image vendor=./vendor.img \
--sparse \
--output ./super_new.img
Replace ORIGINAL_SUPER_IMG_SIZE, SUM_OF_ALL_PARTITIONS_SIZES, ODM_PARTITION_SIZE, PRODUCT_PARTITION_SIZE, SYSTEM_PARTITION_SIZE, VENDOR_PARTITION_SIZE with the values you obtained in step 7.
Read lpmake docs for a more detailed expalation of the args used above:
partition_tools - platform/system/extras - Git at Google
9. Compress the repacked super_new.img
Code:
lz4 -B6 --content-size super_new.img super_new.img.lz4
10. Compress the clean vmbeta.img
Code:
lz4 -B6 --content-size vbmeta.img vbmeta.img.lz4
11. Extract tar-md5-script-tool.zip
12. Put all the *.img.lz4 files extracted from AP .tar.gz in tar-md5-script-tool dir
13. Replace super.img.lz4 and vbmeta.img.lz4 in tar-md5-script-tool dir with your repacked and compressed super_new.img.lz4 (rename it to super.img.lz4) and the clean compressed vbmeta.img.lz4
14. Run batch.bat in tar-md5-script-tool dir
You will find the new AP .tar.md5 in the temp-folder subdir
15. Flash your custom AP .tar.md5 with Odin along with BL, CP, CSC from original ROM
16. Reboot into recovery and do a factory reset
17. Done
Can you share screenshot as I think treble projects are only stable on SD chipset.
Abish4i said:
Can you share screenshot as I think treble projects are only stable on SD chipset.
Click to expand...
Click to collapse
System lang is italian but should be easy to understand.
I found only a couple bugs so far in phhusson's GSI:
- in the launcher dragging apps from drawer to homescreen doesn't always work (just use another launcher)
- crashed once while searching in settings app
I use the tablet only for media consumption and some retrogaming, so there are probably other bugs i haven't noticed.
This is a generic guide, it won't include a "known issues" section since it largely depends on what GSI you choose.
I haven't tested this on the LTE version so i can't say for sure if mobile network works or not.
Unfortunately i don't have the time to make a custom ROM, test it and keep it updated here on the forum but maybe if there is enough interest someone will do it.
I hope other users will try to flash a GSI and share their experience here so we can gather some info on working/broken stuff, especially on the LTE model since i can't test that.
Hello,
I'm sorry but what am I missing here?
I'm a little fustrated cause after hours and hours of headaches I got to the second to last step which involves tar-md5-script-tool
I simply put all the .img.lz4 files from AP and replace super & vbmeta files which the ones that I converted and try to run the batch.bat as instructed.
However nothing happens and this is what the program spits out.
On the tar tool xda forum it says that it convers .img files, not .img.lz4 . Are we supposed to extract all the .img files from inside the .lz4 files?
I appreciate the guide but there are a lot of missing details I had to fill in and figure out myself, like the fact that from step 4 to step 8 you need to use WSL or a Linux distro (using simg2img for Windows messes things up so please use the one from otatools inside a linux bash)
Also for people that are not familiar with linux you need to type "./" in front of directed commands ( in this case ./simg2img ./lpunpack ./lpmake)
I'm not a developer or a programmer, maybe you wrote this guide for people more inclined to that, but for me this was pretty hard.
Noob here, but I'm running the "simg2img super.img super.ext4.img" and nothing happens for 5 min and when I'm aborting I'm getting a "Error reading sparse file header".
Any suggestions?
DanneSwe said:
Noob here, but I'm running the "simg2img super.img super.ext4.img" and nothing happens for 5 min and when I'm aborting I'm getting a "Error reading sparse file header".
Any suggestions?
Click to expand...
Click to collapse
Are you using the Windows version of simg2img? If yes, use the one from otatools inside Windows Subsystem for Linux
ReubenMCSM said:
Are you using the Windows version of simg2img? If yes, use the one from otatools inside Windows Subsystem for Linux
Click to expand...
Click to collapse
I can confirm simg2img doesn't seem to work on Windows, i used WSL.
@ReubenMCSM i will update the guide with more details in the future but i don't have much time right now.
For you specific issue, try to use the attached tar-md5-script-tool.
Great thanks!
What's the process with tar-md5-script-tool? Just moving the super.img to the folder and running the batch.bat didn't work the output file in the temp folder is 11 kb. Tried to change super.img to super.tar but no change.
Thanks for the tool, but unfortunately the output is the same, like the problem @DanneSwe has
It looks like the batch.bat script from the tar md5 tool linked in the guide is a bit different from the one i used. I will update the guide.
Try again with the version i attached in the post above.
- Extract the AP tar md5 from official rom
- Copy all .img.lz4 files in the tar-md5-script-tool folder
- Replace super.img.lz4 and vbmeta.img.lz4 (step 13)
- Launch batch.bat, output should look like this
- You will find AP_TAR_MD5_CUSTOM_FILE_ODIN.tar.md5 in temp-folder
It finally worked! I redid everything and also moved my folder to drive C instead of drive D, maybe this made the difference
ReubenMCSM said:
It finally worked! I redid everything and also moved my folder to drive C instead of drive D, maybe this made the difference
Click to expand...
Click to collapse
What GSI did you pick and could you upload the files you flashed?
I got simg2img to work by using
.\simg2img -i super.img -o super.ext4.img
packed img filename: super.img
output img filename: super.ext4.img
Wrote "super.ext4.img"
The lpunpack and lpmake step isnt working for me ive been at this for days, no luck.
Can someone please help me out by uploading custom AP .tar.md5(file with GSI, the modded one) along with BL, CP, CSC from original ROM to google drive?
thanks!
ramz.pa said:
The lpunpack and lpmake step isnt working for me ive been at this for days, no luck.
Can someone please help me out by uploading custom AP .tar.md5(file with GSI, the modded one) along with BL, CP, CSC from original ROM to google drive?
thanks!
Click to expand...
Click to collapse
I had the same issue. :/
Can someone help me with the T225 LTE model by compiling the AP please? Because for some reason the tar-md5-script tool isnt working for me
Thanks.
Successfully flashed GSI with magisk on my T220 following the OP's procedure. MTP is not working as the OP said. However, I can use my flash drive so I don't really miss MTP.
I chose "system-squeak-arm64-ab-vndklite-gapps-secure.img.xz" for GSI. "Treble Info" app can tell you what image would be compatible with your device.
If you want to use a different launcher like Nova instead of the default one, change the "Smallest width" setting from 600 to 598 in Developer options to hide the annoying taskbar.
AOSP-Mods and "Project Themer - Android 12+" work fine for me.
Here is my build for my device SM-T220 (SM-T220_EUX_T220XXU1AVE1):
GSI: system-squeak-arm64-ab-vndklite-gapps-secure.img.xz
Custom AP: https://www.filehosting.org/file/details/7045394/AP_TAR_MD5_CUSTOM_FILE_ODIN.tar.md5
Custom AP with Magisk patch: https://www.filehosting.org/file/details/7045714/magisk_patched-25101_cauJQ.tar
You can extract BL and Home_CSC from SM-T220_EUX_T220XXU1AVE1.
Notes: My device is actually SM-T220 XAR, but I have been updating it with SM-T220 EUX firmware versions without any issue.
Pleasance said:
Can someone help me with the T225 LTE model by compiling the AP please? Because for some reason the tar-md5-script tool isnt working for me
Thanks.
Click to expand...
Click to collapse
Here is the custom AP based on the following. Since I don't have SM-T225 device, can't verify it. However, I compiled the AP the same way I did for my SM-T220.
- SM-T225_EUX_T225XXU1AUJ1
- GSI: system-squeak-arm64-ab-vndklite-gapps-secure.img.xz
https://www.filehosting.org/file/details/7046296/AP_TAR_MD5_CUSTOM_FILE_ODIN.tar.md5
xpdragon said:
Here is the custom AP based on the following. Since I don't have SM-T225 device, can't verify it. However, I compiled the AP the same way I did for my SM-T220.
- SM-T225_EUX_T225XXU1AUJ1
- GSI: system-squeak-arm64-ab-vndklite-gapps-secure.img.xz
https://www.filehosting.org/file/details/7046296/AP_TAR_MD5_CUSTOM_FILE_ODIN.tar.md5
Click to expand...
Click to collapse
Thank you so much for compiling the AP for me bro but when i try to flash it with odin i get this error
<ID:0/004> Firmware update start..
<ID:0/004> SingleDownload.
<ID:0/004> preloader.img.lz4
<ID:0/004> FAIL!
For your information the current OS build on my tablet is INS with the baseband version of T225XXU1AVB2 and security patch of 1 Feb 2022 hope this helps you.
DanneSwe said:
What GSI did you pick and could you upload the files you flashed?
I got simg2img to work by using
.\simg2img -i super.img -o super.ext4.img
packed img filename: super.img
output img filename: super.ext4.img
Wrote "super.ext4.img"
Click to expand...
Click to collapse
GSI-12_SM-T220_EUX_T220XXU1AVE1_fac.zip
drive.google.com
Use this ONLY on SM-T220 (without SIM card) and on EUX version.
Pleasance said:
Thank you so much for compiling the AP for me bro but when i try to flash it with odin i get this error
<ID:0/004> Firmware update start..
<ID:0/004> SingleDownload.
<ID:0/004> preloader.img.lz4
<ID:0/004> FAIL!
For your information the current OS build on my tablet is INS with the baseband version of T225XXU1AVB2 and security patch of 1 Feb 2022 hope this helps you.
Click to expand...
Click to collapse
Here is GSI build for SM-T225_INS_T225XXU1AVB2
https://www.filehosting.org/file/details/7129248/GSI-12_SM-T225_INS_T225XXU1AVB2.zip

Categories

Resources