Related
[Q] Generic "MID Tablet" stuck at boot screen; how to identify it, reflash, or fix?
I've acquired a generic "MID Tablet PC" (pictures of it are at on imgur at a/9QUUW -- sorry, I can't post links directly). It seems to have no manufacturer listed anywhere on it, either on box or manual or tablet itself. And it won't boot; turning it on shows what I think is a bootloader screen (Android logo in centre, and "Android OS 2.2, Kernel 2.6.32, Build Number V1.5.2" in bottom corner) and nothing else happens. It has power, volume + and -, menu, and "home" buttons. I've tried many combinations of button presses (power + vol+, power + vol-, power + vol+ + vol-, power + menu, etc) and none seem to do anything other than show the bootloader screen. So, I suspect it needs re-flashing or something. However, since I don't know what it *is*, I don't know which ROM to flash to it.
It does not have a USB device port. It has a proprietary port on the bottom, and there is an adapter for this port. That adapter has on it two USB host ports and an Ethernet RJ45 port. Normally the first thing I'd do would be to plug a USB cable into it and plug that into my computer, and poke it with adb, but there's no USB port to do that with. The manual supplied with it explicitly says that to put files/music/etc on the device you must either put them on a USB stick and then plug that stick into the adapter, or put the files on a microsd card and put that card in the slot, so I suspect that it's not capable of being plugged into a computer and used as a drive or with MTP.
(I have of course searched for previous failures of this sort; there are a fair few people around the internet posting with a similar problem, but no resolutions; XDA itself doesn't have any matches for "Build Number V1.5.2", and although a few people have pointed at a thing called "Uberoid", I don't know whether that's relevant.)
I imagine that if I had the correct firmware I could drop that on a microsd card and reflash the device. However, I do not know how to proceed; I don't know how to identify the device and so don't know which ROM to get and attempt to flash! So... help...? Two questions: is my conclusion above (that it's stuck at the bootloader, and reflashing will help) likely correct, and how do I identify the device and thus get some firmware for it that I can flash onto it in the hope of fixing?
stuartlangridge said:
how do I identify the device and thus get some firmware for it that I can flash onto it in the hope of fixing?
Click to expand...
Click to collapse
Brief update here for future searchers.
mymidpad.com lists many of this type of device. After comparing the downloadable PDF manuals with the paper manual I had, I concluded that I have an M709. I was able to download the firmware from mymidpad.com and flash it with a micro SD card. The touchscreen didn't work; by following the steps at techknow.me forum index.php?topic=174.0 to edit the env_uboot file I was able to get it working.
stuartlangridge said:
Brief update here for future searchers.
mymidpad.com lists many of this type of device. After comparing the downloadable PDF manuals with the paper manual I had, I concluded that I have an M709. I was able to download the firmware from mymidpad.com and flash it with a micro SD card. The touchscreen didn't work; by following the steps at techknow.me forum index.php?topic=174.0 to edit the env_uboot file I was able to get it working.
Click to expand...
Click to collapse
Awesome, Mine was FujeZone Touch Pad TP700 and the M709 Worked and there were no touch problems. It was any easy fix once I found the right file. Searched everywhere but couldnt find a file. Thanks for providing an update on the thread, You helped someone.!
Where to begin? Logic would dictate, the beginning.
I'll do my best to be brief with the backstory.
Months ago I ordered a Jide Ultratablet to use as my portable workhorse. At first things were peachy until a rather monumental lag began to manifest every 15-45 seconds. It made the device impossible to utilize in any productive fashion, so I contacted Jide and opened up a support ticket. After months (in no way an exaggeration) of barely responsive correspondence, during which I sent them a video to demonstrate the problem, they finally came back to me with an email containing a link to a compressed folder containing the Remix 2.0 images, and also a link to a rather vague and complicated tutorial on how to flash Remix 1.5 manually to a device. (In fact, I tried to include a link to the tutorial, but I am unable to since I haven't posted to the forum enough. I am happy to PM it or email it to anyone who might like to help) I can only assume I am meant to apply the same logic to the Remix 2.0 files they sent me. Seemed a bit dicey at first glance, but while I'm by no means an expert, I'm no slouch in this arena and I'm a very quick study.
Now, on to the proverbial meat and potatoes:
If you were able to contact me for a link to the tutorial in question, you will have undoubtedly seen that they indicate one should use ADB-Fastboot as a means to flash the recovery image. No real surprises there. I have ADB and Fastboot installed on my PC (Windows 10). I also have the ADB drivers installed and have confirmed the addition to my PATH. (eg: ;C:\ADB) I can also confirm that it is working fine since I am able to pull up a terminal and issue the ADB command and it gives me the usual wall of commands. The problem is that my device (Ultratablet) is not being seen by ADB. I have checked my USB drivers and they are all up to date and installed properly. My PC sees the device no problem and there is no indication of any sort of connection error. I've also tried different cables and ports. Yet, I can't access it via ADB and thus am unable to issue commands to my device such as "adb reboot bootloader" or "fastboot reboot-bootloader".
My next logical approach was to attempt forcing the device into fastboot mode using the hardware button combination, which is not listed specifically for the Ultratablet anywhere, I might add. (Power key + Volume up) It brings me to a boot options menu with the selections "Continue/Fastboot Protocol/Recovery Kernel/Reboot/Poweroff/Forced Recovery". Ateempting to select Fastboot Protocol causes the display to shut off for a moment, the device to vibrate once, and then the display to turn back on back at the same menu full of selections.
So, in summary, I am expected to flash the device using fastboot and yet I can't even get the device into fastboot mode, let alone issue commands from my PC terminal. As I highlighted near the beginning, teh Jide support team is incredibly unresponsive and not overly helpful. I have notified them of this same set of issues, but I don't expect to hear back in any expedient fashion and I thought one of the mighty members here on XDA might be able to help me come up with a next step in the meantime. I'd cerainly love to be able to use my shiny new tablet.
In any case, thank you for your time.
Kind regards.
Shaiden
Bump? Anyone? Still swinging in the breeze on this one. No word back from the manufacturer, as expected. =/
I have the same problem
Shaiden said:
Bump? Anyone? Still swinging in the breeze on this one. No word back from the manufacturer, as expected. =/
Click to expand...
Click to collapse
I know it's been 4 years but did you find any solution to this? I'm asking because I have the same problem. I decided to downgrade to Remix OS 1.5 in order to root (I have tried 5 rooting apps with no success) but my device refuses to enter fastboot protocol. The whole idea was since I can't find a way to root the damn thing in its current state maybe I can manage it with its older OS version. All this just to turn it to android root apps "testing ground" device. Oof.
These tablets were sold with certain Vizio TVs in mid-2016 into 2017, primarily used for Smartcast to the TV.
They are now obsolete since Vizio released firmware for their TVs turning them into normal Smart TVs, requiring the owners of these TVs to get new remotes and the tablets stopped being useful for this function.
Here in 2019, one can buy these tablets, at the low price end, in working condition, for $25 (for the M series) to $40 (for the P series) shipped.
The specs are as follows:
XR6M10:
Snapdragon 410 1.2GHz quadcore APQ8016
2GB RAM
8GB Storage
1280x720 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
XR6P10:
Snapdragon 615 1.45GHz octocore APQ8039
2GB RAM
16GB Storage
1920x1080 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
Both tablets feature side-firing stereo speakers, a headphone jack, and NO cameras. The size of the tablet is comparable to the size of a Galaxy Note 9, give or take.
Both tablets came with Android 5.1.1, and OTA updates upgraded them to 6.0.1. There are ZERO available stock ROM files available for the tablets. I've tried sniffing the updater and they seem to go to a dead website.
The stock ROM is fairly clean, and only has the Vizio Smartcast app which needs disabling upon setting up. Aside from this, there is no other bloatware on the tablet to speak of after running a fine-tooth comb through the system apps. You get a clean and snappy tablet.
The problem:
There's no stock ROM file available, neither for Android 5.1.1 or for 6.0.1. Vizio does not have any sort of download for either on their site, nor did in the past. The updater checked a third-party website affiliated with Vizio to manage the tablet's updates, as it does with their TVs. Since the website is inert, it can be safely said that Vizio is no longer interested in their existence at all, especially since the warranty on every single one of these tablets is now up.
The tablet seems it can have the bootloader unlocked, the developer options has the toggle for that, but there's no way to get into fastboot. Holding VOL UP+DOWN+POWER at boot or sending the "adb reboot bootloader" command sends it into a "Qualcomm HS-USB QDLoader 9008" mode under USB. This, from what I understand, is behavior persistent with the locked bootloader, but I have no idea of how to get it out of this and just into fastboot. Stock recovery does not have a fastboot option either.
The desires list:
Have someone that knows the intricacies of the MSM8916 platform and the APQ8016/APQ8039 get their hands on these tablets
Get a ROM dump of both tablets in stock form so people with bricked tablets can flash them with it
Get Root (Patch level on the 6.0.1 stock ROM is from October 2016, shouldn't be hard)
Get the bootloader unlocked, somehow, and if not, figure a way to get something like Safestrap running on it if the out-of-the-box kernel allows for it
Custom ROMs? LineageOS would be sweet, especially with some of the tablet-specific fixes that have dropped in the past couple months overall.
so I ask: is there any interest in the freeing of these super cheap tablets? The price to spec ratio is not bad (once again, I got my 6M10 for $25 shipped, and the seller has like 7 more as of the time of this writing), and it doesn't seem like it would be all too hard to unlock the bootloader and get it rooted (at least, from my perspective, that of a novice in this specific hardware field). There are plenty of these in the wild in the hands of people that bought the TVs and plenty in the hands that bought them from ebay when the tablets became obsolete.
This link contains screenshots of CPU-Z and the About Tablet settings section from the tablet, uploaded to imgur. If anyone needs more information on this tablet that needs an app or adb command, I can make this happen.
Board Pic of the XR6M10, XR6P10 should be the same inside:
(click for larger image)
Update: I have temp root.
I have temp root!-the latest kingroot (NOT Kingoroot) APK seemed to have done the trick. I was able to fire up adaway and get the hosts file set up with adblocks to keep the thing safer.
The root is still temporary so it goes away after a reboot. The rooting process involves it doing the root process once, then rebooting, then failing, then you reboot once more, and then retry rooting from the app. From here, 80% of the time, it works and you're able to get temporary root for that boot session.
Once you're done with anything you need root for, you should reboot and then uninstall Kingroot, which you then need to deactivate the device administrator priveleges for, before it will allow you to cleanly uninstall it.
I also made a huge discovery that may turn out better for anyone that can help getting this thing properly rooted and the bootloader unlocked... it seems the file manager included in the stock ROM is v3.0.0 from Cyanogenmod 12.1.
This makes me think that the ROM creator either used that since it was opensource and readily available than come up with their own solution, or that this ROM has some cyanogenmod roots.
I also found this post from another Q&A thread in this section:
TheDrive said:
This device have made by Chinese/Indian company Borqs. The code name Bennu-M. Platform is Qualcomm APQ8016 (MSM8916 w/o modem). There should work standard method to bring EDL mode. Hold Vol+ and Vol- at power on (press power). Then connect to the PC. Thus device will stay look dead, however should be detected as Qualcomm QDLoader 9008 on the PC side. This is the factory described method.
You can flash factory firmware from this mode using external bootloader (programmer) for MSM8916 firehose protocol. This procedure is described in the thousands of manuals around the net. Qualcomm tools like QPST or QFIL can be used as good as many 3rd party utils to flash and manage any another available way. Many professional 'box' tools should support this device too but only as 'generic' msm8916 (if applicable).
However I can't find the firmware package for this device anywhere. You should ask and require the manufacturer/distributor to publish firmware, the source code and all the corresponding matherials to be able to flash and rebuild firmware from sources in any manner you want without any limitations as required by GNU/GPL free open source software licenses this firmware is obligated to.
Everyone who have the device working or software dead, can try to dump the current firmware and data, stored on the internal eMMC memory module in part(s) or in whole image using free QTools project utilities and suitable external bootloader with ability to dump eMMC, not only to flash as many factory supplied programmers do. There are programmer(s) for MSM8916 available in the project repo. Read and understand manuals carefully before trying anything!
There is definitely another ways to root, dump, flash, manage the device in any manner YOU WANT, not only the way you are "allowed" to use your own device by manufacturer/distributor. FTA!
You can root the device then dump all the multiple partition images manually (dd if=/dev/block/mmbblk0...... of=/sdcard/......) or using built custom recovery like CWM/TWRP for your device. Please note, kernel sources are important but not mandatory to build e.g. CWM. You can build one using CWM image from the similar device and the kernel (boot/recovery) image binaries from your device. There are good manuals and image repacking utils available around like e.g. AndImgTool.
There are the way to produce factory image from the eMMC/partitions dump(s). Use utils like R-Studio to dump particular partition images from the eMMC dump (it's like whole HDD or UFD image with all the sectors raw, one by one, w/o any modifications/compression/etc) Manuals / utils are avavailable to make e.g. sparse and xml scripts set which is flashable by the programmer in the EDL mode (i.e. from any damaged state, because EDL is built in to the PBL and masked to the internal CPU ROM, thus can not be damaged in any manner, except firing the CPU up).
You can also flash partition images from the more common Fastboot mode, unless eMMC GPT and bootloaders (SBL/RPM/TZ/ABoot) stay intact (logo showed). You can't dump from fastboot, which is common due to the (foolish) 'safety' requirements. It's security by obscurity and is definitely not for your favor, but for the corps control over you and force to send valuable private data to foreign clouds.
Please share eMMC full and/or partitions dumps using reliable 'neverending' file cloud/hosting since there is no factory firmware available yet (ever). I do not own this device and never seen being overseas, so I can't share.
Click to expand...
Click to collapse
This gives a little bit more information but seems to be more waffle than helpful. Still need someone, or some individuals, that can get one of these devices into their hands and work on a way to get the bootloader unlocked, the eMMC dumped, and ROMs going.
Update file?
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Sudosftw said:
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Click to expand...
Click to collapse
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Qiangong2 said:
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Click to expand...
Click to collapse
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Sudosftw said:
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Click to expand...
Click to collapse
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Qiangong2 said:
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Click to expand...
Click to collapse
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Sudosftw said:
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Click to expand...
Click to collapse
Hmmm. Which tablet do you have? The M or the P?
Qiangong2 said:
Hmmm. Which tablet do you have? The M or the P?
Click to expand...
Click to collapse
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Sudosftw said:
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Click to expand...
Click to collapse
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Qiangong2 said:
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Click to expand...
Click to collapse
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Sudosftw said:
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Click to expand...
Click to collapse
Hmmm. That's unusual. Are you running it in win 7 compatibility mode?
It would be nice to see community roms for these devices. I have the XR6P. If you need any info from this device, just tell me what to do.
I'm very interested in this as I have one of these tablets that I would like to use in my vehicle as a display for my piggyback ECU tuner. It doesn't currently support USB OTG, but I read that if I can gain root access I can add the file to give it USB Host functionality. Can anyone confirm this? I have tried several apps to get it rooted including Kingroot as you were able to get a temp root with that. Unfortunately Kingroot, as all the others I have tried, won't even install on the tablet. Again, I'm only looking to get this thing to be OTG capable. If anyone here has any suggestions, I would be very grateful! Thanks all!
I just bought an M remote to replace my broken P remote. My P remote had Android 6. My M remote has Android 5, and the OTA updater says there's no update. Any way to get Android 6 on this?
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
ALANCHONG said:
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
Click to expand...
Click to collapse
Hey. You can lay out the firmware for XR6M10
XR6M10 and XR6P10 firmware
konog said:
Hey. You can lay out the firmware for XR6M10
Click to expand...
Click to collapse
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
ALANCHONG said:
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
Click to expand...
Click to collapse
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
konog said:
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
Click to expand...
Click to collapse
Please check if the driver is installed
Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Looking for someone who help me root this device.
Code:
CPU: Amlogic S905X2 Quad Core ARM Cortex A53
GPU: ARM Mail-G31 MP2
OS: Android 10.0 ATV
Memory: DDR4 2GB, eMMC 8GB
Review: https://www.wirelesshack.org/review-mecool-km2-android-10-tv-box-2gb-ram-s905x2-cpu.html
reserved for future updates
LifelessLife said:
Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Click to expand...
Click to collapse
I don't think this will happen. This box is certified by Netflix.
Once you can root it, Mecool will lose the Netflix certification and most probably Mecool won't get certification in the future.
Noter2017 said:
Once you can root it, Mecool will lose the Netflix certification and most probably Mecool won't get certification in the future.
Click to expand...
Click to collapse
That's not true. Nvidia Shield is rooted, doesn't mean they cannot get future certifications.
rajricardo said:
That's not true. Nvidia Shield is rooted, doesn't mean they cannot get future certifications.
Click to expand...
Click to collapse
Can you name another box?
The Shield is a complete exception. Not even the certificated Xiaomi boxes can be rooted, even though they have a huge community.
Mecool also has to be super careful. Not that long ago they have been selling boxes with fake/illegal certificates that could play Netflix in HD. Netflix blocked all of these boxes at some point.
Hi All,
I'm fairly new to this android tv scene, but have been following these discussions for a couple months now... I'm a hardware guy, so I picked up a couple of these units, and dissected one, ie took off the CPU and emmc.
I'm still not quite understanding of what exactly is happening with 'unlocking' bootloaders, and how this AMLogic 'tee' environment fully works, maybe you all can try to help me out a bit..
but I did want to share that I see we can still USB boot this thing, and use the AMLogic burning tool to at least re-write an image to the flash... the 'boot_5' pin I've shown in the attached pics..
you can catch it from that via (or trace) in the pic, and just touch it to gnd while powering on the unit, and it goes into USB boot via the amlogic rom... world cup device comes up and you can indeed use the burning tool..
I also dumped the emmc flash if anyone wants it? I'm not sure if that helps for being able to root it though, that's where I need some help understanding... I realize there are BL1, BL2, and BL3 boot stages, BL2 & BL3 I believe are the 'boot.img' and 'bootloader.img' that are present in the flash? that right?
I can put the emmc dump up on a mega.nz link if anyone wants it, but wasn't sure if it matters...
Principal-McVicker said:
but I did want to share that I see we can still USB boot this thing,
Click to expand...
Click to collapse
By, "USB boot" do you mean actually boot operating system files from USB, or do you mean just the ability to obtain a burn mode (worldcup) connection over USB?
Principal-McVicker said:
I'm still not quite understanding of what exactly is happening with 'unlocking' bootloaders,
Click to expand...
Click to collapse
Skyworth has modified u-boot (bl33) for this device such that u-boot won't recognize an unlocked status for the bootloader.
Principal-McVicker said:
use the AMLogic burning tool to at least re-write an image to the flash...
Click to expand...
Click to collapse
For the above reason (no recognition of an unlocked status), flashing images that are not unmodified stock will fail verification and not boot.
Principal-McVicker said:
I also dumped the emmc flash if anyone wants it?
Click to expand...
Click to collapse
What version does it contain?
Hi,
So hopefully this will clarify a bit... the AmLogic S905X2/X3 uses the 'boot4/boot5/boot6' pins for the power-on boot order (power-on config) pins... these are shared pins, that are also DAT4,DAT5,DA6 (data bits 4,5,6) for the emmc interface.
So internally the amlogic has boot4/5/6 pull up, ie '111' for the boot order. When you pull boot5 low, it goes 101, ie USB first.... this is essentially what this is doing, so the amlogic bootRom is now in USB boot first, versus emmc.
(I'm assuming you can prob. also do this by just shorting any of the emmc data bits to gnd (versus just bit 5), cause corruption, and it should also fail over to usb..
I haven't tried to actually flash any image yet, but at least I see the worldcup device, and connect with the burning tool...
so I'll attach the bootup log, as well as the 'build.prop' from the /vendor folder in the image... I think this should tell you what version it's running...
*** BTW: forgot to mention, most of these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin... and it's coded into the AmLogic u-boot code is 'AMLOGIC_KEY' or something like that... so when you hold it... u-boot eventually see's it and halts, and starts up the usb device ***
This is much later then when doing the above, putting the CPU into usb-boot.. just FYI....
Another thing I wanted to mention, regarding the BL33 (which I now understand is u-boot), in the image dump, it starts at offset 0x200, and appears to probably be AES encrypted, there's not even a header on it?
I also took apart an X96 Max+ for comparison, since that box is pretty much open, and the flash image has u-boot unencrypted at the same location, and it starts with the @aml header...
I've been going through the AMLogic tools trying to understand where/how the encryption is done, but I don't understand yet how this BL33 is encrypted, and how BL32 knows what the keys are? and what's the difference from the X96 having u-boot unencrypted..
and in this one, the BL33 is encrypted? How did 'Skyworth' decrypt the bootloader to patch it?
(I'll follow-up with a mega.nz link with the mecool image once it finishes uploading)
Here's the full emmc dump:
734.74 MB file on MEGA
mega.nz
LifelessLife said:
Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Looking for someone who help me root this device.
Code:
CPU: Amlogic S905X2 Quad Core ARM Cortex A53
GPU: ARM Mail-G31 MP2
OS: Android 10.0 ATV
Memory: DDR4 2GB, eMMC 8GB
Review: https://www.wirelesshack.org/review-mecool-km2-android-10-tv-box-2gb-ram-s905x2-cpu.html
Click to expand...
Click to collapse
Principal-McVicker said:
but at least I see the worldcup device, and connect with the burning tool...
Click to expand...
Click to collapse
Note that there are two types of worldcup connections. One is invoked entirely from bootrom, it is sometimes called usb download mode. It is sort of a DFU mode that has limited functionality.
In the uart console, a connection to this type of worldcup connection will look something like this;
Code:
G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:800;NAND:81;SD?:20000;USB:8
Note that nothing can be done using the burning tool, or the command-line update tool, with the above type of worldcup connection on the km2, due to download mode access being password protected on this device. Notwithstanding the fact that the usb burning tool will report the connection.
The second type of worldcup connection is invoked from an application in u-boot named "update". This type of worldcup connection can work with the usb burning tool or the command-line update tool. There is no password protection. In the uart console, a connection to this type of worldcup connection will look something like this;
Code:
InUsbBurn
wait for phy ready count is 0
[MSG]sof
Set Addr 1
Get DT cfg
Get DT cfg
Get DT cfg
set CFG
Get DT cfg
Get DT cfg
Principal-McVicker said:
I've been going through the AMLogic tools trying to understand where/how the encryption is done, but I don't understand yet how this BL33 is encrypted, and how BL32 knows what the keys are? and what's the difference from the X96 having u-boot unencrypted..
Click to expand...
Click to collapse
Read all of the stuff at the following link, starting from oldest to newest;
Code:
https://fredericb.info/tag/amlogic.html
Principal-McVicker said:
How did 'Skyworth' decrypt the bootloader to patch it?
Click to expand...
Click to collapse
Maybe it is not most correct to call it a "patch" I use that terminology because that is what skyworth uses. You'll see something like this in the uart console;
Code:
[sk_patch,24]amlogic's uboot for Android10().date:Apr 8 2021
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
[sk_usb_cfg_init,422]load file "/skyworth/factory_mode/uboot/check_udisk.cfg" from u disk failed!
[sk_boot,182]general boot.
Whatever skyworth does to u-boot, it is done at the source level before the bootloader is compiled.
Principal-McVicker said:
most of these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin... and it's coded into the AmLogic u-boot code is 'AMLOGIC_KEY' or something like that... so when you hold it... u-boot eventually see's it and halts, and starts up the usb device ***
This is much later then when doing the above, putting the CPU into usb-boot.. just FYI....
Click to expand...
Click to collapse
You can define the upgrade_key to be any gpio pin you like that is not otherwise used.
You can use GPIOA0_3, but I think skyworth also uses that for some usb power mode. I think I used GPIOA0_5, which is one of the pins on the uninstalled infrared led near the micro sd slot.
The factory location for the reset button is a side mounted smd switch below the microsd slot (opposite side of the board). In the fcc photo's this switch is actually installed along with some smd resistors near it. I never figured out what gpio pin it uses. But it could never work without being defined in the environment, which it is not!
What's your end goal here? Modifying the bootloader will be rough unless you can get the bootrom keys. If you don't modify the bootloader so that an unlocked status is recognized, you can't flash non-stock partitions.
If you just want root, that can be done with a workaround. If you want to use the device to boot an alternate operating system, this probably can be done, with a workaround.
G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:800;NAND:81;SD?:20000;USB:8
Note that nothing can be done using the burning tool, or the command-line update tool, with the above type of worldcup connection. Notwithstanding the fact that the usb burning tool will report the connection.
Click to expand...
Click to collapse
Heya,
Just wanted to clarify on this... that is the USB connection right from bootROM that I get... and the burning tool would work if I had the bootrom pwd, as this unit reports PWD is needed...
I just did this last night on a 'banana pi M5', which does not have a pwd locked bootrom, and I did the usb burn from this boot method, as it did not have any code on it whatsoever prior to me loading it....
Thanks for all of the info BTW, I'll read over it all, what I really wanted to know about was how that BL33 was encrypted... I'll get back if I have more questions, but I really appreciate all the info
My end goal was really just to understand what all of you already knew, I just couldn't get my head around all of it... I wanted to either just load another OS on this entirely, or figure out a way to hack the bootloader....
Principal-McVicker said:
Just wanted to clarify on this... that is the USB connection right from bootROM that I get... and the burning tool would work if I had the bootrom pwd, as this unit reports PWD is needed...
Click to expand...
Click to collapse
Right, in order to use usb download mode, you need the password (if one is employed).
But this is the very odd case use of a worldcup connection. Unheard of for end-user use.
End users use the reset button, which runs the u-boot "update" application to establish a more robust worldcup connection that can flash and read, and even run u-boot shell commands, without any password.
yeah, so I've been looking at compiling source, as its all up there for the banana pi, so I can play with all the pieces..
Is this skyworth info up in another thread here on this site?
Also, how did he actually write this re-compiled BL33 to the device? he re-program the flash and re-mount it? or just tap the lines and program in place?
Or, I'm taking a guess he may have used the unsigned loader exploit? I'm guessing that may not be patched in current bootROMs? or at least not all of them?
Principal-McVicker said:
these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin...
Click to expand...
Click to collapse
goapy said:
The factory location for the reset button is a side mounted smd switch below the microsd slot (opposite side of the board). In the fcc photo's this switch is actually installed along with some smd resistors near it. I never figured out what gpio pin it uses. But it could never work without being defined in the environment, which it is not!
Click to expand...
Click to collapse
Since you have an extra km2 with the x2 SoC removed, can you trace back the factory reset button traces to the gpio location on the SoC?
I tried finding it by shorting the traces, and using u-boot's gpio command to see which pins had a status change, but I still couldn't find which gpio pin is being used by the factory reset switch location.
Principal-McVicker said:
Here's the full emmc dump:
734.74 MB file on MEGA
mega.nz
Click to expand...
Click to collapse
Thanks for this. This contains version;
MECOOL/HP4035-Mecool/LAS:10/QTT5.200819.003/C2.0.6_20210723:user/release-keys
Although over a year old, it is 4 months newer than what I had.
Since you have an extra km2 with the x2 SoC removed, can you trace back the factory reset button traces to the gpio location on the SoC?
I tried finding it by shorting the traces, and using u-boot's gpio command to see which pins had a status change, but I still couldn't find which gpio pin is being used by the factory reset switch location.
Click to expand...
Click to collapse
Sure thing... I'll do this tonight when I get back home from work, no problem at all...
I think the first step I'd like to try with this thing is just get root? if possible... or at least do something fun to it...
(best way to try and really get a better understanding of this arm tee is to work on a fully locked implementation like this one)
Principal-McVicker said:
I think the first step I'd like to try with this thing is just get root? if possible... or at least do something fun to it...
Click to expand...
Click to collapse
Since doing this is a rather technical process and requires verbose instructions, I'll send the details via direct message.
Principal-McVicker said:
(best way to try and really get a better understanding of this arm tee is to work on a fully locked implementation like this one)
Click to expand...
Click to collapse
It might help to turn on full log level console output for the stock build. Then at least you'll see all of the tee interactions during bootup.
goapy said:
Since doing this is a rather technical process and requires verbose instructions, I'll send the details via direct message.
It might help to turn on full log level console output for the stock build. Then at least you'll see all of the tee interactions during bootup.
Click to expand...
Click to collapse
Heya, Ok... that would be great if you could PM me whatever you can help with...
I double-checked myself, as I thought maybe I missed a u-boot console, but I don't see one on this thing, I don't see any way for it to break into u-boot or any stage while it's booting up? nothing I hammer on the keyboard stops the process from what I can tell?
So, I was trying to identify which pads you are saying are for the smd switch.. but I waasn't totally sure, figured it would be faster to just post the top/bottom pics from that side, and you just circle the spot you want me to trace out?
(FYI, I took down my mega.nz link for the dump, since it sounds like you pulled it down, I hate leaving that stuff up for long unless someone else needs it, they can always PM me)
See attached image. The purple arrow identifies the pad that I want to trace.
But I just remembered that it is difficult to trace because it goes to a via to the opposite side of the board underneath the card slot.
I don't want to make work for you, I was just curious.
Hisense just released a new device called the A9. Since this phone has Snapdragon 662 I was wondering how easy it would be to root this device. I know there is an EDL for this CPU. The Hisense A5 series was also rootable. Not sure what method was used.
The Onyx Boox Note Air 2 (a 10.3" tablet), which I have, also runs on the same Snapdragon 662 and can be rooted via Magisk. I used the EDL to dump the boot.img on the Note Air 2 to root it via Magisk.
Disclaimer: I'm not a developer or super technical guy, but have rooted a few devices by following guides.
Does anyone know how easy or fast a root would be available? I'm assuming they didn't lock the bootloader on this device as most Chinese devices.
Hello, could you share with us how to root boox device please?
It would be great if GAPPS could be used.
Replying to bump this thread. I have the Hisense A9 and would love to be able to root. It has an option to unlock the bootloader in the developer options if that is helpful.
formeriphoneuser said:
Does anyone know how easy or fast a root would be available? I'm assuming they didn't lock the bootloader on this device as most Chinese devices.
Click to expand...
Click to collapse
Hello and good morning, @formeriphoneuser
I hope you'll always find and get the support you require.
However, prior to your next posting please read the guidances that are stuck on top of every forum like
[Read Before Posting]QUESTIONS DO NOT BELONG IN GENERAL
Hello Everybody, In order to attempt to keep this forum neat and tidy the moderation team is asking you to post your questions into the Questions and Answers (Q&A) forum and not into the General section. You can find the Q&A forum by clicking...
forum.xda-developers.com
and the others. I've moved the thread to Android Q&A.
Thanks for your cooperation!
Regards
Oswald Boelcke
Senior Moderator
I recently good a Hisense A9, and I've been trying to extract the boot.img and / or recovery.img from it (since I can't find either of those online yet). So far I've been trying to get boot.img from EDL mode using this EDL tool. I can boot into EDL mode fine, but when I try to run an EDL command there are lots of errors. It's possible I'm using the wrong Firehose file, but I think it's right. (I'll post a link to the logs below). I've been following this guide mainly. Is anyone else working on this?
*Edit* the firehose file I'm using is 0014d0e100000000_d40eee56f3194665_FHPRG.bin.
Anyway, OP - hopefully I, or someone, can get the boot image or recovery image soon, then we should be able to patch it with Magisk fairly easily and install Google Services etc.
A word of warning to anyone who wants to try working on this - every time I restart after being in EDL mode, the phone goes into a boot loop of sorts. I enter the 6-digit pin at boot-up, and the phone says something in Chinese (which Google translates as something like "optimising the system, please wait", from memory), and then keeps showing the desktop screen for a second, then looping back to the pin code input, then showing the message, and then repeat. If you hold down volume down, it'll go into safe mode, but then the same thing happens when you restart. I've always managed to get out of it, but I'm not 100% sure how! Something like holding the power key down for about 10 seconds while it's looping... The phone vibrates, but doesn't turn off, and then the loop stops and you can enter your 6-digit pin again and it's back to normal. If that doesn't work, then try turning the phone off, then back on again, but holding the power key down so it keeps restarting without fully booting. Last time I made it restart ~5 times, and then it was back to normal. Maybe it cleared some kind of system cache...?
These are the errors I get from the EDL tool when I try to extract the boot image.
https://pastebin.com/ejXfCJs9
https://pastebin.com/5CqUPB0a
https://pastebin.com/LMmEmm6v
RunnyYolk said:
I recently good a Hisense A9, and I've been trying to extract the boot.img and / or recovery.img from it (since I can't find either of those online yet). So far I've been trying to get boot.img from EDL mode using this EDL tool. I can boot into EDL mode fine, but when I try to run an EDL command there are lots of errors. It's possible I'm using the wrong Firehose file, but I think it's right. (I'll post a link to the logs below). I've been following this guide mainly. Is anyone else working on this?
Anyway, OP - hopefully I, or someone, can get the boot image or recovery image soon, then we should be able to patch it with Magisk fairly easily and install Google Services etc.
A word of warning to anyone who wants to try working on this - every time I restart after being in EDL mode, the phone goes into a boot loop of sorts. I enter the 6-digit pin at boot-up, and the phone says something in Chinese (which Google translates as something like "optimising the system, please wait", from memory), and then keeps showing the desktop screen for a second, then looping back to the pin code input, then showing the message, and then repeat. If you hold down volume down, it'll go into safe mode, but then the same thing happens when you restart. I've always managed to get out of it, but I'm not 100% sure how! Something like holding the power key down for about 10 seconds while it's looping... The phone vibrates, but doesn't turn off, and then the loop stops and you can enter your 6-digit pin again and it's back to normal. If that doesn't work, then try turning the phone off, then back on again, but holding the power key down so it keeps restarting without fully booting. Last time I made it restart ~5 times, and then it was back to normal. Maybe it cleared some kind of system cache...?
These are the errors I get from the EDL tool when I try to extract the boot image.
https://pastebin.com/ejXfCJs9
https://pastebin.com/5CqUPB0a
https://pastebin.com/LMmEmm6v
Click to expand...
Click to collapse
Maybe try this loader. This is for sure the one I used for my NA2. Otherwise, you have quite some errors that relate to python. Not sure what the issue is there.
formeriphoneuser said:
Maybe try this loader. This is for sure the one I used for my NA2. Otherwise, you have quite some errors that relate to python. Not sure what the issue is there.
Click to expand...
Click to collapse
Awesome, thanks! I should have mentioned which loader I was using (different to the one you linked). I'll edit my post to say what I used before.
I tried the loader that @formeriphoneuser suggested, but with a similar result. (https://pastebin.com/ucMkEkeW). I also tried with the flag --memory="ufs" in case the device has UFS memory, but similar result.
But the good new is, I've just discovered a reliable way to avoid the boot loop after leaving EDL mode. So to leave EDL mode, make sure any running commands have ended, unplug the device from the computer, and press and hold the eink button (on the left of the phone), volume-up, and power button. Keep them all pressed until the first vibration (after about 15 seconds or so, then release the power button only). Keep the other two pressed while the phone boots, and even while you're entering your 6 digit pin code. When you see the main screen you can release the buttons and your phone shouldn't enter the boot loop. I have no idea how much of that is necessary, but something in there works for me.
I've added an Issue to the github repo for the EDL tool I'm using. Other than that, I think I've hit a brick wall and won't be able to do any more for now. Unless anyone knows how to check that the firehose file is correct for my device, and update it if it's not. Hopefully Hisense will release the stock firmware, or send us an OTA update or something.
Does this work? if the Bootloader could be unlocked.
Arthurliao said:
Does this work? if the Bootloader could be unlocked.
Click to expand...
Click to collapse
The problem with a GSI is that Android doesn't have partial refresh support for the eInk display, which means a driver has to be written from scratch, otherwise the display will be verrrrrry slow.
RunnyYolk said:
I tried the loader that @formeriphoneuser suggested, but with a similar result. (https://pastebin.com/ucMkEkeW). I also tried with the flag --memory="ufs" in case the device has UFS memory, but similar result.
But the good new is, I've just discovered a reliable way to avoid the boot loop after leaving EDL mode. So to leave EDL mode, make sure any running commands have ended, unplug the device from the computer, and press and hold the eink button (on the left of the phone), volume-up, and power button. Keep them all pressed until the first vibration (after about 15 seconds or so, then release the power button only). Keep the other two pressed while the phone boots, and even while you're entering your 6 digit pin code. When you see the main screen you can release the buttons and your phone shouldn't enter the boot loop. I have no idea how much of that is necessary, but something in there works for me.
I've added an Issue to the github repo for the EDL tool I'm using. Other than that, I think I've hit a brick wall and won't be able to do any more for now. Unless anyone knows how to check that the firehose file is correct for my device, and update it if it's not. Hopefully Hisense will release the stock firmware, or send us an OTA update or something.
Click to expand...
Click to collapse
Bit of a long shot here, but I vaguely remember having trouble with EDL on my Oneplus 6T and I think the solution was to use a USB2 port instead of USB3.
RunnyYolk said:
I tried the loader that @formeriphoneuser suggested, but with a similar result. (https://pastebin.com/ucMkEkeW). I also tried with the flag --memory="ufs" in case the device has UFS memory, but similar result.
But the good new is, I've just discovered a reliable way to avoid the boot loop after leaving EDL mode. So to leave EDL mode, make sure any running commands have ended, unplug the device from the computer, and press and hold the eink button (on the left of the phone), volume-up, and power button. Keep them all pressed until the first vibration (after about 15 seconds or so, then release the power button only). Keep the other two pressed while the phone boots, and even while you're entering your 6 digit pin code. When you see the main screen you can release the buttons and your phone shouldn't enter the boot loop. I have no idea how much of that is necessary, but something in there works for me.
I've added an Issue to the github repo for the EDL tool I'm using. Other than that, I think I've hit a brick wall and won't be able to do any more for now. Unless anyone knows how to check that the firehose file is correct for my device, and update it if it's not. Hopefully Hisense will release the stock firmware, or send us an OTA update or something.
Click to expand...
Click to collapse
Also, looking at your pastebins, It seems you are running Ubuntu via a Parallels Virtual Machine. I would suggest using the LiveDVD from the EDL github repo and running it on bare metal to rule out any system related issues. Given that the pastebins show errors relating to libusb1.py, there is a good chance your issues are due to the emulated USB controller provided by Parallels.
matteqa said:
Also, looking at your pastebins, It seems you are running Ubuntu via a Parallels Virtual Machine. I would suggest using the LiveDVD from the EDL github repo and running it on bare metal to rule out any system related issues. Given that the pastebins show errors relating to libusb1.py, there is a good chance your issues are due to the emulated USB controller provided by Parallels.
Click to expand...
Click to collapse
I tried booting the liveDVD from the repo in Parallels, but it wouldn't boot, saying something like Ubuntu was missing. But I'll try it as a bootable USD drive. I won't be able to do it until next weekend at the earliest, but I'll report back when I've tried that method. Thanks for your suggestions!
So I bought a USB drive and flashed the liveDVD from the repo to it, but my only computers are Macs and will recognise the USB drive as bootable - I've tried Fat32 / HFS+ file systems, made sure it's a GUID partition table, and used both Etcher GUI and terminal's `dd` to burn the image to the drive, but still the USB never shows up in the startup utility. Anyway, I've hit a roadblock on this for now - I think my next options are to either pick up a cheap Windows laptop, or put a bounty out for boot.img (or preferably full root! )
RunnyYolk said:
So I bought a USB drive and flashed the liveDVD from the repo to it, but my only computers are Macs and will recognise the USB drive as bootable - I've tried Fat32 / HFS+ file systems, made sure it's a GUID partition table, and used both Etcher GUI and terminal's `dd` to burn the image to the drive, but still the USB never shows up in the startup utility. Anyway, I've hit a roadblock on this for now - I think my next options are to either pick up a cheap Windows laptop, or put a bounty out for boot.img (or preferably full root! )
Click to expand...
Click to collapse
Just checking, have you tried the macOS version of the EDL tool? All of your pastebins are from ubuntu parallels, however there is also a native macOS version in the github repo.
matteqa said:
Just checking, have you tried the macOS version of the EDL tool? All of your pastebins are from ubuntu parallels, however there is also a native macOS version in the github repo.
Click to expand...
Click to collapse
Ah, that's a good call! I did try the native Mac version on one machine, but it wasn't able to find libusb library, so I started using parallels / ubuntu, and then basically forgot that the native mac version existed! So thanks for the reminder - I tried it yesterday on an older Mac, and the native EDL client seems to be working properly. Unfortunately I think the firehose / loader files I have aren't correct. When I ran it with a loader I get sahara - [LIB]: Unexpected error on uploading, maybe signature of loader wasn't accepted ?
type object 'req' has no attribute 'image_id', and then I tried running it without any loader and got sahara - [LIB]: Couldn't find a loader for given hwid and pkhash (0014d0e100430000_56d3f3c74a52172b_[FHPRG/ENPRG].bin) :(.
So I guess we need the correct loader for the A9. I'm pretty clueless about how these files come to exist in the first place (do they have to come from the manufacturer, or can we build them ourselves?), but anyway I'll open a new issue on Github and see if the developer of the client can help.
For completeness' sake, here are logs from each attempt at reading boot_a (I tried three different loaders, each one with and without --skipresponse, and then once with no loader).
https://pastebin.com/AA9d5Tdh
https://pastebin.com/gXHS9pYN
https://pastebin.com/6e5FeWDc
https://pastebin.com/8dGWFNau
https://pastebin.com/iTd8ZsVH
https://pastebin.com/2esPvxyX
https://pastebin.com/Pvz9YxfE
https://pastebin.com/D47mPKt6
*edit* This is the issue on Github: https://github.com/bkerler/edl/issues/303
RunnyYolk said:
Ah, that's a good call! I did try the native Mac version on one machine, but it wasn't able to find libusb library, so I started using parallels / ubuntu, and then basically forgot that the native mac version existed! So thanks for the reminder - I tried it yesterday on an older Mac, and the native EDL client seems to be working properly. Unfortunately I think the firehose / loader files I have aren't correct. When I ran it with a loader I get sahara - [LIB]: Unexpected error on uploading, maybe signature of loader wasn't accepted ?
type object 'req' has no attribute 'image_id', and then I tried running it without any loader and got sahara - [LIB]: Couldn't find a loader for given hwid and pkhash (0014d0e100430000_56d3f3c74a52172b_[FHPRG/ENPRG].bin) :(.
So I guess we need the correct loader for the A9. I'm pretty clueless about how these files come to exist in the first place (do they have to come from the manufacturer, or can we build them ourselves?), but anyway I'll open a new issue on Github and see if the developer of the client can help.
For completeness' sake, here are logs from each attempt at reading boot_a (I tried three different loaders, each one with and without --skipresponse, and then once with no loader).
https://pastebin.com/AA9d5Tdh
https://pastebin.com/gXHS9pYN
https://pastebin.com/6e5FeWDc
https://pastebin.com/8dGWFNau
https://pastebin.com/iTd8ZsVH
https://pastebin.com/2esPvxyX
https://pastebin.com/Pvz9YxfE
https://pastebin.com/D47mPKt6
*edit* This is the issue on Github: https://github.com/bkerler/edl/issues/303
Click to expand...
Click to collapse
Have you tried to read from "boot" instead of "boot_a". Maybe hisense isn't using A/B partitions since they don't care about google play certification. Also, have you tried using --memory=ufs.
Otherwise, it may be that the loader has a custom signature. As far as I know, the loader is proprietary and you have to get it from the manufacturer.
@RunnyYolk
I've also just found a patched version of a SDM662 loader on another forum that might work.
I've reuploaded it here: https://cloud.matteqa.com/index.php/s/M6MxgPFDsYwaKP6
matteqa said:
@RunnyYolk
I've also just found a patched version of a SDM662 loader on another forum that might work.
I've reuploaded it here: https://cloud.matteqa.com/index.php/s/M6MxgPFDsYwaKP6
Click to expand...
Click to collapse
Thanks! I tried this loader, and also the --memory=ufs flag / "boot" alternatives as you suggested, but had the same errors as before. I'm pretty sure I saw boot_a and boot_b directories somewhere when I was exploring the filesystem in adb shell, but I'll double check again when I have time.
Are there any other avenues I could try to root this device? I wonder if there's any point trying to boot TWRP from an A7? Am I right in thinking I can `fastboot boot recover.img` without risk of bricking the phone? (Ie just booting rather than flashing.)... Maybe I'm clutching at straws...