there is a method to unlock the bootloader of this device. researched and found nothing about it
therafael1910 said:
there is a method to unlock the bootloader of this device. researched and found nothing about it
Click to expand...
Click to collapse
Unlocking the Bootloader | Motorola Support US
Visit the customer support page to view user guides, FAQs, bluetooth pairing, software downloads, drivers, tutorials and to get repair and contact us information.
motorola-global-portal.custhelp.com
And
[Guide]Un/locking Motorola Bootloader
UnLocking and ReLocking Motorola Bootloader https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a Moto Bootloader Unlocking site Re-Locking see Post #4 More about bootloader UnLocking Post #2 Can my...
forum.xda-developers.com
It's not possible to unlock the bootloader on the G8 power lite, only the G8/G8 power.
aryanhington said:
It's not possible to unlock the bootloader on the G8 power lite, only the G8/G8 power.
Click to expand...
Click to collapse
Says who? This is blackjack/XT2055?
sd_shadow said:
Says who? This is blackjack/XT2055?
Click to expand...
Click to collapse
I can confirm that it's not possible on the XT2055-1 running Mediatek MT6765 SoC
Did anyone try this? Can someone confirm if this works for you?
link
or folllowed this
read my post
aryanhington said:
read my post
Click to expand...
Click to collapse
It is easily possible, stop spreading BS
It cannot be done using fastboot but it is certainly possible using the Realtek VCOM USB protocol
Rooting Moto G8 Power Lite
Does anyone know where I can find a decent guide to rooting the G8 Power Lite (if one exists - I know it's only been out a few months)? I've had a Google around and looked on this forum and on reddit but I can't find anything. I haven't done...
forum.xda-developers.com
This video sums it up well
Essentially you need to:
1. download MTKCLIENT from github, works best on Linux IMHO but Windows works too - on Windows you need additional USB drivers and MTK Drivers, which i attached. Use PIP to install the requirements by going into the MTKCLIENT directory and typing into CMD/Terminal: python3 pip install -r requirements.txt
2. Copy the G8 power Lite specific script to the root folder of the MTKCLIENT
3. Open up the phone, remove the plastic covering the cameras and motherboard. Unplug the battery. Short these two pins either by soldering them together or just using something metal - this is only necessary during the flash and then should be removed.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Plug in usb cable to the phone but dont connect it to the pc yet. Start the program either by CD-ing to the MTKCLIENT directory and running it via CLI (on Linux: python3 mtk w proinfo,seccfg proinfo.bin,seccfg.bin, (only use this in case you wiped the bootloader in order to reflash it, the actual unlocking is done by using this generic command: python mtk da seccfg unlock) or doubleclicking the desbloq_bootloader.bat on Windows (which again contains the first command, which should only be used if the bootloader is corrupted or so, unlock using second command from terminal) . Then short the two pins, keep them shorted and connect the USB cable to the PC. You should see a bunch of code scroling, it will automatically close/end.
5. Unplug USB, remove short circuit from two pins, plug in battery, turn on phone, you should see lines of text during the boot like this:
Bootloader unlocked. Now the only use is ROOT, no custom ROMs or Recoveries available as its vastly different from normal G8 power, which has a Snapdragon CPU and totally different screen.
You'll also get a big "CARRIER INVALID" message on the home screen. I tried relocking the bootloader to fix it, but that put the phone into red state and I had to reflash the bootloader using the above mentioned command. On another note, when I trial and error-ed the unlocking process, I first used the bootloader reflash command (which effectively invalidated it) so that may be the sole cause of the invalid message and not the unlocking itself (as the message appeared after reflashing and before unlocking). If anyone tries this, just use python mtk da seccfg unlock and report back.
FakedKetchup said:
It is easily possible, stop spreading BS
It cannot be done using fastboot but it is certainly possible using the Realtek VCOM USB protocol
Rooting Moto G8 Power Lite
Does anyone know where I can find a decent guide to rooting the G8 Power Lite (if one exists - I know it's only been out a few months)? I've had a Google around and looked on this forum and on reddit but I can't find anything. I haven't done...
forum.xda-developers.com
This video sums it up well
Essentially you need to:
1. download MTKCLIENT from github, works best on Linux IMHO but Windows works too - on Windows you need additional USB drivers and MTK Drivers, which i attached. Use PIP to install the requirements by going into the MTKCLIENT directory and typing into CMD/Terminal: python3 pip install -r requirements.txt
2. Copy the G8 power Lite specific script to the root folder of the MTKCLIENT
3. Open up the phone, remove the plastic covering the cameras and motherboard. Unplug the battery. Short these two pins either by soldering them together or just using something metal - this is only necessary during the flash and then should be removed.
View attachment 5889467
4. Plug in usb cable to the phone but dont connect it to the pc yet. Start the program either by CD-ing to the MTKCLIENT directory and running it via CLI (on Linux: python3 mtk w proinfo,seccfg proinfo.bin,seccfg.bin, If it wont unlock using the custom G8 script, just run this generic command: python mtk da seccfg unlock) or doubleclicking the desbloq_bootloader.bat on Windows. Then short the two pins, keep them shorted and connect the USB cable to the PC. You should see a bunch of code scroling, it will automatically close/end.
5. Unplug USB, remove short circuit from two pins, plug in battery, turn on phone, you should see lines of text during the boot like this:
View attachment 5889471
Bootloader unlocked. Now the only use is ROOT, no custom ROMs or Recoveries available as its vastly different from normal G8 power, which has a Snapdragon CPU and totally different screen. You'll also get a big "CARRIER INVALID" message on the home screen, so after you ROOT make sure to relock the bootloader using the same method but the command is python3 mtk da seccfg lock
Click to expand...
Click to collapse
please can you kindly elaborate how you got proinfo.bin and seccfg.bin in the first place? also do you know if it uses any of the payload.bin files which are included with the mtkclient program?
aryanhington said:
please can you kindly elaborate how you got proinfo.bin and seccfg.bin in the first place? also do you know if it uses any of the payload.bin files which are included with the mtkclient program?
Click to expand...
Click to collapse
I have no idea where the files are from, I found them on the net but you know, it works so who cares
These files should work for some models of the Lite G8 as there are the UK models and a few more with the same name. I'm from Slovakia so these didn't work for me, but a generic MTK command python mtk da seccfg unlock did it just fine and I checked it's in fact unlocked by typing fasboot getvar all, and also the fact that on every boot there is a visible text saying that the bootloader is unlocked. It also shows that in developer options.
FakedKetchup said:
I have no idea where the files are from, I found them on the net but you know, it works so who cares
These files should work for some models of the Lite G8 as there are the UK models and a few more with the same name. I'm from Slovakia so these didn't work for me, but a generic MTK command python mtk da seccfg unlock did it just fine and I checked it's in fact unlocked by typing fasboot getvar all, and also the fact that on every boot there is a visible text saying that the bootloader is unlocked. It also shows that in developer options.
Click to expand...
Click to collapse
do you mean the file you attached bootloader_g8powerlite.zip , you dont know where desbloq_bootloader.bat, proinfo.bin , seccfg.bin are from? because they are not mentioned on https://github.com/bkerler/mtkclient
FakedKetchup said:
I have no idea where the files are from, I found them on the net but you know, it works so who cares
These files should work for some models of the Lite G8 as there are the UK models and a few more with the same name. I'm from Slovakia so these didn't work for me, but a generic MTK command python mtk da seccfg unlock did it just fine and I checked it's in fact unlocked by typing fasboot getvar all, and also the fact that on every boot there is a visible text saying that the bootloader is unlocked. It also shows that in developer options.
Click to expand...
Click to collapse
also how is the scatter file used ? i see you attached it but no mention on how its used
aryanhington said:
also how is the scatter file used ? i see you attached it but no mention on how its used
Click to expand...
Click to collapse
1. as i said i dont know, i found the files in the video description
2. scatter file is a useful file for flashing stuff like bootloaders though SP-Flash-Tools. I ripped it from the stock rom which i also just downloaded from the internet. I haven't tried flashing anything yet but it seems the scayyer file (and thus the MTK chip) deosnt allow flashing a nev recovery/bootloader/rom anything really. Need to check again later and play with it a bit more
FakedKetchup said:
1. as i said i dont know, i found the files in the video description
2. scatter file is a useful file for flashing stuff like bootloaders though SP-Flash-Tools. I ripped it from the stock rom which i also just downloaded from the internet. I haven't tried flashing anything yet but it seems the scayyer file (and thus the MTK chip) deosnt allow flashing a nev recovery/bootloader/rom anything really. Need to check again later and play with it a bit more
Click to expand...
Click to collapse
please can you post which error message you get? in theory you should be able to flash anything after the bootloader is unlocked, unless there is some secure boot or verity which is still enabled, which would need to be toggled off. i think you may have the wrong scatter file in that case
aryanhington said:
please can you post which error message you get? in theory you should be able to flash anything after the bootloader is unlocked, unless there is some secure boot or verity which is still enabled, which would need to be toggled off. i think you may have the wrong scatter file in that case
Click to expand...
Click to collapse
Yes i think there is another video on his channel showing that before flashing you need to once again short the 2 pins and execute another program, then flash using SP Tools. There is no error, but when i load up the scatter file, it shows bunch of partitions, none of which are named boot/recovery/bootloader etc. so i don't know if its actually possible. Also I recommend doing all this on Linux, much less hassle, but you will need to compile libpng-12 in order for SP Tools to work. On Ubuntu there should be a binary package in the repos but i used Debian and the package is not supported since release 16.04 so...
according to his channel, you can root it. He uses something called Avenger Box which i assume is some flahing hardware, but we can use SP Flash tools just fine
First, backup NVRAM using SP flash tools in the Readback section
Click ADD NEW and save it to a location on your PC
Then open up your scatter file and look for partition called NVRAM, see the lines "LINEAR START ADRESS", as well as PARTITION SIZE, enter these values to the readback popup menu as such:
(the values on the picture are not real)
Press OK, plug in your device with the shorted pins, press Readback ICON and see if its successful. I am not sure if disabling the protection is needed for readback, will attempt tomorrow.
Tutorial video or a generic guide
Then you can take advice from this video although he isn't using SP Tools so its not a step by step kind of thing. Also for some reason he refuses to share the unlock protection scripts as he is "running a business" by rooting these phones, what a clown , ill try to DM him and see if he shares it or whatever. Ill try to find a way to root it via SP but its a hit or miss.
Edit: Found the script on this exact website:
It's now easy to bypass MediaTek's SP Flash Tool authentication
A group of developers has created a Python utility to bypass the authentication routine of MediaTek SP Flash Tool. Check it out now!
www.xda-developers.com
So on some phones you hold downa volume button to flash but in our case we most likely need to short the 2 pins again
aryanhington said:
please can you post which error message you get? in theory you should be able to flash anything after the bootloader is unlocked, unless there is some secure boot or verity which is still enabled, which would need to be toggled off.
Click to expand...
Click to collapse
FakedKetchup said:
Yes i think there is another video on his channel showing that before flashing you need to once again short the 2 pins and execute another program, then flash using SP Tools. There is no error, but when i load up the scatter file, it shows bunch of partitions, none of which are named boot/recovery/bootloader etc. so i don't know if its actually possible. Also I recommend doing all this on Linux, much less hassle, but you will need to compile libpng-12 in order for SP Tools to work. On Ubuntu there should be a binary package in the repos but i used Debian and the package is not supported since release 16.04 so...
View attachment 5891625
according to his channel, you can root it. He uses something called Avenger Box which i assume is some flahing hardware, but we can use SP Flash tools just fine
First, backup NVRAM using SP flash tools in the Readback section
View attachment 5891651
Click ADD NEW and save it to a location on your PC
Then open up your scatter file and look for lines "LINEAR START ADRESS", as well as PARTITION SIZE, enter these values to the readback popum menu as such:
View attachment 5891667
Press OK, plug in your device, press Readback ICON and see if its successful. I am not sure if disabling the protection is needed for readback, will attempt tomorrow.
Tutorial video
Then you can take advice from this video although he isn't using SP Tools so its not a step by step kind of thing. Also for some reason he refuses to share the unlock protection scripts as he is "running a business" by rooting these phones, what a clown , ill try to DM him and see if he shares it or whatever. Ill try to find a way to root it via SP but its a hit or miss.
Edit: Found the script on this exact website:
It's now easy to bypass MediaTek's SP Flash Tool authentication
A group of developers has created a Python utility to bypass the authentication routine of MediaTek SP Flash Tool. Check it out now!
www.xda-developers.com
So on some phones you hold downa volume button to flash but in our case we most likely need to short the 2 pins again
Click to expand...
Click to collapse
in regards to not seeing the recovery partition etc on sp flash tool, its because the scatter file you have used doesnt contain those partitions. I can help you do a full readback of the rom via sp flash tool and create a proper scatter file for your device, because that one you used is most likely incomplete or for another device.
also you lost me at the part regarding libpng-12 , thats only used to render png files . you can come on libera.chat irc and i have created a channel called #motog8powerlite if you need help as its easier to communicate on there
aryanhington said:
in regards to not seeing the recovery partition etc on sp flash tool, its because the scatter file you have used doesnt contain those partitions. I can help you do a full readback of the rom via sp flash tool and create a proper scatter file for your device, because that one you used is most likely incomplete or for another device.
also you lost me at the part regarding libpng-12 , thats only used to render png files
Click to expand...
Click to collapse
libpng-12 is a dependency of the program, probably for the Welcome tab which is made out of pictures instead of a mark language elements...
In regards to the recovery partitions, i found out it is because on devices with A/B partitions, the recovery is merged into the boot.img file. Im not aware of any custom recoveries made for it.
Patching it for root is as straightforward as installing older version of Magisk App on any android phone, copying the stock boot.img anywhere on the device, then patching the file from the app and flashing using SP Tools.
I patched the boot.img from the stock rom. I also managed to successfully execute the bypass script. It used to throw out Missing Default Config error, but i found the default config on github (exploits-collection; attachments) and used that just fine - copy the contents of the archive into the root folder of the bypass utility:
So, in order to unblock the protection, one needs to SOLDER the two pins, any other method was extremely unreliable. On Windows, install LIBUSB drivers from the attached file or from sorceforge. Do it in such a way that you run the installer and you'll get to this popup:
then click next
and youll see bunch of devices. Now plug in the phone with unplugged battery and shorted pins, then wait till a new device pops up, could be called MTK Device or anything like that. You select it and install the libusb library to it. Unplug the phone.
CD into the Bypass Utility folder via CMD/Terminal and run as root: python3 main.py, but install the requirements beforehand (sudo) pip install pyusb pyserial json5 ( running the program as root, the dependencies may not carry over so install them as root as well)
If you did everything right, you should see a prompt saying "Waiting for device"
Then you keep the 2 pins shorted and plug in the phone, if all goes right you should see this output:
On linux, you need a custom patched kernel, either get the patch or get a prepatched kernel or live boot a FireOS iso.
from the README file:
## Usage on Linux
Skip steps 1-2 after first usage
To use this you need [FireISO](https://github.com/amonet-kamakiri/fireiso/releases) or [this patch](https://github.com/amonet-kamakiri/kamakiri/blob/master/kernel.patch) for your kernel
Prebuilt kernels for various distros are available [here](https://github.com/amonet-kamakiri/prebuilt-kernels)
1. Install python
2. Install pyusb, pyserial, json5 as root with command:
```
pip install pyusb pyserial json5
```
3. Run this command as root and connect your powered off phone with volume+ button, you should get "Protection disabled" at the end
```
./main.py
```
4. After that, without disconnecting phone, run SP Flash Tool in UART Connection mode
Click to expand...
Click to collapse
As long as you keep the phone plugged in, the protection is off, however i found myself often needing to re-run the script before each action that utilizes the bootrom.
Using the mentioned scatter file throws out errors. I tried to first remove the protection and then immediately run the NVRAM readback but it failed
Full guide https://forum.xda-developers.com/t/...d-flash-in-edl-with-no-auth-for-free.4229683/
I tried to make my own scatter file by using MTK Droid Tools, but this utility only supports MTK65xx and below CPUs, so it isnt possible in our case. I also tried a generic MTK6765 scatter but that didn't work either. Without the scatter file, the tool doesn't kow where to write the boot.img and thus its a dead end. I'll try to do this on a different PC see if anything changes but i highly suspect its just a wrong scatter file. I got it from this allegedly stock rom.
What i stumbled across is this mirror site, where basically every ROM this device ever had is uploaded, so i think ill start there.
HUGE EDIT:
Accidentally i didnt load up the scatter file from the ROM directory but instead from a different location, tus it didnt load all the other necessary parts. It seems like you have to flash everything, not just one part like recovery or bootloader. Or maybe you can flash a single thing and that is what the square checkboxes are for lol
Thus i can happily announce that i successfully flashed the boot.img, after which Root Checker wstill reported NON-ROOT. I installed MAGISK APP once again and it asked me to reboot to finalize, then it rebooted, i entered the Magisk app and rooted directly from the app. -and the phone is rooted !
Technically it could be possible to flash a custom ROM using this exact tool, although i can only imagine few of the hardware actually working without manually fixing ACPI etc.
It is certainly one of the most difficult root procedures, but nothing unusual in the world of reverse engineering
FakedKetchup said:
libpng-12 is a dependency of the program, probably for the Welcome tab which is made out of pictures instead of a mark language elements...
In regards to the recovery partitions, i found out it is because on devices with A/B partitions, the recovery is merged into the boot.img file. Im not aware of any custom recoveries made for it.
Patching it for root is as straightforward as installing older version of Magisk App on any android phone, copying the stock boot.img anywhere on the device, then patching the file from the app and flashing using SP Tools.
I patched the boot.img from the stock rom. I also managed to successfully execute the bypass script. It used to throw out Missing Default Config error, but i found the default config on github (exploits-collection; attachments) and used that just fine - copy the contents of the archive into the root folder of the bypass utility:
View attachment 5892949
So, in order to unblock the protection, one needs to SOLDER the two pins, any other method was extremely unreliable. On Windows, install LIBUSB drivers from the attached file or from sorceforge. Do it in such a way that you run the installer and you'll get to this popup:
View attachment 5892951
then click next
View attachment 5892953
and youll see bunch of devices. Now plug in the phone with unplugged battery and shorted pins, then wait till a new device pops up, could be called MTK Device or anything like that. You select it and install the libusb library to it. Unplug the phone.
CD into the Bypass Utility folder via CMD/Terminal and run as root: python3 main.py, but install the requirements beforehand (sudo) pip install pyusb pyserial json5 ( running the program as root, the dependencies may not carry over so install them as root as well)
If you did everything right, you should see a prompt saying "Waiting for device"
Then you keep the 2 pins shorted and plug in the phone, if all goes right you should see this output:
View attachment 5892965
On linux, you need a custom patched kernel, either get the patch or get a prepatched kernel or live boot a FireOS iso.
from the README file:
As long as you keep the phone plugged in, the protection is off, however i found myself often needing to re-run the script before each action that utilizes the bootrom.
Using the mentioned scatter file throws out errors. I tried to first remove the protection and then immediately run the NVRAM readback but it failed
View attachment 5892981
Full guide https://forum.xda-developers.com/t/...d-flash-in-edl-with-no-auth-for-free.4229683/
I tried to make my own scatter file by using MTK Droid Tools, but this utility only supports MTK65xx and below CPUs, so it isnt possible in our case. I also tried a generic MTK6765 scatter but that didn't work either. Without the scatter file, the tool doesn't kow where to write the boot.img and thus its a dead end. I'll try to do this on a different PC see if anything changes but i highly suspect its just a wrong scatter file. I got it from this allegedly stock rom.
What i stumbled across is this mirror site, where basically every ROM this device ever had is uploaded, so i think ill start there.
HUGE EDIT:
Accidentally i didnt load up the scatter file from the ROM directory but instead from a different location, tus it didnt load all the other necessary parts. It seems like you have to flash everything, not just one part like recovery or bootloader. Or maybe you can flash a single thing and that is what the square checkboxes are for lol
View attachment 5893083
Thus i can happily announce that i successfully flashed the boot.img, after which Root Checker wstill reported NON-ROOT. I installed MAGISK APP once again and it asked me to reboot to finalize, then it rebooted, i entered the Magisk app and rooted directly from the app. -and the phone is rooted !
Technically it could be possible to flash a custom ROM using this exact tool, although i can only imagine few of the hardware actually working without manually fixing ACPI etc.
It is certainly one of the most difficult root procedures, but nothing unusual in the world of reverse engineering
Click to expand...
Click to collapse
please can you elaborate why you're using exploits_collection-master as before you mentioned you were using mtkclient-main? also do you know why a patched kernel is required on linux?
Not sure but without them it throws out errors, I looked up the error and found a GitHub page which was referenced to the mtkclient - it essentially needs a default config and I supplied that, the file contains configurations for many APUs which are listed in the readme file
Patched kernel I assume is necessary for the bootrom exploit, again if you took few minutes to check the links I mentioned it's all there on GitHub. The kernel needs a way to communicate with the MTK protocol, on Windows there is the VCOM Driver and LIBUSB wizard, on Linux you need to apply the driver to the kernel manually or download a prepatched one.
Hope I proved my point that it's indeed possible to root it and unlock the bootloader, it took me dozens of hours so least you could do is go ahead and edit all the messages where you confidently said it isn't and link this forum there.
Related
THIS WILL ONLY WORK WITH DEVICES USING EMMC PARTITION LAYOUT!
otherwise flashtool cannot properly readback needed files wich will cause a bricked device. for rooting mt6573 or mt6575 without emmc partition layout,
refere to this method by rua1: http://forum.xda-developers.com/showpost.php?p=38337401&postcount=5
You need to upload the needed files to your Computer using the Read Page Only feature.
ALSO, MAKE SURE YOUR DON'T TRY THAT ON AN ALCATEL (OR SIMILAR) DEVICE, INDICATOR HERE IS A CUSTPACK PARTITION IN SCATTERFILE.
those devices have mt65xx, but have a totally different partition strukture. You can try this tutorial, BUT IF YOU BRICK YOUR DEVICE; I CANNOT HELP YOU OUT!!!
since a lot of devices have different hardware - e.g. Display or Camera - making a Backup of your device should have highest priority. Flashing a wrong ROM can brick your phone!!
What is needed:
VCOM Driver, thx to n2k1
ADB, thx to n2k1
MTK Droid Tools V2.46
If you wan't to use the newest Versionof MTK Droid Tools, refere to here:
http://forum.xda-developers.com/showthread.php?p=38337401#post38337401
also, you can buy Master Shifu rua1 a coffee for his great tool!
Support for the newest Version of Droid Tools is NOT given in this thread! I personally don't use his tool so if something unexpected happens, its not my fault.
SP Flashtool V3.1224 for mt6589, newer flashtool is needed!!! if there are some problems with reading back or flashing the device, newer flashtool is needed.
Install the needed drivers. installing VCOM drivers might take a while, because it will show up just a few seconds while connecting the phone(off).
and now the Step-by-Step tutorial to backup your boot.img, recovery.img and system.img for rooting.
1. enable USB-debugging under Settings-Development->USB debugging
2. phone should now get recognized as "Android Phone - Android Composite ADB Interface" -> if this is a Unknown Device, you should install the ADB drivers.
3.Open MTK Droid Tools
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Connect device to USB (USB Debugging has to be enabled)
5. Device informations has been loaded, Press on "Blocks Map"
We'll need to find the lines bootimg, recovery and Android. We'll need to write down Start-adress(Scatter) and the Size for every line.
(i made a screenshot, writing down isn't necessary.)
In MY Case, this is:
bootimg: 00F88000 size: 00600000
recovery: 01588000 size: 00600000
Android: 026E8000 size: 31900000
6. Now we'll need to click on "Create Scatter File" and you can save it as "MT6577_Android_scatter_emmc.txt"
7. You can Close MTK Droid Tools now.
8. Now we need to open SP Flash Tool and we need to load the scatter file.
9. Now we'll need to click on "Read Back" in the top of SP Flash Tool.
Click on "ADD" 3 Times, we will create "ROM_0", "ROM_1" and "ROM_2".
10. Doubleclick on "ROM_0", and select a place to save it, e.g. C:/N9770_backup/ and rename it to"boot.img"
11. now it will ask you for the Start Adress and lengh for bootimg, we wrote down earlier.
this is in my case: Start Address: 0x00F88000; Lenght: 0x00600000. the first "0x" MUST remain at its place!
12. the same thing you'll need to do for "recovery" and "android".
13. disconnect, shut down and remove the battery of your Device.
13. Now we'll need to click on "Read Back", insert your battery and connect your device to USB. (VCOM driver is needed now, you'll need to install it before getting to the next steps)
14. if this were correct, a red bar should appear on the bottom of SP Flash Tool. you'll need to wait until the green ring appears.
15.Flash Tool now read back the 3 files. system.img isn't that important, but boot.img and recovery.img should be around 6 MB. if the file is smaller or bigger, the length is different to my device or there was a failure while reading back your firmware. So make sure, that at least recovery or boot.img has the right size!!
16. Back to droid tools. reconnect your device to USB , debugging should be enabled, too. switch to "root, backup, recovery" tab in MTK Droid Tools.
select "to choose the boot.img" and press on "Recovery and boot". select your backup boot.img and recovery,img. MTK droid tools will patch boot.img, so you obtain permanent shellroot.
(optional) a window will pop-up and ask you, if you want to install CWM-r. i cannot tell you if that will work, but you can try it, since you backed up your recovery before. )
(optional) a window will pop-up and ask you for the name of your device(you connected it before starting droidtools, so this should not ask you for the name). you can just press enter or you can enter a name for your device.
17. Droid Tools should have modified the boot.img. "--a task is complete--" text should show up in the right of droidtools.
18. Back to Flashtool
You'll need to load the Scatter (like in Step 8)
select boot.img and recovery.img. make sure you select the modified files. (.../Droidtools/recovery/boot.img and recovery.img)
only boot and recovery should be selected!!
19.disconnect, shout down and remove the battery of your device. press on "Download", a window will show up that you have not selected all images. you can press on "OK".
20. insert the battery and connect your device to USB. Flash process should start and if it worked, green ring will appear.
21. Back to DroidTools. device needs to be connected and debugging enabled. switch to "root, backup, recovery" again and press on "SuperUser". this will push superuser, SU binary and busybox to your device.
22. Your Device is rooted now. you can make a Full backup with Droid Tools now.
thx to n2k1 and tommy0815 for the needed files and the original tutorial!!
if i helped you, don't forget to press on "thanks"
reserved for future updates
Testing on my Acer Z120 MT6575 base, I hope this will work, feedback later *fingers crossed*
FEEDBACK:
It totally worked, My Acer z120 is now rooted.
(optional) a window will pop-up and ask you, if you want to install CWM-r. i cannot tell you if that will work, but you can try it, since you backed up your recovery before.
Click to expand...
Click to collapse
Do not use CWM, it will cause your phone not to boot properly, that is my experience on my phone.
Thanks!
yeah never tested it though, thx for the reply!
Re: [HOWTO][GUIDE] Root & Backup of almost EVERY MT65xx based Device
is there anyone here who tried to follow this thread and successfully rooted his android phone?lenovo s720 user here.waiting for more positive feedbacks.
Will this method work on a Vodafone Smart III (975N) probably with 6575?
Guys, this will work on every mt65xx device, if you installed all drivers sucessfully .this whole thing basically changes a value in Boot.IMG To obtain permanent root in the shell. This is the same on EVERY mt65xx based smartphone. Basically you are rooted now. Just needs To push busybox, su and superuser To your device. Thos whole thing seems complex, but you make a backup oft your modified files before modifiing. I never Had device this tutorial was not working every mt6575, 6577 and 6589 should work without an problem. Mt6573 can be a Problem because oft their YAFFS partition strukture.
Chrizzly92 said:
Guys, this will work on every device, if you installed all drivers sucessfully .this whole thing basically changes a value in Boot.IMG To obtain permanent root in the shell. This is the same on EVERY mt65xx based smartphone. Basically you are rooted now. Just needs To push busybox, su and superuser To your device. Thos whole thing seems complex, but you make a backup oft your modified files before modifiing. I never Had device this tutorial was not working every mt6575, 6577 and 6589 should work without an problem. Mt6573 can be a Problem because oft their YAFFS partition strukture.
Click to expand...
Click to collapse
Thanks, I will try!
Sent from my Samsung I9300 with tapatalk4
thank you for this :thumbup:
Sent from my PICOpad GEW using xda app-developers app
dbius said:
Will this method work on a Vodafone Smart III (975N) probably with 6575?
Click to expand...
Click to collapse
Yes, i rooted my vodafone 975N with this method (CWM recovery working) :good:
Gynekolog said:
Yes, i rooted my vodafone 975N with this method :good:
Click to expand...
Click to collapse
:good: That sounds great! Thx man for the informations!
Edit:
Now i tried to root the phone. Everything is went fine till phase nr.19. At this point when the flashtool tried to write back the modified boot.img and recovery.img it gave back me the attached error window.
What should be the problem? I went through the steps with doublecheck and everything was fine till that point. I tried this step two or three times more, but every time gave me this error message.
What should I do now? If it helps I can upload the log folder content here.
Make sure the scatterfile is correct and the files should not be bigger than 6 MB. Flash tool tells you that you need to flash a full image cause the scatter is different from you phone.
Sent from my Star N9770 using xda app-developers app
Chrizzly92 said:
Make sure the scatterfile is correct and the files should not be bigger than 6 MB. Flash tool tells you that you need to flash a full image cause the scatter is different from you phone.
Sent from my Star N9770 using xda app-developers app
Click to expand...
Click to collapse
!EDIT!
Thanks for your answer!
Tonight I found a newer version for flash tool (v3.1304.0.119). Using that version rooting the phone was successful, so thanks, finally it worked.
VCOM Ports
Gynekolog said:
Yes, i rooted my vodafone 975N with this method :good:
Click to expand...
Click to collapse
I still cant root my device. I think its the VCOM ports, because i cant flash
When i click "Read Back" the device is not there..
Can you help me?
Thanks!
This will be very helpful. I have a china phone running on MT6577. I've successfully installed a ported V970 ROM to ZA-985 (which is compatible to my unit in terms of hardware and appearance). I wanna try porting a JB V970 Lewa OS ROM to Kata i1 (identical to ZA-985).
dbius said:
!EDIT!
Thanks for your answer!
Tonight I found a newer version for flash tool (v3.1304.0.119). Using that version rooting the phone was successful, so thanks, finally it worked.
Click to expand...
Click to collapse
thx for your reply, i updated Post #1 , that for mt6589 newer flashtool is required nad sumtimes youll need to play with them. this is because the widely spread devices, they are not the same and sometimes big differences in partitionlayout, SoC revision and so on.
@verntechguy: after rooting, make sure you get a full backup of your device using mtk droid tools. porting lewa is not that hard, but you maybe need to try different platforms to port from. you can refere to here, master shifu yuweng made a pretty good tutorial abut porting Roms.
@Beirajunior: is your device recognized as "mt65xx preloader" when connection to USB? (phone should be off) if not, you can try pressing VOL Up or down while connecting to USB. for flashing, VCOM port 1-16 should be assigned to the drivers.
6
Chrizzly92 said:
thx for your reply, i updated Post #1 , that for mt6589 newer flashtool is required nad sumtimes youll need to play with them. this is because the widely spread devices, they are not the same and sometimes big differences in partitionlayout, SoC revision and so on.
@verntechguy: after rooting, make sure you get a full backup of your device using mtk droid tools. porting lewa is not that hard, but you maybe need to try different platforms to port from. you can refere to here, master shifu yuweng made a pretty good tutorial abut porting Roms.
@Beirajunior: is your device recognized as "mt65xx preloader" when connection to USB? (phone should be off) if not, you can try pressing VOL Up or down while connecting to USB. for flashing, VCOM port 1-16 should be assigned to the drivers.
6
Click to expand...
Click to collapse
Can you help me by team viewer ? :x i still cant do the flash..and the phone is reconized as "mt65xx preloader" but after a while he disconect.
My email is: [email protected]
I appreciate any help.
Cheers
no, i cannot help you via teamviewer, my internet connection is too slow, cause i`m on tethering. some additional infos will be helpfull. device? mt6573,75,77,89?
if the device gets found, everything should work. you`ll need to assing the VCOM ports. just look in the driver settings or google it. i`m sure there is some kind of tutorial for it. also, trying another PC or OS will help, too. alot of guys have problems with that, just switching to XP or so will mostly help without tweaking the drivers.
device should be disconnected and battery should not be inserted. now press readback in flashtool, insert battery and connect the device to USB. now phone should be found by flashtool. if not, like i said, check VCOM ports.
Chrizzly92 said:
no, i cannot help you via teamviewer, my internet connection is too slow, cause i`m on tethering. some additional infos will be helpfull. device? mt6573,75,77,89?
if the device gets found, everything should work. you`ll need to assing the VCOM ports. just look in the driver settings or google it. i`m sure there is some kind of tutorial for it. also, trying another PC or OS will help, too. alot of guys have problems with that, just switching to XP or so will mostly help without tweaking the drivers.
device should be disconnected and battery should not be inserted. now press readback in flashtool, insert battery and connect the device to USB. now phone should be found by flashtool. if not, like i said, check VCOM ports.
Click to expand...
Click to collapse
Hi,
Im already done, but im receiving this error when i try to modified the backuped files (boot and recovery) on MTK Droid Root.I sai no to similar CWM, and i get this error:
"--- ERROR :Boot unthe public mailing list [email protected]"
" --- task is complete ---"
What do you suggest ?
Cheers!
what SoC? mt6573?
Good morning.
I got a problem yesterday with my LG L5 II Dual phone: I caught my sisters pressing any buttons on it and when I saw what they did, there was an Android image on it. Now, every time I try to boot it, it cannot finish the initial setup, saying "Unfortunately, LGSetupWizard stopped."
I've rooted this phone some time ago, but the root seems to have no effect now. For instance, I deleted the following apps:
- Facebook
- Twittter
- All of "TIM" resources ("TIM Recarga, TIM Música, TIM this, TIM that"); "TIM" is the mobile operator of my phone.
I tried to follow the steps described in this post: "[Tutorial] Flashing KDZ on LG L5 II (E455/E460) and other LG phones", but I can't get my phone detected under "Download Mode", what I accessed using (Vol Up) + (Vol Down) keys while booting the phone. Unfortunately, it couldn't be detected in any workaround provided by this guide.
When connected under "Download Mode", I see a device called "LGE AndroidNet USB Modem" under "Modems" category on Windows Device Manager. It seems to be the only mode my phone could be detected under this mode.
Playing around with it, I could access a "Recovery Mode" by (Vol Up) + (Quick Access) keys while booting up the phone. I tried to get some info about it and I could, at least, use it with ADB. But I have read-only access, not read-write anymore. Searching more trying to get an answer to "ADB Force Root Mode", I got some things to notice, like the file "default.prop" under the phone's root system.
This "default.prop" shows the following 6 first lines:
Code:
ro.secure=1
ro.allow.mock.location=0
persist.mtk.aee.aed=on
ro.debuggable=0
persist.sys.usb.config=charge_only
persist.service.acm.enable=0
which means, I think, the phone now isn't configured for USB debugging neither for system write permission.
What can I do to, at least, try to delete some files on it, specifically the 4 setup wizard ones, located at "/system/app/" under the names "LGSetupWizard_JB.apk", "LGSetupWizard_JB.odex", "SetupWizard.apk" and "SetupWizard.odex", since these are the ones which I'm dealing with?
Ah. I tried on computers running Windows 8.1 and Windows XP SP3. No luck.
(edit: 2014-04-02, 23:16 UTC -03:00)
I've playing around with ADB trying to run it with another mode. I don't know if this can help, but sending the phone to recovery mode using ADB
Code:
adb reboot recovery
I get an Android lying with a red triangle sign over it... Still searching for a procedure or an answer to fix the phone, but still with no luck.
[Solved] Guide to solve this kind of problem
After looking for a while on how to fix the problem either by trying to run an ADB shell as root either by flashin the ROM, I could figure another way to flash the original "TIM" rom for my phone instead of the one described on the topic "[Tutorial] Flashing KDZ on LG L5 II (E455/E460) and other LG phones". Here's the way out:
1. Downloading firmware KDZ Flash ROM
First, you have to download the original KDZ ROM for your phone. It can be found at the link below:
LG Optimus L5 II Firmware List
The ones for Brazilian users are described in the page. For TIM users, I suggest using firmware 33 BTM/TIM(BRAZIL), size 599.09 MiB.
Since my phone was sold by TIM, I can't tell about another mobile operators, like Claro, Oi, and VIVO.
2. Extracting a binary file from the KDZ Flash ROM
After that, you will need to extract the KDZ file using LGExtractor (and not DZExtractor).
You can download it from here as an autoextractor file: <4shared>. It will extract itself to C:\RecoverE455\Extract.
Put your KDZ file on an easy access folder. I will assume you will use C:\RecoverE455\ROM for this.
Launch an Administrator command line prompt, and run this command:
Code:
C:\RecoverE455\Extract\LGExtractor -kdz C:\RecoverE455\ROM\<KDZ-ROM-FileName>.kdz
Again, I assume you will put evertything under C:\RecoverE455.
Now, you have a cabinet (CAB) file in the same folder of your KDZ ROM. Extract it directly and you will get some structure similar to this:
DLL (folder)
LGE... (binary rom)
LGUP... (dll file)
3. Getting a most recent version of LGFlashTool
After this procedure, you will have to download LGFlashTool in order to flash you newly extracted BINARY rom.
You can download it from here as an autoextractor file: <4shared>. It will extract itself to C:\RecoverE455\Flasher.
Run the Setup program attached within it and it will install itself under the folder C:\LG\LGFlashTool. Overwrite the file MegaLock.dll under this folder with the one you just extracted in C:\RecoverE455\Flasher.
4. Install the correct LG Support Drivers for your E455 phone
Instead of installing the most recent version of LG Drivers provided by LG, you will install the following ones:
LG United Mobile Driver 3.8.1
LG Windows Mobile 1.0
LG SmartPhone DUN Modem Driver 1.0
They are packaged and you can download them from here as an autoextractor file: <4shared>. It will extract itself to C:\RecoverE455\Drivers. Install them in the order described above then restart your computer.
5. Put your phone under Download Mode
To do this, turn off your phone either directly either removing and reinserting the battery.
Plug the phone - WHILE TURNED OFF - on your computer by the USB cable.
Hold (Vol Up) + (Vol Down) and turn on the phone. Keep holding (Vol Up) + (Vol Down) until you see the line "==>Download mode" in bottom of the screen. If it doesn't appear, try until you get this.
6. Configuring your computer to flash under USB download mode
After plugging your device under Download Mode, open Windows Device Manager and search for some LGE AndroidNet USB Serial Port (COM##):
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If it is not (COM41), you must set it to port (COM41). Set properties of the serial port, select tab "Port Settings", then click "Advanced":
Here, select (COM41) for COM number port.
7. Launch LGFlashTool and flashing
Open your newly modified LGFlashTool (yes, the one you downloaded here and replaced some DLL). It immediately will ask for your BINARY rom and a DLL:
Click the "..." button and select the LGUP***.DLL in the same folder as your .BIN file you extracted in step 2.
Click the "Add" button immediately below (side S/W box), then select the LGE***.BIN you extracted in step 2.
Click OK.
Click the serial port button --
--, and let this dialog be equal as this one, with only "16 ports\Port 1 ~ Port 16\1" marked:
And now click the forward button --
.
It will display READY on box with port COM41.
Disconnect your phone, turn it off, then turn it on under Download Mode as described on step 5.
If you manage to turn it on Download Mode without connecting to your computer, plug it back to the computer.
It will begin flashing by itself. No action needed.
DO NOT DISCONNECT YOUR PHONE. I DON'T KNOW WHAT MAY HAPPEN IF YOU DO SO, BUT PROBABLY YOU WILL BREAK DEFINITIVELY YOUR DEVICE.
After all, your phone will restart with all its original configuration and LGFlashTool will display an error. After you manage to finish LGSetupWizard on the phone, you may close everything.
Man, you are a HERO.
I was having trouble debranding and updating my phone, but with your tutorial, it was EASY! Now I have a debranded and updated phone (V10K).
MANY MANY MANY THANKS!!!
Again, I assume you will put evertything under C:\RecoverE455.
Now, you have a cabinet (CAB) file in the same folder of your KDZ ROM. Extract it directly and you will get some structure similar to this:
DLL (folder)
LGE... (binary rom)
LGUP... (dll file)
i couldn't find these, i've done instructions carefully ... help me pleasee !!! :crying:
reresatria said:
Again, I assume you will put evertything under C:\RecoverE455.
Now, you have a cabinet (CAB) file in the same folder of your KDZ ROM. Extract it directly and you will get some structure similar to this:
DLL (folder)
LGE... (binary rom)
LGUP... (dll file)
i couldn't find these, i've done instructions carefully ... help me pleasee !!! :crying:
Click to expand...
Click to collapse
solved :laugh: , just doin' little mistake ... thanks man for tutorial
Hi! I'm here again!
I'm trying to do everything again, but now in my new phone, a D685 (LG G Pro Lite Dual).
But, when I connect it in download mode, FlashTool give me an error just after "USB Connection established". No description of the error, just a "F0000002"...
You know how to solve this?
LG 455 IMEI Problem
Hi,
I flash my phone following this instructions a month ago, all gone ok but yesterday both sims come into negative band and i discover IMEIS changed. I try to rewrite imeis from back label under batteries by all the ways i know, but none works. The AT command method via engineer menu or Putty console responds OK but doesnt change anything; same thing with MTKTools.
The las chance, i think, its by meta mode imei an sn change tools, like Maui META or SN_STATION, but i cant enter the phone in meta mode or cant find the correct drivers; every times programs fail attemping to connect to phone...
Please if some know some clues make me know!!!!
niconiconico111 said:
Hi,
I flash my phone following this instructions a month ago, all gone ok but yesterday both sims come into negative band and i discover IMEIS changed. I try to rewrite imeis from back label under batteries by all the ways i know, but none works. The AT command method via engineer menu or Putty console responds OK but doesnt change anything; same thing with MTKTools.
The las chance, i think, its by meta mode imei an sn change tools, like Maui META or SN_STATION, but i cant enter the phone in meta mode or cant find the correct drivers; every times programs fail attemping to connect to phone...
Please if some know some clues make me know!!!!
Click to expand...
Click to collapse
The AT commands worked for me. In putty, be sure to get "IMEI changed" as response, and check the number. If I remember, the IMEI is comma seppareted.
[SOLVED]
romulocarlos said:
The AT commands worked for me. In putty, be sure to get "IMEI changed" as response, and check the number. If I remember, the IMEI is comma seppareted.
Click to expand...
Click to collapse
Hi, thanks for the reply!
Yes, finally the solution was simple, instead of using AT+EGMR command I use AT%IMEI=, that worked!!
can u solve it ?
romulocarlos said:
Hi! I'm here again!
I'm trying to do everything again, but now in my new phone, a D685 (LG G Pro Lite Dual).
But, when I connect it in download mode, FlashTool give me an error just after "USB Connection established". No description of the error, just a "F0000002"...
You know how to solve this?
Click to expand...
Click to collapse
hii, how about this problem ? have you solved it ? can u tell me how do it ... i've got same problem,
reresatria said:
hii, how about this problem ? have you solved it ? can u tell me how do it ... i've got same problem,
Click to expand...
Click to collapse
FlashTool can't work with this phone. Instead, search here on XDA about flashing KDZ larger than 1Gb. Is an offline method.
help
romulocarlos said:
FlashTool can't work with this phone. Instead, search here on XDA about flashing KDZ larger than 1Gb. Is an offline method.
Click to expand...
Click to collapse
thx for reply, i'm using L5 II E455 before i've tried your method about twice and it's work, but since i restart my phone and got an android laying with a red triangle over it, i can't flashing again, it got problem error F0000002 ...
goo(dot)gl/R43Jmj if you don't mind click the url
reresatria said:
thx for reply, i'm using L5 II E455 before i've tried your method about twice and it's work, but since i restart my phone and got an android laying with a red triangle over it, i can't flashing again, it got problem error F0000002 ...
goo(dot)gl/R43Jmj if you don't mind click the url
Click to expand...
Click to collapse
I'm sorry, I make a mistake. My answer above was for another thread.
This method works with E455, just check the drivers and everything else again, and if possible, use a clean computer.
Again, sorry for my mistake.
still can't
romulocarlos said:
I'm sorry, I make a mistake. My answer above was for another thread.
This method works with E455, just check the drivers and everything else again, and if possible, use a clean computer.
Again, sorry for my mistake.
Click to expand...
Click to collapse
still i can't flash my phone,
Thank you very much, I could not recover the phone all the time, the update always stuck to 4%. When this has helped me! Just when I launched the BAT extractor, it deleted all the contents of the parent folder.
UPDATE: I have updated this post with a file named "board diag v2.99.zip" This should now support more phones!!!
Several people have been having issues with hard bricks and there are several posts with a bit of info about how to fix them but no simple instructions so I'm posting a (hopefully) fool proof guide to fixing your hard brick. Tested on windows 7 and windows 10.
First what is a hard brick? A hard brick is a phone that does not boot, or is stuck in a boot loop, or has a security error AND cannot access recovery or download mode.
Disclaimer: Your warranty is now void etc. I am not responsible etc. You have to open your phone to do this so it is a last resort. Read the entire tutorial before beginning!
Required Materials:
Bricked LG G3
Stock USB cable <-- or at least one that you know is good
a short thin but stiff wire to short pins
Qualcomm high speed usb drivers
BoardDiag by willcracker <-- other versions don't seem to work
The tot file of the rom that you were running. (not older not newer same version) You can find these easily on XDA or google but it varies depending on your software version
First you need to install the Qualcomm high speed usb drivers. Your phone will be detected as Qualcomm 9008 (COM) later on in the tutorial but you need these drivers. I will include the drivers in this post. If you are on a 64 bit system you will need to disable driver signing. Here is how:
Step 1. Open the Windows command prompt as “Run as Administrator”.
Step 2. Run
Code:
bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
Step 3. To finalize the process run
Code:
bcdedit -set TESTSIGNING ON
Step 4. Reboot and you’re done.
I have attached both the 32 bit version and the 64 bit version be sure to only use the 64bit one on 64bit and likewise only use the 32bit one on 32bit, you do not need both sets of drivers.
1. Open your phone and take out the battery. Remove the top half of the phone housing. You do not need to remove the bottom half by the usb. Also you don't need to remove the screw next to the camera. If you do remember that it is a different size so keep it separate.
2, You will see a big metal shield. You need to remove it. It is pretty easy just pry it off and it pops back into place when you are done.
3. Next you need to short the pins as shown in the following picture. While continuing to short the pins plug in your usb cable. You should hear windows detect the phone almost instantly. Keep shorting the pins for the count to 5 and then you can release the wire. See image below, ignore the ethernet connector.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Now open device manager in windows and it should show your phone under com ports as Qualcomm 9008 (COM #). If it doesn't try the process over again. When it does work remember this number. It is going to be used later.
5. Now fire up BoardDiag by willcracker be sure to run it as administrator. It is in this post named willcracker.rar There are some pictures on how to flash with this app but I will describe it as well. First we are going to need to extract your tot file. This can take some time. Like 10 mintues on a decent PC. The app may look like it froze up but it is just thinking. When it is complete move on to the next step.
6. You need to tell the program the com port that you are using that we found earlier and the folder where you extracted the firmware to.
7. once you have extracted the firmware and set up the program with the correct port you need to Check "AP" and "EMMC" then press start. Be sure not to select any partitions or change any other options than the firmware directory and comport.
It should come back as PASS. If it throws an error about not being in dload mode you need to restart the shorting process. Hold the short for a bit longer this time.
8. Flash all of the partitions except for Cache, System, Userdata, and Sbl1. Sbl1 will be flashed later and causes the phone to reboot.
You can flash System, Userdata, and cache but it takes a really long time so I don't recommend it. It is better to get your phone into download mode and use LG flash tool to do a full restore.
9. Once you have finished flashing all of the partitions one after the other put in the battery and flash Sbl1. Your phone will now reboot and try to boot into android. If your system is messed up it wont. You will still be in a boot loop. But you should now be able to enter download mode and recovery.
10. Open up LG Flash Tool and flash your tot using Board DL mode. Everything you need at this point is in the following thread http://forum.xda-developers.com/spr...de-how-to-restore-sprint-lg-g3-ls990-t2852042
Hope that this helps, also if you find any problems or need help please post so I can update this post.
NOTES: If you get an error about a dll missing you need to download and install the following http://www.microsoft.com/en-us/download/details.aspx?id=5555
Also make sure that you use "B2 (MSM8974AC)" as the AP Chipset for the LG G3.
thanks a lot brother.... just one Q...where can I get the TOT file?
paragxx said:
thanks a lot brother.... just one Q...where can I get the TOT file?
Click to expand...
Click to collapse
I assume that you are using sprint ls990 if so here is are the latest tot files. ZV8 and ZV6 can be found here http://downloads.codefi.re/autoprime/LG/LG_G3/LS990 thank autoprime. The files are zipped just extract the zip and then do the process above.
ZV4 can be found here direct link. http://downloads.codefi.re/wolfgart/LG_G3/LS990/ZV4/LS990ZV4_04.51101.zip
Any chance this works on ATT D850?
For myself and the benefit of others, I'm just clarifying something. I've always understood there to be the "hard brick" and the "soft brick". The soft brick is what you describe above where your phone lights up but doesn't boot. A hard brick is where nothing lights up, and your phone doesn't respond at all.
If someone were to describe what you describe above, I'd say that's not a hard brick. There's hope for a soft brick but not a hard brick. Am I wrong, or have the terms morphed a bit in the past several years?
mjjcb said:
For myself and the benefit of others, I'm just clarifying something. I've always understood there to be the "hard brick" and the "soft brick". The soft brick is what you describe above where your phone lights up but doesn't boot. A hard brick is where nothing lights up, and your phone doesn't respond at all.
If someone were to describe what you describe above, I'd say that's not a hard brick. There's hope for a soft brick but not a hard brick. Am I wrong, or have the terms morphed a bit in the past several years?
Click to expand...
Click to collapse
I was always told that a soft brick could be repaired with either recovery or fastboot and that a hard brick was anything that you needed more tools to fix. But I guess that everyone's definition is different. Also This method works on any kind of brick as long as there isn't a hardware issue. No screen on, no power on etc.
BlackSportD said:
Any chance this works on ATT D850?
Click to expand...
Click to collapse
Sorry that I missed your post.... but yes this should work on all variations of the LG G3 as long as it has the points on the motherboard posted in the picture. I do know that the international dual sim version has different pins and I don't know those pins but ATT, Sprint, Verizon, should all work.
l33tlinuxh4x0r said:
Sorry that I missed your post.... but yes this should work on all variations of the LG G3 as long as it has the points on the motherboard posted in the picture. I do know that the international dual sim version has different pins and I don't know those pins but ATT, Sprint, Verizon, should all work.
Click to expand...
Click to collapse
hey, mine is F460K (snapdragon 805) APQ8084 and not msm8974. My device shows as Qualcomm HS-USB QDLoader 9008 (COM6) . I assume i dont need to sort wire as its sole purpose is to show the device as Qualcomm in Device manager.
I think i need to create a file under model like B2 (MSM8974AC) with 2nd_loader.hex etc. Can you help me on this or is it unnecessary ?
currently i get the error
No response from the device. Check PMIC first and if still boot problem, replace AP
Pannam said:
hey, mine is F460K (snapdragon 805) APQ8084 and not msm8974. My device shows as Qualcomm HS-USB QDLoader 9008 (COM6) . I assume i dont need to sort wire as its sole purpose is to show the device as Qualcomm in Device manager.
I think i need to create a file under model like B2 (MSM8974AC) with 2nd_loader.hex etc. Can you help me on this or is it unnecessary ?
currently i get the error
No response from the device. Check PMIC first and if still boot problem, replace AP
Click to expand...
Click to collapse
You are right about not needing to short the wire and also about needing the correct 2nd_loader.hex etc. However I don't know how to make those. Attached are some more models that I found online. Hope that this helps.
l33tlinuxh4x0r said:
You are right about not needing to short the wire and also about needing the correct 2nd_loader.hex etc. However I don't know how to make those. Attached are some more models that I found online. Hope that this helps.
Click to expand...
Click to collapse
Thanx man, but they dont show my chipset.
Pannam said:
Thanx man, but they dont show my chipset.
Click to expand...
Click to collapse
What phone do you have? This tutorial is for the LG G3 from what I just googled the chipset that you are looking for is the Samsung Galaxy Note 4?
l33tlinuxh4x0r said:
What phone do you have? This tutorial is for the LG G3 from what I just googled the chipset that you are looking for is the Samsung Galaxy Note 4?
Click to expand...
Click to collapse
this is my phone it is lg g3 but upgraded version. http://www.gsmarena.com/lg_g3_lte_a-6520.php
Pannam said:
this is my phone it is lg g3 but upgraded version. http://www.gsmarena.com/lg_g3_lte_a-6520.php
Click to expand...
Click to collapse
I don't know then. I know that this method works on the carrier versions of the lg g3 but people have had issues with other versions.
l33tlinuxh4x0r said:
Several people have been having issues with hard bricks and there are several posts with a bit of info about how to fix them but no simple instructions so I'm posting a (hopefully) fool proof guide to fixing your hard brick. Tested on windows 7 and windows 10.
First what is a hard brick? A hard brick is a phone that does not boot, or is stuck in a boot loop, or has a security error AND cannot access recovery or download mode.
Disclaimer: Your warranty is now void etc. I am not responsible etc. You have to open your phone to do this so it is a last resort. Read the entire tutorial before beginning!
Required Materials:
Bricked LG G3
Stock USB cable <-- or at least one that you know is good
a short thin but stiff wire to short pins
Qualcomm high speed usb drivers
BoardDiag by willcracker <-- other versions don't seem to work
The tot file of the rom that you were running. (not older not newer same version) You can find these easily on XDA or google but it varies depending on your software version
First you need to install the Qualcomm high speed usb drivers. Your phone will be detected as Qualcomm 9008 (COM) later on in the tutorial but you need these drivers. I will include the drivers in this post. If you are on a 64 bit system you will need to disable driver signing. Here is how:
Step 1. Open the Windows command promt as “Run as Administrator”.
Step 2. Run
Code:
bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
Step 3. To finalize the process run
Code:
bcdedit -set TESTSIGNING ON
Step 4. Reboot and you’re done.
I have attached both the 32 bit version and the 64 bit version be sure to only use the 64bit one on 64bit and likewise only use the 32bit one on 32bit, you do not need both sets of drivers.
1. Open your phone and take out the battery. Remove the top half of the phone housing. You do not need to remove the bottom half by the usb. Also you don't need to remove the screw next to the camera. If you do remember that it is a different size so keep it separate.
2, You will see a big metal shield. You need to remove it. It is pretty easy just pry it off and it pops back into place when you are done.
3. Next you need to short the pins as shown in the following picture. While continuing to short the pins plug in your usb cable. You should hear windows detect the phone almost instantly. Keep shorting the pins for the count to 5 and then you can release the wire. See image below, ignore the ethernet connector.
4. Now open device manager in windows and it should show your phone under com ports as Qualcomm 9008 (COM #). If it doesn't try the process over again. When it does work remember this number. It is going to be used later.
5. Now fire up BoardDiag by willcracker be sure to run it as administrator. It is in this post named willcracker.rar There are some pictures on how to flash with this app but I will describe it as well. First we are going to need to extract your tot file. This can take some time. Like 10 mintues on a decent PC. The app may look like it froze up but it is just thinking. When it is complete move on to the next step.
6. You need to tell the program the com port that you are using that we found earlier and the folder where you extracted the firmware to.
7. once you have extracted the firmware and set up the program with the correct port you need to Check "AP" and "EMMC" then press start. Be sure not to select any partitions or change any other options than the firmware directory and comport.
It should come back as PASS. If it throws an error about not being in dload mode you need to restart the shorting process. Hold the short for a bit longer this time.
8. Flash all of the partitions except for Cache, System, Userdata, and Sbl1. Sbl1 will be flashed later and causes the phone to reboot.
You can flash System, Userdata, and cache but it takes a really long time so I don't recommend it. It is better to get your phone into download mode and use LG flash tool to do a full restore.
9. Once you have finished flashing all of the partitions one after the other put in the battery and flash Sbl1. Your phone will now reboot and try to boot into android. If your system is messed up it wont. You will still be in a boot loop. But you should now be able to enter download mode and recovery.
10. Open up LG Flash Tool and flash your tot using Board DL mode. Everything you need at this point is in the following thread http://forum.xda-developers.com/spr...de-how-to-restore-sprint-lg-g3-ls990-t2852042
Hope that this helps, also if you find any problems or need help please post so I can update this post.
Click to expand...
Click to collapse
hi
i get the error
No response from the device. Check PMIC first and if still boot problem, replace AP
model ls740 volt
G2MLTE (MSM8926)
help
nemran said:
hi
i get the error
No response from the device. Check PMIC first and if still boot problem, replace AP
model ls740 volt
G2MLTE (MSM8926)
help
Click to expand...
Click to collapse
Sorry I don't have that device to test. This is confirmed on the carrier version of the LG G3 only.
Thank You
I found a post similar to this that no matter where I looked - I was always referred back to that post - which was written in poor english - no download links worked. I appreciate this post. Saved my ass.
EMMC test fail
using D855 16gb
any fix ??
zohaibkhan143 said:
EMMC test fail
using D855 16gb
any fix ??
Click to expand...
Click to collapse
I have never had that error myself but it means either that you are using the wrong firmware images or that you have a hardware issue.
l33tlinuxh4x0r said:
I have never had that error myself but it means either that you are using the wrong firmware images or that you have a hardware issue.
Click to expand...
Click to collapse
tot is correct. I think so its a hardware issue.. I need a medusa box for fix maybe its the last solution for my G3:crying:
LGD855AT-00-V10e-EUR-XX-JUL-08-2014-16G+0
using this tot. Is it fine ?
l33tlinuxh4x0r said:
Several people have been having issues with hard bricks and there are several posts with a bit of info about how to fix them but no simple instructions so I'm posting a (hopefully) fool proof guide to fixing your hard brick. Tested on windows 7 and windows 10.
First what is a hard brick? A hard brick is a phone that does not boot, or is stuck in a boot loop, or has a security error AND cannot access recovery or download mode.
Disclaimer: Your warranty is now void etc. I am not responsible etc. You have to open your phone to do this so it is a last resort. Read the entire tutorial before beginning!
Required Materials:
Bricked LG G3
Stock USB cable <-- or at least one that you know is good
a short thin but stiff wire to short pins
Qualcomm high speed usb drivers
BoardDiag by willcracker <-- other versions don't seem to work
The tot file of the rom that you were running. (not older not newer same version) You can find these easily on XDA or google but it varies depending on your software version
First you need to install the Qualcomm high speed usb drivers. Your phone will be detected as Qualcomm 9008 (COM) later on in the tutorial but you need these drivers. I will include the drivers in this post. If you are on a 64 bit system you will need to disable driver signing. Here is how:
Step 1. Open the Windows command promt as “Run as Administrator”.
Step 2. Run
Code:
bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
Step 3. To finalize the process run
Code:
bcdedit -set TESTSIGNING ON
Step 4. Reboot and you’re done.
I have attached both the 32 bit version and the 64 bit version be sure to only use the 64bit one on 64bit and likewise only use the 32bit one on 32bit, you do not need both sets of drivers.
1. Open your phone and take out the battery. Remove the top half of the phone housing. You do not need to remove the bottom half by the usb. Also you don't need to remove the screw next to the camera. If you do remember that it is a different size so keep it separate.
2, You will see a big metal shield. You need to remove it. It is pretty easy just pry it off and it pops back into place when you are done.
3. Next you need to short the pins as shown in the following picture. While continuing to short the pins plug in your usb cable. You should hear windows detect the phone almost instantly. Keep shorting the pins for the count to 5 and then you can release the wire. See image below, ignore the ethernet connector.
4. Now open device manager in windows and it should show your phone under com ports as Qualcomm 9008 (COM #). If it doesn't try the process over again. When it does work remember this number. It is going to be used later.
5. Now fire up BoardDiag by willcracker be sure to run it as administrator. It is in this post named willcracker.rar There are some pictures on how to flash with this app but I will describe it as well. First we are going to need to extract your tot file. This can take some time. Like 10 mintues on a decent PC. The app may look like it froze up but it is just thinking. When it is complete move on to the next step.
6. You need to tell the program the com port that you are using that we found earlier and the folder where you extracted the firmware to.
7. once you have extracted the firmware and set up the program with the correct port you need to Check "AP" and "EMMC" then press start. Be sure not to select any partitions or change any other options than the firmware directory and comport.
It should come back as PASS. If it throws an error about not being in dload mode you need to restart the shorting process. Hold the short for a bit longer this time.
8. Flash all of the partitions except for Cache, System, Userdata, and Sbl1. Sbl1 will be flashed later and causes the phone to reboot.
You can flash System, Userdata, and cache but it takes a really long time so I don't recommend it. It is better to get your phone into download mode and use LG flash tool to do a full restore.
9. Once you have finished flashing all of the partitions one after the other put in the battery and flash Sbl1. Your phone will now reboot and try to boot into android. If your system is messed up it wont. You will still be in a boot loop. But you should now be able to enter download mode and recovery.
10. Open up LG Flash Tool and flash your tot using Board DL mode. Everything you need at this point is in the following thread http://forum.xda-developers.com/spr...de-how-to-restore-sprint-lg-g3-ls990-t2852042
Hope that this helps, also if you find any problems or need help please post so I can update this post.
Click to expand...
Click to collapse
I'm going to go insane. I'm stuck at doing the gnd and the capacitor. My laptop detects the device but it says devce not recognized. i installed the qualcomm high speed drivers you had in download on 32bit windows 7 and also tried on 64bit windows 8. Exact same thing, usb device not recognized. Also, I've installed the verizon lg g3 specific drivers and tried too but it doesnt work. Please HELP !
Hello guys, I was one the unfortunate guys who tried to downgrade from an updated XLOADER version FW to an older and failed to do so, resulting a hard brick. I managed to get my phone up and running again with free tools without DC-Phoenix, I include everything detailed in my post, even a preconfigured virtualbox linux system for the initial steps. I also included an UPDATE.app splitter too.
So, this is not an XLOADER downgrade tutorial, with this you can get your phone running again with the newer xloader FW-s. In this case I used files from the B386 version, so your phone will be on 8.0.0.386(C432). WARNING your IMEI number will most likely be gone if you do something wrong, as mine did, this method is only a last bastion to reset your phone. And I don't really have acces for my phone in the coming weeks, but I have some stuff left from firmwares if there is any problem with the script, just hit me up in the thread for any errors or missing stuff.
What you need for this whole thing:
This archive, it contains the firmware, the tools, the preconfigured linux, and the drivers.
VirtualBox downloaded and installed, just google it.
A physically opened phone, unscrewed motherboard, as the testpoint is on the other side, and something to short your testpoint.
First steps:
After you downloaded the archive, just unzip the whole thing to a folder where you have enough space ( the archive is ~7.8GB unzipped)
Now you need to download and install VirtualBox, and import the HIKEY.ova virtual system I included in the zip.
Here's how you can do it
Step one, The HIKEY.ova file is located in the virtual machine folder
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Step two, Leave the settings at default and import it
Setting up your phone and computer:
You need to open up your phone physically, here is a good video of the disassembly https://www.youtube.com/watch?v=Zkj7YVeSzS4
Now, if you got your motherboard unscrewed, you must leave the cable with the big arrow connected to it.
Plug your usb cable into your phone and into your computer, now you must short your testpoint, I included an image about where the testpoint is. https://i.imgur.com/q9ZNGgx.jpg
Just use metal tweezers or a bent metal paperclip, one end on the test point, and the other end to something you can ground it with, the metal shields next to it are good to use.
If you did everything right, your computer should recognize a new device named USB SER, if this is the case, you now must install the huawei android phone drivers. Now the USB SER is now recognized as HUAWEI USB COM 1.0 in the device manager.
Starting the revive process:
After you got the HUAWEI USB COM 1.0 set up, you need to start the virtual linux machine.
The first thing it will ask for is hw login, just type this with lowercase letters.
Code:
hw
hw (again)
Now, you need to add your HUAWEI USB COM 1.0 to the virtual machine.
To do this you need to click the USB icon in the lower right corner and select HUAWEI USB COM 1.0.
.
.
It should have connected as ttyUSB0, you can check it with the command
Code:
dmesg
Now you need to type
Code:
cd hikey_idt/
sudo ./hikey_idt -c config -p /dev/ttyUSB0
(if it asks for sudo password its hw again, also if your device is connected as other ttyUSB number, then you should use that number)
You should see this written from the console if it succeded
With this, you now have a special fastboot booted in your phone.
Flashing the system:
You can now exit the virtual machine, and run first batch, named 1. revive flasher.bat.
It will give you two options after it finished flashing the system, check the one you need, VTR-L29 or VTR-L09.
After the batch is done and you felt that the phone rebooted from the fastboot mode, you can now disconnect the phone from the computer.
You now need to connect the LCD cable, the battery cable, and buttons cable back to your motherboard, no need to re screw the mobo yet, just leave everything hanging in case you need to do the process again with the testpoint.
Now manually boot back into fastboot, Hold volume down while connecting your usb to your computer.
Now you need to flash a TWRP with 2. TWRP recovery.bat.
After that, boot into TWRP, wait for it to completely boot up, and flash an oeminfo with one of the oeminfo batches 3a or 3b.
With this, you should now be able to boot into the system, if there are still problems like bootlooping, do a factory reset from recovery.
Big thanks to:
@goodwin_c for the special fastboot/hikey_idt combo.
@Pretoriano80 for the TWRP recovery
@ante0 for the splitupdate.exe
Im downloading all the files right now. Let you know how it goes. THANK YOU so much
---------- Post added at 06:02 PM ---------- Previous post was at 05:46 PM ----------
This you can get your phone running again with the newer xloader FW-s. In this case I used files from the B386 version, so your phone will be on 8.0.0.386(C432). WARNING your IMEI number will most likely be gone if you do something wrong, as mine did, this method is only a last bastion to reset your phone. And I don't really have acces for my phone in the coming weeks, but I have some stuff left from firmwares if there is any problem with the script, just hit me up in the thread for any errors or missing stuff.
-what can I do wrong?. I don't want to break my IMEI. if i follow your instructions, Also my firmware before it was hard brick is VTR-L09 8.0.0.310(c25) Custom version CUSTC23D001. I wont have any issues flashing the firmware you provide? , thank you for your help
NowLearn said:
Im downloading all the files right now. Let you know how it goes. THANK YOU so much
---------- Post added at 06:02 PM ---------- Previous post was at 05:46 PM ----------
This you can get your phone running again with the newer xloader FW-s. In this case I used files from the B386 version, so your phone will be on 8.0.0.386(C432). WARNING your IMEI number will most likely be gone if you do something wrong, as mine did, this method is only a last bastion to reset your phone. And I don't really have acces for my phone in the coming weeks, but I have some stuff left from firmwares if there is any problem with the script, just hit me up in the thread for any errors or missing stuff.
-what can I do wrong?. I don't want to break my IMEI. if i follow your instructions, Also my firmware before it was hard brick is VTR-L09 8.0.0.310(c25) Custom version CUSTC23D001. I wont have any issues flashing the firmware you provide? , thank you for your help
Click to expand...
Click to collapse
What I did wrong was flashing the board fw wrong, erasing modemnvm partition, erasing nvme partition, and some other partitions that got my imei ****ed up. I excluded those from the batch, and because of this, there are possibilities that it might not work. And as of your version, I did not include that one in the stuff. I used the european fw, but with some modification you can use your own FW with my stuff. I can maybe compile it for you, but that'll take some time.
yoghurt13 said:
What I did wrong was flashing the board fw wrong, erasing modemnvm partition, erasing nvme partition, and some other partitions that got my imei ****ed up. I excluded those from the batch, and because of this, there are possibilities that it might not work. And as of your version, I did not include that one in the stuff. I used the european fw, but with some modification you can use your own FW with my stuff. I can maybe compile it for you, but that'll take some time.
Click to expand...
Click to collapse
Im installing the virtualbox right now. I would like to know If i flash your VERSION, i wont have any issue? if its european and my phone its from Latin America?. I dont mind having a different firmware as long that my phone dont break.
NowLearn said:
Im installing the virtualbox right now. I would like to know If i flash your VERSION, i wont have any issue? if its european and my phone its from Latin America?. I dont mind having a different firmware as long that my phone dont break.
Click to expand...
Click to collapse
Most likely your phone will work, but there would be baseband differences because of the oeminfo, and update version, wich would mean you can't make phonecalls and mobile data. I'm downloading your firmware currently, so be patient and I'll get stuffed in a new zip with the modifications.
yoghurt13 said:
Most likely your phone will work, but there would be baseband differences because of the oeminfo, and update version, wich would mean you can't make phonecalls and mobile data. I'm downloading your firmware currently, so be patient and I'll get stuffed in a new zip with the modifications.
Click to expand...
Click to collapse
bro, u didnt have to do that, but I appreciate it. Let me pm u. Thank you again
Would it be possible to rebrand VTR-L09 to VTR-L29 using this method?
2. TWRP Recovery.bat not working. just say waiting any devices. ı cant make phone restart to fastboot mode. I do disconnect battery,lcd and botton cable and connect usb cable in ps.use testpoint to connect,ps see the device anythings okay. cd hikey_idt/
sudo ./hikey_idt -c config -p /dev/ttyUSB0. I enter this codes and says finish downloading and phone get vibration thats all.after that open revive flasher.bat. and choıce vtr-l29 and enter thats all.ım stuck in the.connect again lcd,battery and botton cable trying to open twrp.bat but not open.by the way if when phone get vibration after that ı need see phone start with fastboot mood? because cant access fastboot mode. I dont really understand how this works.
volpula said:
2. TWRP Recovery.bat not working. just say waiting any devices. ı cant make phone restart to fastboot mode. I do disconnect battery,lcd and botton cable and connect usb cable in ps.use testpoint to connect,ps see the device anythings okay. cd hikey_idt/
sudo ./hikey_idt -c config -p /dev/ttyUSB0. I enter this codes and says finish downloading and phone get vibration thats all.after that open revive flasher.bat. and choıce vtr-l29 and enter thats all.ım stuck in the.connect again lcd,battery and botton cable trying to open twrp.bat but not open.by the way if when phone get vibration after that ı need see phone start with fastboot mood? because cant access fastboot mode. I dont really understand how this works.
Click to expand...
Click to collapse
Do you have any direct messaging app we can communicate? I can maybe help with teamviewer if that's an option for you.
I can currently suggest that if your phone vibrates after linux command and finish download, that's already a good sign. After that, try to close the linux machine, and just remove and reconnect usb, and see if your device is now visible in device manager.
Ok, so I was able to rebrand to VTR-L29 but my IMEI is 0.
Anyone can help me put my IMEI back? I tried to use HCU but it's telling my that my current security patch is not supported.
Thanks!
Ekenfo said:
Ok, so I was able to rebrand to VTR-L29 but my IMEI is 0.
Anyone can help me put my IMEI back? I tried to use HCU but it's telling my that my current security patch is not supported.
Thanks!
Click to expand...
Click to collapse
Currently there is no way to reset your IMEI with android 8+, as HCU and the other softwares does not support our phone over android 8, if your IMEI is erased then It's might be gone forever at this rate, but I'm trying to find a method, but no guarantees.
yoghurt13 said:
Do you have any direct messaging app we can communicate? I can maybe help with teamviewer if that's an option for you.
I can currently suggest that if your phone vibrates after linux command and finish download, that's already a good sign. After that, try to close the linux machine, and just remove and reconnect usb, and see if your device is now visible in device manager.
Click to expand...
Click to collapse
I can give you only my instagram.beacause I dont have a backup phone rightnow just waiting to fix my phone.if I can fix that buy a new phone but never huawei again.
yoghurt13 said:
Currently there is no way to reset your IMEI with android 8+, as HCU and the other softwares does not support our phone over android 8, if your IMEI is erased then It's might be gone forever at this rate, but I'm trying to find a method, but no guarantees.
Click to expand...
Click to collapse
Do you know if the IMEI is contained in the oeminfo image? Maybe we could just hex edit it and flash it back?
Or maybe using the AT+EGMR=1,7,"IMEI"' command? But root is needed for that.
In the steps you described in your first post you say to flash twrp in fastboot. My device is locked so it's not working.
The only way I can get twrp to flash is after using the testpoint method. But then when I try to go in recovery I'm only getting in the stock recovery, not trwp...
Any idea?
Thanks!
yoghurt13 said:
Do you have any direct messaging app we can communicate? I can maybe help with teamviewer if that's an option for you.
I can currently suggest that if your phone vibrates after linux command and finish download, that's already a good sign. After that, try to close the linux machine, and just remove and reconnect usb, and see if your device is now visible in device manager.
Click to expand...
Click to collapse
by the way I try remove and reconnect usb but device manager can't see the device. only see device when I reach and touch testpoint area again.
volpula said:
by the way I try remove and reconnect usb but device manager can't see the device. only see device when I reach and touch testpoint area again.
Click to expand...
Click to collapse
Then there is the problem, try to install HiSuite, or my android driverpack, and try to see if the phone shows up in device manager.
Ekenfo said:
Do you know if the IMEI is contained in the oeminfo image? Maybe we could just hex edit it and flash it back?
Or maybe using the AT+EGMR=1,7,"IMEI"' command? But root is needed for that.
In the steps you described in your first post you say to flash twrp in fastboot. My device is locked so it's not working.
The only way I can get twrp to flash is after using the testpoint method. But then when I try to go in recovery I'm only getting in the stock recovery, not trwp...
Any idea?
Thanks!
Click to expand...
Click to collapse
That command only works on MTK devices, and for the TWRP if you can flash it in testpoint instead of the normal recovery, with
Code:
fastboot flash recovery_ramdisk twrp image file location
, then you should be able to boot that if you disconnect the usb, and hold vol up while restarting phone.
yoghurt13 said:
That command only works on MTK devices, and for the TWRP if you can flash it in testpoint instead of the normal recovery, with
Code:
fastboot flash recovery_ramdisk twrp image file location
, then you should be able to boot that if you disconnect the usb, and hold vol up while restarting phone.
Click to expand...
Click to collapse
I'm not sure why but for some reasons I can't get the phone to boot into TWRP, I only get the emui recovery screen.
Another thought : It appears hisuite could rollback the firmware to a nougat version. That option is not available with my phone.
Is there a version that we know for sure that hisuite allows to downgrade from?
Maybe we could flash that version, downgrade using hisuite and then hcu would work?
Ekenfo said:
I'm not sure why but for some reasons I can't get the phone to boot into TWRP, I only get the emui recovery screen.
Another thought : It appears hisuite could rollback the firmware to a nougat version. That option is not available with my phone.
Is there a version that we know for sure that hisuite allows to downgrade from?
Maybe we could flash that version, downgrade using hisuite and then hcu would work?
Click to expand...
Click to collapse
There is currently no way to downgrade from XLOADER2, huawei did some black magic with it, and there is a checker built in the phone that checks if its a loader1 or 2.
So, I flashed TRWP in both recovery_ramdisk and erecovery_ramdisk and I was able to access it.
I got my nvme image and patched it to unlock the bootloader.
But that doesn't help to get hcu to work...
Any idea what would be the next step to fix my imei?
Ekenfo said:
So, I flashed TRWP in both recovery_ramdisk and erecovery_ramdisk and I was able to access it.
I got my nvme image and patched it to unlock the bootloader.
But that doesn't help to get hcu to work...
Any idea what would be the next step to fix my imei?
Click to expand...
Click to collapse
I literally have no ideai yet how to fix our IMEI, since the NVME partition does not contain the information we need, I just tested one from a working phone, and it was the same as before, zeroed out IMEI.
[LOOK AT POST #2 FOR UPDATES]
Good Morning/noon/afternoon/night whatever. Since I'm the dumbest man alive, I've messed up my tablet once again. Yesterday, I wanted to flash Valera's Project Treble zip, and i followed each and every single instruction UNTIL before flashing the GSI. I was following a guide on XDA and it said that no heavy modifications (SuperSU or Magisk) can stay. So I was worried because I still had magisk installed (T820 Tweaked by @rorymc928). Then in Valera's forum it was written that if i flash @ashyx TWRP, i can format everything and all would be good to go. BUT when I used Valera's TWRP to flash ashyx's TWRP image, nothing worked. It was stuck on download mode. So the next day (today) I used ODIN to flash the Stock ROM, but while doing that the Tab rebooted for no reason. And now the Tab is showing "An error has occured while flashing the device software" and whatever mode I went to, it kept rebooting after some time, so I can't flash ANYTHING. As a last ditch effort, I nand flashed the Stock ROM and that failed too. Now I'm desperate to do anything. Please help. I beg
Edit: Now I've messed up real bad. Since download mode wasn't staying on for more than 30 seconds, I decided to flash the OS in parts. First, I flashed the bootloader (BL). This is where the problems began. While flashing, the fricking tab rebooted and now my tab is in a veggie state. Nothing works, doesn't respond to ANYTHING. Upon connecting to PC, it displays "Qualcomm HS-USB QDLoader 9008". From what I can see, the entire boot partition and some core Qualcomm files got messed up. So I beg anybody for a solution. (Especially the people I trust: @rorymc928 @JordanBleu and @ashyx)
On YouTube I saw someone using EMMC Dongle to fix their Samsung phone, using a raw dump of the device. So i would ask anybody to give me a raw dump of the SM-T820 32 GB version OR tell me how to solve this problem please (I can't stress this enough)
NullCode said:
Edit: Now I've messed up real bad. Since download mode wasn't staying on for more than 30 seconds, I decided to flash the OS in parts. First, I flashed the bootloader (BL). This is where the problems began. While flashing, the fricking tab rebooted and now my tab is in a veggie state. Nothing works, doesn't respond to ANYTHING. Upon connecting to PC, it displays "Qualcomm HS-USB QDLoader 9008". From what I can see, the entire boot partition and some core Qualcomm files got messed up. So I beg anybody for a solution. (Especially the people I trust: @rorymc928 @JordanBleu and @ashyx)
On YouTube I saw someone using EMMC Dongle to fix their Samsung phone, using a raw dump of the device. So i would ask anybody to give me a raw dump of the SM-T820 32 GB version OR tell me how to solve this problem please (I can't stress this enough)
Click to expand...
Click to collapse
Hello, and sorry for what happened to your tab.
Infact, it wasn't recommended to flash the OS in separate parts like you did, but when you were flashing them you should have seen if the "auto reboot" case in Odin was checked or not (and you should have unchecked it).
I must to be clear : you have to tell us if TWRP still works (which isn't probable) or if your download mode (Odin mode) still works, which is the basic of all, even on bricked devices.
If it works then you can reflash all the firmware again, BUT COMPLETELY AND NOT IN PARTS, if it doesn't work, then.... Your tab is deeply bricked and won't recover in an easy way.
JordanBleu said:
Hello, and sorry for what happened to your tab.
Infact, it wasn't recommended to flash the OS in separate parts like you did, but when you were flashing them you should have seen if the "auto reboot" case in Odin was checked or not (and you should have unchecked it).
I must to be clear : you have to tell us if TWRP still works (which isn't probable) or if your download mode (Odin mode) still works, which is the basic of all, even on bricked devices.
If it works then you can reflash all the firmware again, BUT COMPLETELY AND NOT IN PARTS, if it doesn't work, then.... Your tab is deeply bricked and won't recover in an easy way.
Click to expand...
Click to collapse
Uh oh. Yeah TWRP and Download mode all don't work. Nothing works. Only after connecting to the PC it shows QDLoader 9008 mode. And the reason I flashed it in parts is because THE DAMN TAB WOULDN'T STAY ON, EVEN AFTER I LET IT CHARGE FOR 5 HOURS. And even after I flashed it in parts it just rebooted and the bootloader flash failed. So yeah, hard bricked.
Oh and @JordanBleu I wonder if you have an SM-T820. Do you?
NullCode said:
Edit: Now I've messed up real bad. Since download mode wasn't staying on for more than 30 seconds, I decided to flash the OS in parts. First, I flashed the bootloader (BL). This is where the problems began. While flashing, the fricking tab rebooted and now my tab is in a veggie state. Nothing works, doesn't respond to ANYTHING. Upon connecting to PC, it displays "Qualcomm HS-USB QDLoader 9008". From what I can see, the entire boot partition and some core Qualcomm files got messed up. So I beg anybody for a solution. (Especially the people I trust: @rorymc928 @JordanBleu and @ashyx)
On YouTube I saw someone using EMMC Dongle to fix their Samsung phone, using a raw dump of the device. So i would ask anybody to give me a raw dump of the SM-T820 32 GB version OR tell me how to solve this problem please (I can't stress this enough)
Click to expand...
Click to collapse
NullCode said:
Uh oh. Yeah TWRP and Download mode all don't work. Nothing works. Only after connecting to the PC it shows QDLoader 9008 mode. And the reason I flashed it in parts is because THE DAMN TAB WOULDN'T STAY ON, EVEN AFTER I LET IT CHARGE FOR 5 HOURS. And even after I flashed it in parts it just rebooted and the bootloader flash failed. So yeah, hard bricked.
Oh and @JordanBleu I wonder if you have an SM-T820. Do you?
Click to expand...
Click to collapse
If you are talking about the wifi version, then sadly no (I only have the cellular variant, SM-T825).
I hope I can help you even with the cellular version.
JordanBleu said:
If you are talking about the wifi version, then sadly no (I only have the cellular variant, SM-T825).
I hope I can help you even with the cellular version.
Click to expand...
Click to collapse
Thanks a lot for giving your help. My plan is this:
My tab is in EDL Mode, and I saw on Google that EDL Devices can boot to SD Card when the eMMC Fails. So what I want to do is flash the bootloader and the PIT File to an SD Card, using the image pulled from your Tab.
Now the problem is:
1: The tutorials I found for doing this are OLD (like Galaxy S3 old).
2: I have no clue where the bootloader is stored on Samsung devices.
And also here is the tutorial I found for the Galaxy S3:
"1: Boot the device to TWRP and connect it to PC and open ADB (if you don't have it install "minimal ADB and Fastboot")
Now type the following commands:
ADB devices (to check if your device is detected).
If it is OK then do:
ADB shell
dd if=/dev/block/mmcblk0p1 of=/external_sd/part1.img
dd if=/dev/block/mmcblk0p2 of=/external_sd/part2.img
dd if=/dev/block/mmcblk0p4 of=/external_sd/part4.img
OK you see one number is always changing... we need this with following numbers:
1 2 4 5 6 7 10 11 14 15
Partition 10 and 14 are a bit larger so the command may look like it's stuck but it isn't."
Could you mind performing these steps and sending the files to AndroidFileHost?
Thanks in advance if you do.
And if it works I'll make a guide for everyone who has a hard bricked Tab.
By coincidence, without knowing your post, I recently read something about EDL I didn't know anything about before.
Perhaps this helps.
https://www.the***********.com/qualcomm-edl-mode-guide/
This adress seems censored so you have to replace the star by (custom) followed directly by (droid).
I've asked that guy if it's possible to build such a flashable file from the stock ROM but didn't get an answer yet.
bmwdroid said:
By coincidence, without knowing your post, I recently read something about EDL I didn't know anything about before.
Perhaps this helps.
https://www.the***********.com/qualcomm-edl-mode-guide/
This adress seems censored so you have to replace the star by (custom) followed directly by (droid).
I've asked that guy if it's possible to build such a flashable file from the stock ROM but didn't get an answer yet.
Click to expand...
Click to collapse
Good morning. Yeah I've tried that site because @rorymc928 gave me that website a long time ago (and it didn't go well). EDL devices can boot from the SD, so I wanted the bootloader image from anybody's Tab S3. I'd be very happy if you managed to give me.
NullCode said:
Good morning. Yeah I've tried that site because @rorymc928 gave me that website a long time ago (and it didn't go well). EDL devices can boot from the SD, so I wanted the bootloader image from anybody's Tab S3. I'd be very happy if you managed to give me.
Click to expand...
Click to collapse
Giving you the boot.img is not the problem but mine is for T825.
Don't know if they differ.
You could extract it from of the stock T820 ROM files couldn't you?
If you still want it, just tell me.
But as far as I understand the a. m. site the tool can only flash .elf or .mbn files didn't read about .img files.
bmwdroid said:
Giving you the boot.img is not the problem but mine is for T825.
Don't know if they differ.
You could extract it from of the stock T820 ROM files couldn't you?
If you still want it, just tell me.
But as far as I understand the a. m. site the tool can only flash .elf or .mbn files didn't read about .img files.
Click to expand...
Click to collapse
Man that's a bummer. You didn't understand my request. I don't need the boot.img (I already have it). What I need is the image of the BOOTLOADER (apdp, NON-HLOS, sec, tz, rpm, cmnlib etc) all combined in an img file. That's only possible if another person with the same device grabs one and sends it to me
bmwdroid said:
Giving you the boot.img is not the problem but mine is for T825.
Don't know if they differ.
You could extract it from of the stock T820 ROM files couldn't you?
If you still want it, just tell me.
But as far as I understand the a. m. site the tool can only flash .elf or .mbn files didn't read about .img files.
Click to expand...
Click to collapse
Also @bmwdroid well there's nothing to lose, so I'm giving you the thread which mentions how to do it (it was made for the Note 4, so idk if it still works) https://forum.xda-developers.com/note-4/general/tutorialhow-to-make-debrick-image-t3488082
Sorry that I misunderstood you.
You'll need to reinstall the stock OS with Odin on Windows
NullCode said:
Also @bmwdroid well there's nothing to lose, so I'm giving you the thread which mentions how to do it (it was made for the Note 4, so idk if it still works) https://forum.xda-developers.com/note-4/general/tutorialhow-to-make-debrick-image-t3488082
Click to expand...
Click to collapse
Hi @NullCode!
I've googled for the recovery process because I would use custom ROM on my SM-T590, so I want to make sure it can be restored if something goes wrong, and found your thread.
For me, in the downloaded official Samsung ROM there is a BL_T590(...) file which you can open with WinRAR (of course, download the FW for your model, for example with Frija). Then it will give you files like aboot.mbn.lz4 (I think this one is the Android bootloader), apdp.mbn.lz4, cmnlib.mbn.lz4, etc. You can decompress these files with LZ4 command line tool, and then you may be able to reflash them in EDL mode.
Edit: On some forums I found that they didn't decompress LZ4 files, so I have no idea which way could work.
Also there are some solutions to generate rawprogram.xml files for flashing, but I'm not sure if it's allowed to link them here.
Good luck, and let me know if this worked!
Tools:
Frija: https://forum.xda-developers.com/s10-plus/how-to/tool-frija-samsung-firmware-downloader-t3910594
LZ4 tool: https://github.com/lz4/lz4/releases/tag/v1.9.3
UDPSendToFailed said:
Hi @NullCode!
I've googled for the recovery process because I would use custom ROM on my SM-T590, so I want to make sure it can be restored if something goes wrong, and found your thread.
For me, in the downloaded official Samsung ROM there is a BL_T590(...) file which you can open with WinRAR (of course, download the FW for your model, for example with Frija). Then it will give you files like aboot.mbn.lz4 (I think this one is the Android bootloader), apdp.mbn.lz4, cmnlib.mbn.lz4, etc. You can decompress these files with LZ4 command line tool, and then you may be able to reflash them in EDL mode.
Edit: On some forums I found that they didn't decompress LZ4 files, so I have no idea which way could work.
Also there are some solutions to generate rawprogram.xml files for flashing, but I'm not sure if it's allowed to link them here.
Good luck, and let me know if this worked!
Tools:
Frija: https://forum.xda-developers.com/s10-plus/how-to/tool-frija-samsung-firmware-downloader-t3910594
LZ4 tool: https://github.com/lz4/lz4/releases/tag/v1.9.3
Click to expand...
Click to collapse
Hello! Well I would like to thank you for trying to help, but flashing with EDL mode isnt a possibility. Because even if i have the full ODIN firmware [which I do] I would need the official signed Samsung Firehose loader with the Sahara protocol. If that was a bit too complicated [no offence], basically I need to hack into Samsung's servers OR persuade a Samsung repair employee to give me the loader to flash my tab with. Alas, since this isnt a possibility, I am planning to send this tablet to its homeland [America] and get it JTAG flashed, because that is the only thing that can be done for this
NullCode said:
Hello! Well I would like to thank you for trying to help, but flashing with EDL mode isnt a possibility. Because even if i have the full ODIN firmware [which I do] I would need the official signed Samsung Firehose loader with the Sahara protocol. If that was a bit too complicated [no offence], basically I need to hack into Samsung's servers OR persuade a Samsung repair employee to give me the loader to flash my tab with. Alas, since this isnt a possibility, I am planning to send this tablet to its homeland [America] and get it JTAG flashed, because that is the only thing that can be done for this
Click to expand...
Click to collapse
Are you sure about that? I mean, isn't the EDL interface universal among Qualcomm SOCs? I think it is, there are lots of tools for flashing, also I haven't seen anything about Samsung locks this option, the only manufacturer that blocks 3rd party flashers is Xiaomi as far I know, but there is a modded flasher software for Xiaomi too. As I can see, there are threads about Galaxy S8 being reflashed and is working fine, so in theory Samsung doesn't lock bootloaders.
Also there is a file for MSM8996 for Galaxy Note 8 which is Snapdragon 820 in your tablet. It's in the G930XU5 folder.
https://forum.xda-developers.com/showpost.php?p=77904842&postcount=2
UDPSendToFailed said:
Are you sure about that? I mean, isn't the EDL interface universal among Qualcomm SOCs? I think it is, there are lots of tools for flashing, also I haven't seen anything about Samsung locks this option, the only manufacturer that blocks 3rd party flashers is Xiaomi as far I know, but there is a modded flasher software for Xiaomi too. As I can see, there are threads about Galaxy S8 being reflashed and is working fine, so in theory Samsung doesn't lock bootloaders.
Also there is a file for MSM8996 for Galaxy Note 8 which is Snapdragon 820 in your tablet. It's in the G930XU5 folder.
https://forum.xda-developers.com/showpost.php?p=77904842&postcount=2
Click to expand...
Click to collapse
No no Samsung doesn't block EDL mode at all (in fact, my tablet ONLY goes to EDL mode now), the problem is the flash loader, which is specific to each device. Xiaomi used to generously provide Fastboot ROMs which used the loader we are talking about and EDL mode to flash things, but they don't do that anymore.
Also, I tried the G930XU5 thing the day I wrote this thread, and it was stuck at 50% and didn't do anything else (I think this happened because the loaders are also flash chip dependant and the one in the Note 8 thread is UFS while the Tab S3 uses eMMC). Oh another thing, could you tell me the names of flashers that use EDL mode? I've only heard of QFIL and MiFlash
NullCode said:
No no Samsung doesn't block EDL mode at all (in fact, my tablet ONLY goes to EDL mode now), the problem is the flash loader, which is specific to each device. Xiaomi used to generously provide Fastboot ROMs which used the loader we are talking about and EDL mode to flash things, but they don't do that anymore.
Also, I tried the G930XU5 thing the day I wrote this thread, and it was stuck at 50% and didn't do anything else (I think this happened because the loaders are also flash chip dependant and the one in the Note 8 thread is UFS while the Tab S3 uses eMMC). Oh another thing, could you tell me the names of flashers that use EDL mode? I've only heard of QFIL and MiFlash
Click to expand...
Click to collapse
Final update: Well, someone from a mobile service explained me how it works, basically without a firehose file which is signed by Samsung specifically for the device, we can't do anything. I hope the files will be available for the public, because this way Samsung just forces their users to pay for a "repair" which could be done at home using the official Qualcomm solutions.
QPST - Official Qualcomm flasher
emmcdl - I think this one can do the flashing with multiple files since it has options like sector address, etc, also you can find a fota.zip (password for fota.zip is fotatest1234) inside the official Samsung ROM which has some partition table informations
Z3X Samsung Tool PRO - Looks like it can do many things, but doesn't start up for me, says "Card not found"
blankflash - This one is for Motorola devices, but who knows
sahara - You can find it on GitHub, there is an example .xml file too
And possibly many others which I haven't found yet.
Update: I found an app called PIT Magic, it can show partition table info and memory addresses after unpacking CSC and selecting the .pit file. Maybe that can be useful when used together with emmcdl, like flashing SBL back with emmcdl -p ttyUSB0 -b SBL1 C:\path_to_sbl1.mbn or with using these adresses in .xml files.
Update #2: There are some firehose files on "OneLabsTools" GitHub page for MSM8996 too.
https://forum.xda-developers.com/showthread.php?t=1916936
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
NullCode said:
Edit: Now I've messed up real bad. Since download mode wasn't staying on for more than 30 seconds, I decided to flash the OS in parts. First, I flashed the bootloader (BL). This is where the problems began. While flashing, the fricking tab rebooted and now my tab is in a veggie state. Nothing works, doesn't respond to ANYTHING. Upon connecting to PC, it displays "Qualcomm HS-USB QDLoader 9008". From what I can see, the entire boot partition and some core Qualcomm files got messed up. So I beg anybody for a solution. (Especially the people I trust: @rorymc928 @JordanBleu and @ashyx)
On YouTube I saw someone using EMMC Dongle to fix their Samsung phone, using a raw dump of the device. So i would ask anybody to give me a raw dump of the SM-T820 32 GB version OR tell me how to solve this problem please (I can't stress this enough)
Click to expand...
Click to collapse
You could try flashing twrp . It dont take more than 5 second. You only have to be prepare to enter to recovery mode because your device reboot automaticly
UDPSendToFailed said:
Final update: Well, someone from a mobile service explained me how it works, basically without a firehose file which is signed by Samsung specifically for the device, we can't do anything. I hope the files will be available for the public, because this way Samsung just forces their users to pay for a "repair" which could be done at home using the official Qualcomm solutions.
Click to expand...
Click to collapse
yeah I did say that a while before but I'm glad you understood. Without this "programmer" there is nothing we can do.
there's also a high likelihood that Samsung won't provide the firehose files because every company just wants money nowadays