Hi I recently purchased a Sony tablet S (original) from a friend. The tablet was at Honeycomb so I tried to upgrade to ICS using SonyTablet S FLASHER after rooting it. The upgrade was not successful and was stuck at the boot logo. However I could recover using Condi's instructions at this thread by flashing the old Honeycomb version.
I tried to do it again today but failed again. This time around instructions above and from FAQ section here does not seem to work .
Wanted to gift the tablet to my folks but it is currently a beautiful brick :crying:
Please help
My recovery log and region prop below.
Code:
Starting recovery on Sun May 19 01:22:50 2013
framebuffer: fd 4 (1280 x 800)
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /configs ext2 /dev/block/mmcblk0p1 (null) 0
2 /system0 ext4 /dev/block/mmcblk0p2 (null) 0
3 /system1 ext4 /dev/block/mmcblk0p3 (null) 0
4 /cache ext4 /dev/block/mmcblk0p4 (null) 0
5 /misc emmc /dev/block/mmcblk0p5 (null) 0
6 /staging ext4 /dev/block/mmcblk0p6 (null) 0
7 /blflags ext4 /dev/block/mmcblk0p7 (null) 0
8 /datapp ext4 /dev/block/mmcblk0p8 (null) 0
9 /log ext4 /dev/block/mmcblk0p9 (null) 0
10 /data ext4 /dev/block/mmcblk0p10 (null) 0
11 /vsd ext4 /dev/block/mmcblk0p11 (null) 0
12 /sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0
13 /boot emmc boot (null) 0
14 /recovery emmc recovery (null) 0
15 /system ext4 system (null) 0
Command: "/sbin/recovery"
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=1
ro.build.id=THMASU0035
ro.build.display.id=THMASU0035
ro.build.version.incremental=0035.002
ro.build.version.sdk=13
ro.build.version.codename=REL
ro.build.version.release=3.2.1
ro.build.date=Fri Nov 4 17:56:26 JST 2011
ro.build.date.utc=1320396986
ro.build.type=user
ro.build.user=integ-build
ro.build.host=build6
ro.build.tags=test-keys
ro.product.model=Sony Tablet S
ro.product.brand=Sony
ro.product.name=nbx03_002
ro.product.device=nbx03
ro.product.board=nbx03
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Sony
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=tegra
ro.build.product=nbx03
ro.build.description=nbx03_003-user 3.2.1 THMASU0035 0035.002 test-keys
ro.build.fingerprint=Sony/nbx03_002/nbx03:3.2.1/THMASU0035/0035.002:user/test-keys
ro.build.characteristics=tablet,nosdcard
ro.opengles.version=131072
wifi.interface=wlan0
ro.ethernet.interface=eth0
ro.ethernet.autoEnable=yes
rild.libargs=-d /dev/ttyACM1 -i rmnet0
ro.sony.sound.enabled=true
ro.separated.external.storage=true
ro.external.storage.removable=false
ro.tether.denied=true
windowsmgr.max_events_per_sec=120
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=3.2_r3
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.com.google.clientidbase=android-sony
ro.sony.wifisleep=0
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
ro.sony.update.server=info.update.sony.net
ro.sony.update.category_id=ST001
ro.sony.update.service_id=nbx03_003
ro.sony.sku.base=nbx03_003
ro.sony.build.id=THMASU0035300
ro.sony.build.incremental=111104029
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.factorytest=0
ro.bootmode=unknown
ro.baseband=unknown
ro.carrier=wifi-only
ro.bootloader=0x00000008
ro.hardware=nbx03
ro.revision=0
init.svc.recovery=running
init.svc.nfx_daemon=running
init.svc.adbd=running
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_016-ota-120803071.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803071
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Code:
ro.sony.sku.version=27550237_9
ro.camera.sound.forced=0
ro.product.locale.language=en
ro.product.locale.region=GB
ro.pss.gamepad.buttonmeaning=cross-enter
ro.sony.network.wwan=1
ro.sony.sku.country=UK
ro.sony.sku.detailed=27550237
ro.sony.update.category_id=ST003
ro.sony.volume_limit=0
ro.sony.wm.atrac=0
ro.sony.wm.clearphase_path=SGPT1_001.LPS
ro.sony.wm.xloud_path=SGPT1_001.XLD
prashp said:
Hi I recently purchased a Sony tablet S (original) from a friend. The tablet was at Honeycomb so I tried to upgrade to ICS using SonyTablet S FLASHER after rooting it. The upgrade was not successful and was stuck at the boot logo. However I could recover using Condi's instructions at this thread by flashing the old Honeycomb version.
I tried to do it again today but failed again. This time around instructions above and from FAQ section here does not seem to work .
Wanted to gift the tablet to my folks but it is currently a beautiful brick :crying:
Please help
My recovery log and region prop below.
Code:
Starting recovery on Sun May 19 01:22:50 2013
framebuffer: fd 4 (1280 x 800)
recovery filesystem table
=========================
0 /tmp ramdisk (null) (null) 0
1 /configs ext2 /dev/block/mmcblk0p1 (null) 0
2 /system0 ext4 /dev/block/mmcblk0p2 (null) 0
3 /system1 ext4 /dev/block/mmcblk0p3 (null) 0
4 /cache ext4 /dev/block/mmcblk0p4 (null) 0
5 /misc emmc /dev/block/mmcblk0p5 (null) 0
6 /staging ext4 /dev/block/mmcblk0p6 (null) 0
7 /blflags ext4 /dev/block/mmcblk0p7 (null) 0
8 /datapp ext4 /dev/block/mmcblk0p8 (null) 0
9 /log ext4 /dev/block/mmcblk0p9 (null) 0
10 /data ext4 /dev/block/mmcblk0p10 (null) 0
11 /vsd ext4 /dev/block/mmcblk0p11 (null) 0
12 /sdcard vfat /dev/block/mmcblk1p1 /dev/block/mmcblk1 0
13 /boot emmc boot (null) 0
14 /recovery emmc recovery (null) 0
15 /system ext4 system (null) 0
Command: "/sbin/recovery"
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=1
ro.build.id=THMASU0035
ro.build.display.id=THMASU0035
ro.build.version.incremental=0035.002
ro.build.version.sdk=13
ro.build.version.codename=REL
ro.build.version.release=3.2.1
ro.build.date=Fri Nov 4 17:56:26 JST 2011
ro.build.date.utc=1320396986
ro.build.type=user
ro.build.user=integ-build
ro.build.host=build6
ro.build.tags=test-keys
ro.product.model=Sony Tablet S
ro.product.brand=Sony
ro.product.name=nbx03_002
ro.product.device=nbx03
ro.product.board=nbx03
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Sony
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=tegra
ro.build.product=nbx03
ro.build.description=nbx03_003-user 3.2.1 THMASU0035 0035.002 test-keys
ro.build.fingerprint=Sony/nbx03_002/nbx03:3.2.1/THMASU0035/0035.002:user/test-keys
ro.build.characteristics=tablet,nosdcard
ro.opengles.version=131072
wifi.interface=wlan0
ro.ethernet.interface=eth0
ro.ethernet.autoEnable=yes
rild.libargs=-d /dev/ttyACM1 -i rmnet0
ro.sony.sound.enabled=true
ro.separated.external.storage=true
ro.external.storage.removable=false
ro.tether.denied=true
windowsmgr.max_events_per_sec=120
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=3.2_r3
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.com.google.clientidbase=android-sony
ro.sony.wifisleep=0
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=48m
dalvik.vm.heapsize=256m
ro.sony.update.server=info.update.sony.net
ro.sony.update.category_id=ST001
ro.sony.update.service_id=nbx03_003
ro.sony.sku.base=nbx03_003
ro.sony.build.id=THMASU0035300
ro.sony.build.incremental=111104029
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
net.change=net.bt.name
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.factorytest=0
ro.bootmode=unknown
ro.baseband=unknown
ro.carrier=wifi-only
ro.bootloader=0x00000008
ro.hardware=nbx03
ro.revision=0
init.svc.recovery=running
init.svc.nfx_daemon=running
init.svc.adbd=running
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_016-ota-120803071.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803071
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Code:
ro.sony.sku.version=27550237_9
ro.camera.sound.forced=0
ro.product.locale.language=en
ro.product.locale.region=GB
ro.pss.gamepad.buttonmeaning=cross-enter
ro.sony.network.wwan=1
ro.sony.sku.country=UK
ro.sony.sku.detailed=27550237
ro.sony.update.category_id=ST003
ro.sony.volume_limit=0
ro.sony.wm.atrac=0
ro.sony.wm.clearphase_path=SGPT1_001.LPS
ro.sony.wm.xloud_path=SGPT1_001.XLD
Click to expand...
Click to collapse
try ICS r1a
info.update.sony.net/ST002/nbx03_002/contents/0008/signed-nbx03_002-ota-120803078.zip
or ICS r5a (not rootable)
info.update.sony.net/ST002/nbx03_002/contents/0009/signed-nbx03_002-ota-121116062.zip
stifilz said:
try ICS r1a
info.update.sony.net/ST002/nbx03_002/contents/0008/signed-nbx03_002-ota-120803078.zip
or ICS r5a (not rootable)
info.update.sony.net/ST002/nbx03_002/contents/0009/signed-nbx03_002-ota-121116062.zip
Click to expand...
Click to collapse
Thanks stifilz. The signed-nbx03_002-ota-120803078.zip (ICS r1a) does not seem to work.
the installation debug from recovery log
Code:
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_002-ota-120803078.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803078
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Should I bite the bullet and try to install signed-nbx03_002-ota-121116062.zip (ICS r5a) ?
Please help.
Why does Sony have to make it so complicated by having so many regions
prashp said:
Thanks stifilz. The signed-nbx03_002-ota-120803078.zip (ICS r1a) does not seem to work.
the installation debug from recovery log
Code:
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_002-ota-120803078.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803078
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Should I bite the bullet and try to install signed-nbx03_002-ota-121116062.zip (ICS r5a) ?
Please help.
Why does Sony have to make it so complicated by having so many regions
Click to expand...
Click to collapse
Sorry your region is nbx03_003 so 002 will not work. You can install the R1a though. you want info.update.sony.net/ST003/nbx03_003/contents/0013/signed-nbx03_003-ota-120803004.zip
Stifilz
stifilz said:
Sorry your region is nbx03_003 so 002 will not work. You can install the R1a though. you want info.update.sony.net/ST003/nbx03_003/contents/0013/signed-nbx03_003-ota-120803004.zip
Stifilz
Click to expand...
Click to collapse
Thanks Stifilz, but the nbx03_003 R1a - signed-nbx03_003-ota-120803004.zip does not seem to work either
here is the log
Code:
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_003-ota-120803004.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803004
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Which region does sku[27550237] stand for? Mine is a UK tablet.
Really stuck :crying:
prashp said:
Thanks Stifilz, but the nbx03_003 R1a - signed-nbx03_003-ota-120803004.zip does not seem to work either
here is the log
Code:
-- Install /sdcard ...
Finding update package...
I:Update location: /sdcard/signed-nbx03_003-ota-120803004.zip
Desklunvr update package...
Opening update package...
I:1 key(s) loaded from /res/keys
Verifying update package...
I:comment is 1465 bytes; signature 1447 bytes from end
I:whole-file signature verified against key 0
I:verify_file returned 0
prev version[NONE] is not an int
Checking version is passed, 0 -> 120803004
Not found detailed sku[27550237] in META-INF/com/android/detailedSKU.lst
E:Prohibit update as a result of checking version or base sku
Installation aborted.
Which region does sku[27550237] stand for? Mine is a UK tablet.
Really stuck :crying:
Click to expand...
Click to collapse
I just double checked and that sku is for UK which is the nbx03_003. So I am not sure what is happening. Perhaps the other partition is a different region.... try the R1a for nbx03_001 (US). Have you used region changer or flasher or anything unusual??
stifilz said:
I just double checked and that sku is for UK which is the nbx03_003. So I am not sure what is happening. Perhaps the other partition is a different region.... try the R1a for nbx03_001 (US). Have you used region changer or flasher or anything unusual??
Click to expand...
Click to collapse
Hi stifilz, managed to flash signed-nbx03_004-ota-120803061.zip. Thanks for your help and your excellent work on this forum. You guys rock!
Here's something I have compiled which might help others:
Code:
FILENAME | SKU #
========================================================
signed-nbx03_002-ota-120803078.zip | 27550108
signed-nbx03_002-ota-120803078.zip | 27550109
signed-nbx03_003-ota-120803004.zip | 27550112
signed-nbx03_003-ota-120803004.zip | 27550113
signed-nbx03_004-ota-120803061.zip | 27550115
signed-nbx03_004-ota-120803061.zip | 27550237
signed-nbx03_005-ota-120803080.zip | 27550116
signed-nbx03_005-ota-120803080.zip | 27550117
signed-nbx03_006-ota-120803066.zip | 27550238
signed-nbx03_007-ota-120803058.zip | 27550120
signed-nbx03_007-ota-120803058.zip | 27550121
signed-nbx03_009-ota-120803082.zip | 27550124
signed-nbx03_009-ota-120803082.zip | 27550125
signed-nbx03_009-ota-120803082.zip | 27550128
signed-nbx03_009-ota-120803082.zip | 27550129
signed-nbx03_011-ota-120803084.zip | 27550136
signed-nbx03_011-ota-120803084.zip | 27550137
signed-nbx03_011-ota-120803084.zip | 27550139
signed-nbx03_011-ota-120803084.zip | 27550140
signed-nbx03_011-ota-120803084.zip | 27550142
signed-nbx03_011-ota-120803084.zip | 27550143
signed-nbx03_011-ota-120803084.zip | 27550148
signed-nbx03_011-ota-120803084.zip | 27550149
signed-nbx03_011-ota-120803084.zip | 27550151
signed-nbx03_011-ota-120803084.zip | 27550152
signed-nbx03_014-ota-120803069.zip | 27550138
signed-nbx03_014-ota-120803069.zip | 27550141
signed-nbx03_014-ota-120803069.zip | 27550150
signed-nbx03_014-ota-120803069.zip | 27550153
signed-nbx03_015-ota-120804000.zip | 27550145
signed-nbx03_015-ota-120804000.zip | 27550146
signed-nbx03_015-ota-120804000.zip | 27550157
signed-nbx03_015-ota-120804000.zip | 27550158
signed-nbx03_015-ota-120804000.zip | 27550160
signed-nbx03_015-ota-120804000.zip | 27550161
signed-nbx03_015-ota-120804000.zip | 27550197
signed-nbx03_015-ota-120804000.zip | 27550198
signed-nbx03_016-ota-120803071.zip | 27550159
signed-nbx03_016-ota-120803071.zip | 27550162
signed-nbx03_016-ota-120803071.zip | 27550199
signed-nbx03_018-ota-120804002.zip | 27550154
signed-nbx03_018-ota-120804002.zip | 27550155
signed-nbx03_019-ota-120803074.zip | 27550156
signed-nbx03_023-ota-120803003.zip | 27550171
signed-nbx03_026-ota-120804005.zip | 27550176
signed-nbx03_026-ota-120804005.zip | 27550177
signed-nbx03_027-ota-120803077.zip | 27550263
signed-nbx03_028-ota-120803079.zip | 27550262
signed-nbx03_029-ota-120804007.zip | 27550182
signed-nbx03_029-ota-120804007.zip | 27550183
signed-nbx03_029-ota-120804007.zip | 27550185
signed-nbx03_029-ota-120804007.zip | 27550186
signed-nbx03_030-ota-120803081.zip | 27550260
signed-nbx03_030-ota-120803081.zip | 27550261
signed-nbx03_031-ota-120803073.zip | 27550188
signed-nbx03_031-ota-120803073.zip | 27550189
signed-nbx03_032-ota-120804006.zip | 27550259
signed-nbx03_033-ota-120804008.zip | 27550191
signed-nbx03_033-ota-120804008.zip | 27550192
signed-nbx03_034-ota-120803083.zip | 27550258
signed-nbx03_035-ota-120804009.zip | 27550270
signed-nbx03_035-ota-120804009.zip | 27550271
signed-nbx03_035-ota-120804009.zip | 27550272
signed-nbx03_035-ota-120804009.zip | 27550273
signed-nbx03_036-ota-120804010.zip | 27550274
signed-nbx03_036-ota-120804010.zip | 27550275
signed-nbx03_036-ota-120804010.zip | 27550276
signed-nbx03_036-ota-120804010.zip | 27550277
signed-nbx03_036-ota-120804010.zip | 27550278
signed-nbx03_036-ota-120804010.zip | 27550279
signed-nbx03_037-ota-120804011.zip | 27550264
signed-nbx03_037-ota-120804011.zip | 27550265
signed-nbx03_037-ota-120804011.zip | 27550266
signed-nbx03_037-ota-120804011.zip | 27550267
signed-nbx03_037-ota-120804011.zip | 27550268
signed-nbx03_037-ota-120804011.zip | 27550269
signed-nbx03_040-ota-120803005.zip | 27550104
signed-nbx03_040-ota-120803005.zip | 27550105
signed-nbx03_041-ota-120804012.zip | 27550179
signed-nbx03_041-ota-120804012.zip | 27550180
signed-nbx03_042-ota-120804013.zip | 27550132
signed-nbx03_042-ota-120804013.zip | 27550133
signed-nbx03_043-ota-120803085.zip | 27550241
signed-nbx03_045-ota-120804014.zip | 27550289
signed-nbx03_045-ota-120804014.zip | 27550290
signed-nbx03_045-ota-120804014.zip | 27550291
signed-nbx03_045-ota-120804014.zip | 27550292
signed-nbx03_046-ota-120804015.zip | 27550139
signed-nbx03_046-ota-120804015.zip | 27550140
signed-nbx03_046-ota-120804015.zip | 27550148
signed-nbx03_046-ota-120804015.zip | 27550149
signed-nbx03_047-ota-120804001.zip | 27550141
signed-nbx03_047-ota-120804001.zip | 27550150
prashp said:
Hi stifilz, managed to flash signed-nbx03_004-ota-120803061.zip. Thanks for your help and your excellent work on this forum. You guys rock!
Here's something I have compiled which might help others:
Code:
FILENAME | SKU #
========================================================
signed-nbx03_002-ota-120803078.zip | 27550108
signed-nbx03_002-ota-120803078.zip | 27550109
signed-nbx03_003-ota-120803004.zip | 27550112
signed-nbx03_003-ota-120803004.zip | 27550113
signed-nbx03_004-ota-120803061.zip | 27550115
signed-nbx03_004-ota-120803061.zip | 27550237
signed-nbx03_005-ota-120803080.zip | 27550116
signed-nbx03_005-ota-120803080.zip | 27550117
signed-nbx03_006-ota-120803066.zip | 27550238
signed-nbx03_007-ota-120803058.zip | 27550120
signed-nbx03_007-ota-120803058.zip | 27550121
signed-nbx03_009-ota-120803082.zip | 27550124
signed-nbx03_009-ota-120803082.zip | 27550125
signed-nbx03_009-ota-120803082.zip | 27550128
signed-nbx03_009-ota-120803082.zip | 27550129
signed-nbx03_011-ota-120803084.zip | 27550136
signed-nbx03_011-ota-120803084.zip | 27550137
signed-nbx03_011-ota-120803084.zip | 27550139
signed-nbx03_011-ota-120803084.zip | 27550140
signed-nbx03_011-ota-120803084.zip | 27550142
signed-nbx03_011-ota-120803084.zip | 27550143
signed-nbx03_011-ota-120803084.zip | 27550148
signed-nbx03_011-ota-120803084.zip | 27550149
signed-nbx03_011-ota-120803084.zip | 27550151
signed-nbx03_011-ota-120803084.zip | 27550152
signed-nbx03_014-ota-120803069.zip | 27550138
signed-nbx03_014-ota-120803069.zip | 27550141
signed-nbx03_014-ota-120803069.zip | 27550150
signed-nbx03_014-ota-120803069.zip | 27550153
signed-nbx03_015-ota-120804000.zip | 27550145
signed-nbx03_015-ota-120804000.zip | 27550146
signed-nbx03_015-ota-120804000.zip | 27550157
signed-nbx03_015-ota-120804000.zip | 27550158
signed-nbx03_015-ota-120804000.zip | 27550160
signed-nbx03_015-ota-120804000.zip | 27550161
signed-nbx03_015-ota-120804000.zip | 27550197
signed-nbx03_015-ota-120804000.zip | 27550198
signed-nbx03_016-ota-120803071.zip | 27550159
signed-nbx03_016-ota-120803071.zip | 27550162
signed-nbx03_016-ota-120803071.zip | 27550199
signed-nbx03_018-ota-120804002.zip | 27550154
signed-nbx03_018-ota-120804002.zip | 27550155
signed-nbx03_019-ota-120803074.zip | 27550156
signed-nbx03_023-ota-120803003.zip | 27550171
signed-nbx03_026-ota-120804005.zip | 27550176
signed-nbx03_026-ota-120804005.zip | 27550177
signed-nbx03_027-ota-120803077.zip | 27550263
signed-nbx03_028-ota-120803079.zip | 27550262
signed-nbx03_029-ota-120804007.zip | 27550182
signed-nbx03_029-ota-120804007.zip | 27550183
signed-nbx03_029-ota-120804007.zip | 27550185
signed-nbx03_029-ota-120804007.zip | 27550186
signed-nbx03_030-ota-120803081.zip | 27550260
signed-nbx03_030-ota-120803081.zip | 27550261
signed-nbx03_031-ota-120803073.zip | 27550188
signed-nbx03_031-ota-120803073.zip | 27550189
signed-nbx03_032-ota-120804006.zip | 27550259
signed-nbx03_033-ota-120804008.zip | 27550191
signed-nbx03_033-ota-120804008.zip | 27550192
signed-nbx03_034-ota-120803083.zip | 27550258
signed-nbx03_035-ota-120804009.zip | 27550270
signed-nbx03_035-ota-120804009.zip | 27550271
signed-nbx03_035-ota-120804009.zip | 27550272
signed-nbx03_035-ota-120804009.zip | 27550273
signed-nbx03_036-ota-120804010.zip | 27550274
signed-nbx03_036-ota-120804010.zip | 27550275
signed-nbx03_036-ota-120804010.zip | 27550276
signed-nbx03_036-ota-120804010.zip | 27550277
signed-nbx03_036-ota-120804010.zip | 27550278
signed-nbx03_036-ota-120804010.zip | 27550279
signed-nbx03_037-ota-120804011.zip | 27550264
signed-nbx03_037-ota-120804011.zip | 27550265
signed-nbx03_037-ota-120804011.zip | 27550266
signed-nbx03_037-ota-120804011.zip | 27550267
signed-nbx03_037-ota-120804011.zip | 27550268
signed-nbx03_037-ota-120804011.zip | 27550269
signed-nbx03_040-ota-120803005.zip | 27550104
signed-nbx03_040-ota-120803005.zip | 27550105
signed-nbx03_041-ota-120804012.zip | 27550179
signed-nbx03_041-ota-120804012.zip | 27550180
signed-nbx03_042-ota-120804013.zip | 27550132
signed-nbx03_042-ota-120804013.zip | 27550133
signed-nbx03_043-ota-120803085.zip | 27550241
signed-nbx03_045-ota-120804014.zip | 27550289
signed-nbx03_045-ota-120804014.zip | 27550290
signed-nbx03_045-ota-120804014.zip | 27550291
signed-nbx03_045-ota-120804014.zip | 27550292
signed-nbx03_046-ota-120804015.zip | 27550139
signed-nbx03_046-ota-120804015.zip | 27550140
signed-nbx03_046-ota-120804015.zip | 27550148
signed-nbx03_046-ota-120804015.zip | 27550149
signed-nbx03_047-ota-120804001.zip | 27550141
signed-nbx03_047-ota-120804001.zip | 27550150
Click to expand...
Click to collapse
Of course the +3G model for UK. Haha forgot about that. How did you get the list? (just wondering there are several ways, lol)
stifilz said:
Of course the +3G model for UK. Haha forgot about that. How did you get the list? (just wondering there are several ways, lol)
Click to expand...
Click to collapse
Used the desklunvr package to decrypt 1a the roms and got the SKUs from there
How, when, where and why
prashp said:
Hi stifilz, managed to flash signed-nbx03_004-ota-120803061.zip. Thanks for your help and your excellent work on this forum. You guys rock!
Here's something I have compiled which might help others:
Code:
FILENAME | SKU #
========================================================
signed-nbx03_002-ota-120803078.zip | 27550108
signed-nbx03_002-ota-120803078.zip | 27550109
signed-nbx03_003-ota-120803004.zip | 27550112
signed-nbx03_003-ota-120803004.zip | 27550113
signed-nbx03_004-ota-120803061.zip | 27550115
signed-nbx03_004-ota-120803061.zip | 27550237
signed-nbx03_005-ota-120803080.zip | 27550116
signed-nbx03_005-ota-120803080.zip | 27550117
signed-nbx03_006-ota-120803066.zip | 27550238
signed-nbx03_007-ota-120803058.zip | 27550120
signed-nbx03_007-ota-120803058.zip | 27550121
signed-nbx03_009-ota-120803082.zip | 27550124
signed-nbx03_009-ota-120803082.zip | 27550125
signed-nbx03_009-ota-120803082.zip | 27550128
signed-nbx03_009-ota-120803082.zip | 27550129
signed-nbx03_011-ota-120803084.zip | 27550136
signed-nbx03_011-ota-120803084.zip | 27550137
signed-nbx03_011-ota-120803084.zip | 27550139
signed-nbx03_011-ota-120803084.zip | 27550140
signed-nbx03_011-ota-120803084.zip | 27550142
signed-nbx03_011-ota-120803084.zip | 27550143
signed-nbx03_011-ota-120803084.zip | 27550148
signed-nbx03_011-ota-120803084.zip | 27550149
signed-nbx03_011-ota-120803084.zip | 27550151
signed-nbx03_011-ota-120803084.zip | 27550152
signed-nbx03_014-ota-120803069.zip | 27550138
signed-nbx03_014-ota-120803069.zip | 27550141
signed-nbx03_014-ota-120803069.zip | 27550150
signed-nbx03_014-ota-120803069.zip | 27550153
signed-nbx03_015-ota-120804000.zip | 27550145
signed-nbx03_015-ota-120804000.zip | 27550146
signed-nbx03_015-ota-120804000.zip | 27550157
signed-nbx03_015-ota-120804000.zip | 27550158
signed-nbx03_015-ota-120804000.zip | 27550160
signed-nbx03_015-ota-120804000.zip | 27550161
signed-nbx03_015-ota-120804000.zip | 27550197
signed-nbx03_015-ota-120804000.zip | 27550198
signed-nbx03_016-ota-120803071.zip | 27550159
signed-nbx03_016-ota-120803071.zip | 27550162
signed-nbx03_016-ota-120803071.zip | 27550199
signed-nbx03_018-ota-120804002.zip | 27550154
signed-nbx03_018-ota-120804002.zip | 27550155
signed-nbx03_019-ota-120803074.zip | 27550156
signed-nbx03_023-ota-120803003.zip | 27550171
signed-nbx03_026-ota-120804005.zip | 27550176
signed-nbx03_026-ota-120804005.zip | 27550177
signed-nbx03_027-ota-120803077.zip | 27550263
signed-nbx03_028-ota-120803079.zip | 27550262
signed-nbx03_029-ota-120804007.zip | 27550182
signed-nbx03_029-ota-120804007.zip | 27550183
signed-nbx03_029-ota-120804007.zip | 27550185
signed-nbx03_029-ota-120804007.zip | 27550186
signed-nbx03_030-ota-120803081.zip | 27550260
signed-nbx03_030-ota-120803081.zip | 27550261
signed-nbx03_031-ota-120803073.zip | 27550188
signed-nbx03_031-ota-120803073.zip | 27550189
signed-nbx03_032-ota-120804006.zip | 27550259
signed-nbx03_033-ota-120804008.zip | 27550191
signed-nbx03_033-ota-120804008.zip | 27550192
signed-nbx03_034-ota-120803083.zip | 27550258
signed-nbx03_035-ota-120804009.zip | 27550270
signed-nbx03_035-ota-120804009.zip | 27550271
signed-nbx03_035-ota-120804009.zip | 27550272
signed-nbx03_035-ota-120804009.zip | 27550273
signed-nbx03_036-ota-120804010.zip | 27550274
signed-nbx03_036-ota-120804010.zip | 27550275
signed-nbx03_036-ota-120804010.zip | 27550276
signed-nbx03_036-ota-120804010.zip | 27550277
signed-nbx03_036-ota-120804010.zip | 27550278
signed-nbx03_036-ota-120804010.zip | 27550279
signed-nbx03_037-ota-120804011.zip | 27550264
signed-nbx03_037-ota-120804011.zip | 27550265
signed-nbx03_037-ota-120804011.zip | 27550266
signed-nbx03_037-ota-120804011.zip | 27550267
signed-nbx03_037-ota-120804011.zip | 27550268
signed-nbx03_037-ota-120804011.zip | 27550269
signed-nbx03_040-ota-120803005.zip | 27550104
signed-nbx03_040-ota-120803005.zip | 27550105
signed-nbx03_041-ota-120804012.zip | 27550179
signed-nbx03_041-ota-120804012.zip | 27550180
signed-nbx03_042-ota-120804013.zip | 27550132
signed-nbx03_042-ota-120804013.zip | 27550133
signed-nbx03_043-ota-120803085.zip | 27550241
signed-nbx03_045-ota-120804014.zip | 27550289
signed-nbx03_045-ota-120804014.zip | 27550290
signed-nbx03_045-ota-120804014.zip | 27550291
signed-nbx03_045-ota-120804014.zip | 27550292
signed-nbx03_046-ota-120804015.zip | 27550139
signed-nbx03_046-ota-120804015.zip | 27550140
signed-nbx03_046-ota-120804015.zip | 27550148
signed-nbx03_046-ota-120804015.zip | 27550149
signed-nbx03_047-ota-120804001.zip | 27550141
signed-nbx03_047-ota-120804001.zip | 27550150
Click to expand...
Click to collapse
Sorry, I did not understand anything. What is SKU?
And how can you help me?
I'm downloading the files and none of them can be unzipped ... how to proceed?
Hello, i want extract the stockfw i have successful extract the kdz to cab and to dz (with linux).
i have download some tool for dz file but exist a problem with HEADER (probably is different... no iam sure 100 it is different...)
i post the python script error for understand better my problem...
Code:
[!] Error: Unsupported DZ file format.
[ ] Expected: 0x32 0x96 0x18 0x74 ,
but received 0x44 0xdd 0x55 0xaa .
the python script is dzfiletools.py (downloaded from xda), that python tool have that line
Code:
dz_header = "\x32\x96\x18\x74"
dz_sub_header = "\x30\x12\x95\x78"
dz_sub_len = 512
how to insert the right value from lg l3 II dz header value?
Code:
0000000: 44dd 55aa ffff ffff 2b17 d205 4c47 4534 D.U.....+...LGE4
0000010: 3330 0000 0000 0000 0000 0000 0000 0000 30..............
0000020: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000030: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000040: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000050: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000060: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000070: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000080: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000090: ffff ffff ffff ffff ffff ffff ffff ffff ................
The whole python tool http://paste.ubuntu.com/7473191/
Hmmm
Naxil said:
Hello, i want extract the stockfw i have successful extract the kdz to cab and to dz (with linux).
i have download some tool for dz file but exist a problem with HEADER (probably is different... no iam sure 100 it is different...)
i post the python script error for understand better my problem...
Code:
[!] Error: Unsupported DZ file format.
[ ] Expected: 0x32 0x96 0x18 0x74 ,
but received 0x44 0xdd 0x55 0xaa .
the python script is dzfiletools.py (downloaded from xda), that python tool have that line
Code:
dz_header = "\x32\x96\x18\x74"
dz_sub_header = "\x30\x12\x95\x78"
dz_sub_len = 512
how to insert the right value from lg l3 II dz header value?
Click to expand...
Click to collapse
I have Never managed and believe me i have tried ..
easiest way to obtain all partitions i found is to:
Flash Stock (the one you want to extract)
Root (busybox might be needed but not sure)
enable usb debugging
Run the attached tool (it will automatically dump all partitions from phone {just like extracting .dz})
Why do you want it anyway ?
ROM building ?
no, iam not able to make a rom.. but i try to understand HOW the roms works (i have only understand that, the roms (Stock) is divided in
1 boot (need to be modded or exploited for change and load different recovery right??)
2 recovery
3 system
4 data/cache
If i not mess with boot and recovery (now i have the cwm on recovery) i can't brick my phone right? or i can always replace it with new kdz (windows + kdzupd)
I want the systemUI from 430 or other kind of file for have back the menu retroillumination...
Easy
Naxil said:
no, iam not able to make a rom.. but i try to understand HOW the roms works (i have only understand that, the roms (Stock) is divided in
1 boot (need to be modded or exploited for change and load different recovery right??)
2 recovery
3 system
4 data/cache
If i not mess with boot and recovery (now i have the cwm on recovery) i can't brick my phone right? or i can always replace it with new kdz (windows + kdzupd)
I want the systemUI from 430 or other kind of file for have back the menu retroillumination...
Click to expand...
Click to collapse
open lg mobile support tool
select emergency upgrade
enter imei or serial
wait for it to download
wait for it to flash it
now you have e430 again
now if firmware is not v10c and you want to easily root download it and normal flash .kdz
now root and unlock bootloader and install cwm again
EDIT: also in my E430 thread there is links to all stock partitions like after extracting .dz
so... no way to mod the python script for dz e430 file?
Lets do it ?
Naxil said:
so... no way to mod the python script for dz e430 file?
Click to expand...
Click to collapse
i'm not capable of doing it
but i'm sure i can help you
read http://forum.xda-developers.com/showpost.php?p=52569369&postcount=48 that
use that program while flashing and inside the log that you will get there is a lot of info that you might find useful for extracting the .dz
also i can provide you with all info from e430 if any needed
Naxil said:
so... no way to mod the python script for dz e430 file?
Click to expand...
Click to collapse
bump ?
IGGYVIP said:
i'm not capable of doing it
but i'm sure i can help you
read http://forum.xda-developers.com/showpost.php?p=52569369&postcount=48 that
use that program while flashing and inside the log that you will get there is a lot of info that you might find useful for extracting the .dz
also i can provide you with all info from e430 if any needed
Click to expand...
Click to collapse
so the APPS file is the bootloader?
following your post
Code:
*---------------------------- PartitionTable Info [COLOR="red"]LG Optimus L3 II E430[/COLOR] --------------------------*
Index| Partition Name | Logical Start Offset | Logical Size (KB) | File Offset | Physical Start Offset | Partition Size (KB) | Device Location
02 | QCSBL | 0xFFFFFFFF | 0x841CFBCD ( 949734KB) | 0x 100000 | 0x 0 | 0x 829 ( 1044KB) | /dev/block/mmcblk0p2
03 | OEMSBL | 0x3445474C | 0x 3033 ( 6169KB) | 0x 180000 | 0x 829 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p3
04 | EXT | 0x 0 | 0x 0 ( 0KB) | 0x 280000 | 0x 2829 | 0x 1D7D7 ( 60395KB) | /dev/block/mmcblk0p4
05 | APPSSBL | 0x 0 | 0xFFFFFFFF (4194303KB) | 0x 300000 | 0x 20000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p5
06 | WALLPAPER | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 22000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p6
07 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 24000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p7
08 | misc | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 26000 | 0x C000 ( 24576KB) | /dev/block/mmcblk0p8
09 | APPS | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 32000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p9
10 | MODEM_ST1 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 38000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p10
11 | MODEM_ST2 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p11
12 | MODEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3C000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p12
13 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 1D80000 | 0x 4A000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p13
14 | SYSTEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3100000 | 0x 58000 | 0x 1D0000 ( 950272KB) | /dev/block/mmcblk0p14
15 | PERSIST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3D100000 | 0x 228000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p15
16 | CACHE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 22E000 | 0x 140000 ( 655360KB) | /dev/block/mmcblk0p16
17 | RECOVERY | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 36E000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p17
18 | DRM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 374000 | 0x 4000 ( 8192KB) | /dev/block/mmcblk0p18
19 | FOTA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 378000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p19
20 | USERDATA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 37E000 | 0x 38C000 (1859584KB) | /dev/block/mmcblk0p20
21 | DLOAD | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p21
22 | BOOT_LOGO_IMAGE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70C000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p22
23 | MPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 70E000 | 0x 8000 ( 16384KB) | /dev/block/mmcblk0p23
24 | ENCRYPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 716000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p24
25 | CUST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 718000 | 0x 10000 ( 32768KB) | /dev/block/mmcblk0p25
26 | rct | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 40280000 | 0x 728000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p26
APPS points to /dev/block/mmcblk0p9 and in the freeedom pack the boot.img points to the same file
ensarman said:
so the APPS file is the bootloader?
following your post
Code:
*---------------------------- PartitionTable Info [COLOR="red"]LG Optimus L3 II E430[/COLOR] --------------------------*
Index| Partition Name | Logical Start Offset | Logical Size (KB) | File Offset | Physical Start Offset | Partition Size (KB) | Device Location
02 | QCSBL | 0xFFFFFFFF | 0x841CFBCD ( 949734KB) | 0x 100000 | 0x 0 | 0x 829 ( 1044KB) | /dev/block/mmcblk0p2
03 | OEMSBL | 0x3445474C | 0x 3033 ( 6169KB) | 0x 180000 | 0x 829 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p3
04 | EXT | 0x 0 | 0x 0 ( 0KB) | 0x 280000 | 0x 2829 | 0x 1D7D7 ( 60395KB) | /dev/block/mmcblk0p4
05 | APPSSBL | 0x 0 | 0xFFFFFFFF (4194303KB) | 0x 300000 | 0x 20000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p5
06 | WALLPAPER | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 22000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p6
07 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 24000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p7
08 | misc | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 26000 | 0x C000 ( 24576KB) | /dev/block/mmcblk0p8
09 | APPS | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 32000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p9
10 | MODEM_ST1 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 38000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p10
11 | MODEM_ST2 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p11
12 | MODEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3C000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p12
13 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 1D80000 | 0x 4A000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p13
14 | SYSTEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3100000 | 0x 58000 | 0x 1D0000 ( 950272KB) | /dev/block/mmcblk0p14
15 | PERSIST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3D100000 | 0x 228000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p15
16 | CACHE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 22E000 | 0x 140000 ( 655360KB) | /dev/block/mmcblk0p16
17 | RECOVERY | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 36E000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p17
18 | DRM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 374000 | 0x 4000 ( 8192KB) | /dev/block/mmcblk0p18
19 | FOTA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 378000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p19
20 | USERDATA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 37E000 | 0x 38C000 (1859584KB) | /dev/block/mmcblk0p20
21 | DLOAD | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p21
22 | BOOT_LOGO_IMAGE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70C000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p22
23 | MPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 70E000 | 0x 8000 ( 16384KB) | /dev/block/mmcblk0p23
24 | ENCRYPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 716000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p24
25 | CUST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 718000 | 0x 10000 ( 32768KB) | /dev/block/mmcblk0p25
26 | rct | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 40280000 | 0x 728000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p26
APPS points to /dev/block/mmcblk0p9 and in the freeedom pack the boot.img points to the same file
Click to expand...
Click to collapse
/dev/block/mmcblk0p5 is bootloader in freedom pack its lock.bin
Hello, I've been reading the thread about BinExtractor and it seems to work with original TOT firmwares that now we can download using some nice methods (like going to a url and putting the IMEI or there's even an APP that does the same).
In my case I'm trying with 10B_00.tot for my E431g
Now, the latest binextractor seems to properly read the magic numbers from my tot file header but it's not able to extract the img files from it.
So I have already asked the developer to add my model to the supported devices but I would like to have more understanding of the TOT file headers so we could develop our own apps or even do things manually.
Does anyone have any information on how to better understand those headers it'd be really nice. So far I got to the part of "reading the first datablock" from the file but I don't really know what the app does with those (as follows):
Code:
/*SET FIRST DATABLOCK*/
dataBlock.blockOff = 0x2010;
dataBlock.blockSize = 12;
dataBlock.numItems = 4;
dataBlock.items = calloc(sizeof(Item), 4);
dataBlock.items[0].type = DISK_OFF;
dataBlock.items[0].size = 4;
dataBlock.items[1].type = FILE_OFF;
dataBlock.items[1].size = 4;
dataBlock.items[2].type = FILE_SIZE;
dataBlock.items[2].size = 4;
dataBlock.items[3].type = SKIP;
dataBlock.items[3].size = 4;
I have attached the mentioned datablock, the red-square is that 0x2010 offset start.
@xonar_ maybe you could give us some explanation of what those header parts mean and how can we know what to do depending on the differences. Here I'm trying to concentrate on L3 II header files.
Thanks to all in advance!
binExtractor github: https://github.com/Xonar/LGBinExtractor
method for manually getting the images from the firmware using dd: http://forum.xda-developers.com/showthread.php?t=2071465
get the original firmware using IMEI: http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=your_imei
root-check
Here's a little find I did searching for "ro.secure" inside the TOT
for me it looks like something related to the persist partition with a residing anti-root consistency check.. this is why it would be great to extract all the partitions from the firmware, we need a full check to make sure all this **** is gone before flashing anything to a phone.
cher
Code:
/rct<bh:00>/persist/rct.partition<bh:00>w<bh:00>/system/bin/su<bh:00>/system/xbin/su<bh:00>/system/sbin/su<bh:00>/sbin/su<bh:00>/data/local/tmp/su<bh:00>/system/app/Superuser.apk<bh:00>/system/app/SuperUser.apk<bh:00>/system/app/superuser.apk<bh:00>/data/data/com.noshufou.android.su<bh:00>/data/local/tmp/Superuser.apk<bh:00>/data/local/tmp/SuperUser.apk<bh:00>/data/local/tmp/superuser.apk<bh:00>/system/bin/busybox<bh:00>/system/xbin/busybox<bh:00>/data/local/tmp/busybox<bh:00>/system/<bh:00>/<bh:00>su<bh:00>getprop ro.secure<bh:00>r<bh:00>getprop ro.debuggable<bh:00>sys.rctd.uid<bh:00>1<bh:00>sys.uctd.on<bh:00>0<bh:00>rb<bh:00>wb<bh:00>Not Rooted
[LG RCT v%s]<bh:00>1.0.1224<bh:00>Rooted
<bh:00> LG RCT had been hacked by user.
<bh:00> > LG RCT Flag(backup)
<bh:00> > LG RCT Flag
<bh:00> Not allowed command had been executed.
<bh:00> > su
<bh:00> Permission related property had been changed.
<bh:00> > ro.secure
<bh:00> > ro.debuggable
<bh:00> Mount option had been changed.
<bh:00> > /system
<bh:00> > /
<bh:00> Rooting related file had been installed.
<bh:00> > superuser
<bh:00> > busybox
<bh:00>
[LG RCT v%s]<bh:00>/dev/block/platform/msm_sdcc.3/by-num/p26<bh:00>/persist<bh:00>/dev<bh:00>%s<bh:00>getprop ro.hardware<bh:00>/persist/rct<bh:00>/data/system/lgmdm_root_flag.txt<bh:00>/persist/rct.cfg<bh:00>/sdcard/RCT_security
gattytto said:
Hello, I've been reading the thread about BinExtractor and it seems to work with original TOT firmwares that now we can download using some nice methods (like going to a url and putting the IMEI or there's even an APP that does the same).
In my case I'm trying with 10B_00.tot for my E431g
Now, the latest binextractor seems to properly read the magic numbers from my tot file header but it's not able to extract the img files from it.
So I have already asked the developer to add my model to the supported devices but I would like to have more understanding of the TOT file headers so we could develop our own apps or even do things manually.
Does anyone have any information on how to better understand those headers it'd be really nice. So far I got to the part of "reading the first datablock" from the file but I don't really know what the app does with those (as follows):
Code:
/*SET FIRST DATABLOCK*/
dataBlock.blockOff = 0x2010;
dataBlock.blockSize = 12;
dataBlock.numItems = 4;
dataBlock.items = calloc(sizeof(Item), 4);
dataBlock.items[0].type = DISK_OFF;
dataBlock.items[0].size = 4;
dataBlock.items[1].type = FILE_OFF;
dataBlock.items[1].size = 4;
dataBlock.items[2].type = FILE_SIZE;
dataBlock.items[2].size = 4;
dataBlock.items[3].type = SKIP;
dataBlock.items[3].size = 4;
I have attached the mentioned datablock, the red-square is that 0x2010 offset start.
@xonar_ maybe you could give us some explanation of what those header parts mean and how can we know what to do depending on the differences. Here I'm trying to concentrate on L3 II header files.
Thanks to all in advance!
binExtractor github: https://github.com/Xonar/LGBinExtractor
method for manually getting the images from the firmware using dd: http://forum.xda-developers.com/showthread.php?t=2071465
get the original firmware using IMEI: http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=your_imei
Click to expand...
Click to collapse
9-APPS.img for my E431g:
init.vee3.rc: right at the end of the file, declared as a service
Code:
#Porting Rooting Check Tool
service rctd /system/bin/rctd
class late_start
user root
group root
full tree of 9-APPS.img
Code:
[email protected]:/media/sf_fw/img/tools/apps# tree ./
./
├── charger
├── cupssd.rc
├── data
├── default.prop
├── dev
├── fstab.vee3
├── init
├── init.goldfish.rc
├── init.lge.early.rc
├── init.lge.rc
├── init.lge.usb.sh
├── init.miniOS.rc
├── init.qcom.class_core.sh
├── init.qcom.class_main.sh
├── init.qcom.rc
├── init.qcom.ril.path.sh
├── init.qcom.sh
├── init.qcom.usb.rc
├── init.qcom.usb.sh
├── init.rc
├── init.target.rc
├── init.vee3.rc
├── init.vee3.usb.rc
├── lgdms.fota.rc
├── lgdms.fota_update.rc
├── proc
├── res
│** └── images
│** ├── charger
│** │** ├── battery_0.png
│** │** ├── battery_1.png
│** │** ├── battery_2.png
│** │** ├── battery_3.png
│** │** ├── battery_4.png
│** │** ├── battery_5.png
│** │** ├── battery_charge.png
│** │** └── battery_fail.png
│** ├── chargerimages
│** │** ├── battery_charging_01.png
│** │** ├── battery_charging_02.png
│** │** ├── battery_charging_03.png
│** │** ├── battery_charging_04.png
│** │** ├── battery_charging_05.png
│** │** ├── battery_charging_06.png
│** │** ├── battery_charging_07.png
│** │** ├── battery_charging_08.png
│** │** ├── battery_charging_bg.png
│** │** ├── battery_charging_complete.png
│** │** ├── battery_charging_warning_eng_1.png
│** │** ├── battery_charging_warning_eng_2.png
│** │** ├── battery_charging_warning_jp_1.png
│** │** ├── battery_charging_warning_jp_2.png
│** │** ├── battery_charging_warning_kor_1.png
│** │** ├── battery_charging_warning_kor_2.png
│** │** ├── battery_charging_warning.png
│** │** ├── battery_trickle_ani_01.png
│** │** ├── battery_trickle_ani_02.png
│** │** ├── battery_wait_ani_01.png
│** │** └── battery_wait_ani_02.png
│** └── errorlogo.png
├── sbin
│** ├── adbd
│** ├── brd
│** ├── chargerlogo
│** ├── clearlock
│** ├── cupssd
│** ├── lge_fota
│** ├── make_ext4fs
│** ├── setup_fs
│** ├── skd
│** └── wallpaper
├── skd.rc
├── sys
├── system
├── ueventd.goldfish.rc
├── ueventd.qcom.rc
├── ueventd.rc
└── ueventd.vee3.rc
gattytto said:
Here's a little find I did searching for "ro.secure" inside the TOT
for me it looks like something related to the persist partition with a residing anti-root consistency check.. this is why it would be great to extract all the partitions from the firmware, we need a full check to make sure all this **** is gone before flashing anything to a phone.
cher
Code:
/rct<bh:00>/persist/rct.partition<bh:00>w<bh:00>/system/bin/su<bh:00>/system/xbin/su<bh:00>/system/sbin/su<bh:00>/sbin/su<bh:00>/data/local/tmp/su<bh:00>/system/app/Superuser.apk<bh:00>/system/app/SuperUser.apk<bh:00>/system/app/superuser.apk<bh:00>/data/data/com.noshufou.android.su<bh:00>/data/local/tmp/Superuser.apk<bh:00>/data/local/tmp/SuperUser.apk<bh:00>/data/local/tmp/superuser.apk<bh:00>/system/bin/busybox<bh:00>/system/xbin/busybox<bh:00>/data/local/tmp/busybox<bh:00>/system/<bh:00>/<bh:00>su<bh:00>getprop ro.secure<bh:00>r<bh:00>getprop ro.debuggable<bh:00>sys.rctd.uid<bh:00>1<bh:00>sys.uctd.on<bh:00>0<bh:00>rb<bh:00>wb<bh:00>Not Rooted
[LG RCT v%s]<bh:00>1.0.1224<bh:00>Rooted
<bh:00> LG RCT had been hacked by user.
<bh:00> > LG RCT Flag(backup)
<bh:00> > LG RCT Flag
<bh:00> Not allowed command had been executed.
<bh:00> > su
<bh:00> Permission related property had been changed.
<bh:00> > ro.secure
<bh:00> > ro.debuggable
<bh:00> Mount option had been changed.
<bh:00> > /system
<bh:00> > /
<bh:00> Rooting related file had been installed.
<bh:00> > superuser
<bh:00> > busybox
<bh:00>
[LG RCT v%s]<bh:00>/dev/block/platform/msm_sdcc.3/by-num/p26<bh:00>/persist<bh:00>/dev<bh:00>%s<bh:00>getprop ro.hardware<bh:00>/persist/rct<bh:00>/data/system/lgmdm_root_flag.txt<bh:00>/persist/rct.cfg<bh:00>/sdcard/RCT_security
Click to expand...
Click to collapse
Hi there
gattytto said:
get the original firmware using IMEI: http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=your_imei
Click to expand...
Click to collapse
Thats a nice find
what are you trying to achieve by this doing this (extracting and making kdz files) ? we have cwm and unlocked bootloader we can do all using easy .zip's
anyway i think i have something that you might find useful (also check my thread for more (see sig))
Code:
*---------------------------- PartitionTable Info E430 V10C_00--------------------------*
Index| Partition Name | Logical Start Offset | Logical Size (KB) | File Offset | Physical Start Offset | Partition Size (KB) | Device Location
02 | QCSBL | 0xFFFFFFFF | 0x841CFBCD ( 949734KB) | 0x 100000 | 0x 0 | 0x 829 ( 1044KB) | /dev/block/mmcblk0p2
03 | OEMSBL | 0x3445474C | 0x 3033 ( 6169KB) | 0x 180000 | 0x 829 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p3
04 | EXT | 0x 0 | 0x 0 ( 0KB) | 0x 280000 | 0x 2829 | 0x 1D7D7 ( 60395KB) | /dev/block/mmcblk0p4
05 | APPSSBL | 0x 0 | 0xFFFFFFFF (4194303KB) | 0x 300000 | 0x 20000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p5
06 | WALLPAPER | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 22000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p6
07 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 24000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p7
08 | misc | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 26000 | 0x C000 ( 24576KB) | /dev/block/mmcblk0p8
09 | APPS | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 32000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p9
10 | MODEM_ST1 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 38000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p10
11 | MODEM_ST2 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p11
12 | MODEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3C000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p12
13 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 1D80000 | 0x 4A000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p13
14 | SYSTEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3100000 | 0x 58000 | 0x 1D0000 ( 950272KB) | /dev/block/mmcblk0p14
15 | PERSIST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3D100000 | 0x 228000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p15
16 | CACHE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 22E000 | 0x 140000 ( 655360KB) | /dev/block/mmcblk0p16
17 | RECOVERY | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 36E000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p17
18 | DRM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 374000 | 0x 4000 ( 8192KB) | /dev/block/mmcblk0p18
19 | FOTA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 378000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p19
20 | USERDATA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 37E000 | 0x 38C000 (1859584KB) | /dev/block/mmcblk0p20
21 | DLOAD | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p21
22 | BOOT_LOGO_IMAGE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70C000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p22
23 | MPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 70E000 | 0x 8000 ( 16384KB) | /dev/block/mmcblk0p23
24 | ENCRYPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 716000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p24
25 | CUST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 718000 | 0x 10000 ( 32768KB) | /dev/block/mmcblk0p25
26 | rct | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 40280000 | 0x 728000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p26
the attached file is output of sysinternals dbgview.exe while flashing stock v10c to phone e430
Hi, thanks a lot for your repply and the info, I'd like to answer to your question at the bottom of you post:
what I'm trying to do now is to examine all the .img files included inside the latest original .tot available for download from LG, mainly because since the last update it's impossible to root the e431g using vroot or any other 1-click rooting tool.
so far I've been able to unpack recovery and apps img (9-APPS.img and 17-RECOVERY.img) with their kernel and ramdisk.gz.
there are some things that I still don't understand, for example the existense of secundary recovery.img and oemsbl.img, so I have 17-RECOVERY.img, recovery.img, 3-OEMSBL.img and oemsbl.img
also I'm still trying to unpack some of the IMG files since they seem to be some special filesystem like yaffs2 but I haven't found any tool to browse them (didn't try converters 'cause that's not the approach I'm looking for). right now I'm compiling a 3.16-r2 kernel with the yaffs2 module that I tried modding to compile for that kernel (was hard job indeed).
my approach is to try modify the files present in my original downloaded TOT to root and unlock the bootloader to flash them back into my phone, thus trying to avoid bricking the phone.
you use skype or something?
here's a list of what I get:
Code:
10-MODEM_ST1.img: empty
11-MODEM_ST2.img: empty
12-MODEM.img: data
13-MODEM_BACKUP.img: data
14-SYSTEM.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
15-PERSIST.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
16-CACHE.img: empty
17-RECOVERY.img: data
18-DRM.img: empty
19-FOTA.img: empty
20-USERDATA.img: empty
21-DLOAD.img: empty
22-BOOT_LOGO_IMAGE.img: data
23-MPT.img: empty
24-ENCRYPT.img: empty
25-CUST.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
26-rct.img: empty
2-QCSBL.img: x86 boot sector; partition 1: ID=0x4d, active, starthead 0, startsector 1, 40 sectors; partition 2: ID=0x45, starthead 0, startsector 41, 2048 sectors; partition 3: ID=0x46, starthead 0, startsector 2089, 8192 sectors; partition 4: ID=0x5, starthead 0, startsector 10281, 7501784 sectors, code offset 0x0
3-OEMSBL.img: data
4-EXT.img: x86 boot sector; partition 1: ID=0x47, starthead 0, startsector 120791, 8192 sectors; partition 2: ID=0x5, starthead 0, startsector 1, 1 sectors, extended partition table, code offset 0x0
5-APPSSBL.img: Hitachi SH big-endian COFF object, not stripped
6-WALLPAPER.img: empty
7-MODEM_BACKUP.img: empty
8-misc.img: empty
9-APPS.img: data
oemsbl.img: data
recovery.img: data
also I've seen some info on mounting boot sector files like 4-EXT.img and 2-QCSBL.img but the file systems from those sectors don't seem to get recognized by the mount command.. so I'm guessing there's a filesystem module missing in my linux distro (that's why I'm compiling this other one).
IGGYVIP said:
Thats a nice find
what are you trying to achieve by this doing this (extracting and making kdz files) ? we have cwm and unlocked bootloader we can do all using easy .zip's
anyway i think i have something that you might find useful (also check my thread for more (see sig))
Code:
*---------------------------- PartitionTable Info E430 V10C_00--------------------------*
Index| Partition Name | Logical Start Offset | Logical Size (KB) | File Offset | Physical Start Offset | Partition Size (KB) | Device Location
02 | QCSBL | 0xFFFFFFFF | 0x841CFBCD ( 949734KB) | 0x 100000 | 0x 0 | 0x 829 ( 1044KB) | /dev/block/mmcblk0p2
03 | OEMSBL | 0x3445474C | 0x 3033 ( 6169KB) | 0x 180000 | 0x 829 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p3
04 | EXT | 0x 0 | 0x 0 ( 0KB) | 0x 280000 | 0x 2829 | 0x 1D7D7 ( 60395KB) | /dev/block/mmcblk0p4
05 | APPSSBL | 0x 0 | 0xFFFFFFFF (4194303KB) | 0x 300000 | 0x 20000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p5
06 | WALLPAPER | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 22000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p6
07 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 24000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p7
08 | misc | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 26000 | 0x C000 ( 24576KB) | /dev/block/mmcblk0p8
09 | APPS | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 380000 | 0x 32000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p9
10 | MODEM_ST1 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 38000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p10
11 | MODEM_ST2 | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p11
12 | MODEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x A00000 | 0x 3C000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p12
13 | MODEM_BACKUP | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 1D80000 | 0x 4A000 | 0x E000 ( 28672KB) | /dev/block/mmcblk0p13
14 | SYSTEM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3100000 | 0x 58000 | 0x 1D0000 ( 950272KB) | /dev/block/mmcblk0p14
15 | PERSIST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3D100000 | 0x 228000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p15
16 | CACHE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 22E000 | 0x 140000 ( 655360KB) | /dev/block/mmcblk0p16
17 | RECOVERY | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3DD00000 | 0x 36E000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p17
18 | DRM | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 374000 | 0x 4000 ( 8192KB) | /dev/block/mmcblk0p18
19 | FOTA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 378000 | 0x 6000 ( 12288KB) | /dev/block/mmcblk0p19
20 | USERDATA | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 37E000 | 0x 38C000 (1859584KB) | /dev/block/mmcblk0p20
21 | DLOAD | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70A000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p21
22 | BOOT_LOGO_IMAGE | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E400000 | 0x 70C000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p22
23 | MPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 70E000 | 0x 8000 ( 16384KB) | /dev/block/mmcblk0p23
24 | ENCRYPT | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 716000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p24
25 | CUST | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 3E480000 | 0x 718000 | 0x 10000 ( 32768KB) | /dev/block/mmcblk0p25
26 | rct | 0xFFFFFFFF | 0xFFFFFFFF (4194303KB) | 0x 40280000 | 0x 728000 | 0x 2000 ( 4096KB) | /dev/block/mmcblk0p26
the attached file is output of sysinternals dbgview.exe while flashing stock v10c to phone e430
Click to expand...
Click to collapse
I see
gattytto said:
Hi, thanks a lot for your repply and the info, I'd like to answer to your question at the bottom of you post:
what I'm trying to do now is to examine all the .img files included inside the latest original .tot available for download from LG, mainly because since the last update it's impossible to root the e431g using vroot or any other 1-click rooting tool.
so far I've been able to unpack recovery and apps img (9-APPS.img and 17-RECOVERY.img) with their kernel and ramdisk.gz.
there are some things that I still don't understand, for example the existense of secundary recovery.img and oemsbl.img, so I have 17-RECOVERY.img, recovery.img, 3-OEMSBL.img and oemsbl.img
also I'm still trying to unpack some of the IMG files since they seem to be some special filesystem like yaffs2 but I haven't found any tool to browse them (didn't try converters 'cause that's not the approach I'm looking for). right now I'm compiling a 3.16-r2 kernel with the yaffs2 module that I tried modding to compile for that kernel (was hard job indeed).
my approach is to try modify the files present in my original downloaded TOT to root and unlock the bootloader to flash them back into my phone, thus trying to avoid bricking the phone.
you use skype or something?
here's a list of what I get:
Code:
10-MODEM_ST1.img: empty
11-MODEM_ST2.img: empty
12-MODEM.img: data
13-MODEM_BACKUP.img: data
14-SYSTEM.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
15-PERSIST.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
16-CACHE.img: empty
17-RECOVERY.img: data
18-DRM.img: empty
19-FOTA.img: empty
20-USERDATA.img: empty
21-DLOAD.img: empty
22-BOOT_LOGO_IMAGE.img: data
23-MPT.img: empty
24-ENCRYPT.img: empty
25-CUST.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (extents) (large files)
26-rct.img: empty
2-QCSBL.img: x86 boot sector; partition 1: ID=0x4d, active, starthead 0, startsector 1, 40 sectors; partition 2: ID=0x45, starthead 0, startsector 41, 2048 sectors; partition 3: ID=0x46, starthead 0, startsector 2089, 8192 sectors; partition 4: ID=0x5, starthead 0, startsector 10281, 7501784 sectors, code offset 0x0
3-OEMSBL.img: data
4-EXT.img: x86 boot sector; partition 1: ID=0x47, starthead 0, startsector 120791, 8192 sectors; partition 2: ID=0x5, starthead 0, startsector 1, 1 sectors, extended partition table, code offset 0x0
5-APPSSBL.img: Hitachi SH big-endian COFF object, not stripped
6-WALLPAPER.img: empty
7-MODEM_BACKUP.img: empty
8-misc.img: empty
9-APPS.img: data
oemsbl.img: data
recovery.img: data
also I've seen some info on mounting boot sector files like 4-EXT.img and 2-QCSBL.img but the file systems from those sectors don't seem to get recognized by the mount command.. so I'm guessing there's a filesystem module missing in my linux distro (that's why I'm compiling this other one).
Click to expand...
Click to collapse
i have tried unpacking .dz before but i was never successful as all of tools are outdated
only way i found to extract the .kdz is flashing it to phone and adb dd and pull from device but for that you need root (did you check the latest vroot ?
anyway i have made tool to dump and name all(skipping the sdcard) partitions from phone(L3 II) found HERE
also i made a tool to list ALL of files in phone in easy to read directory format found HERE*this also includes my filelist.txt for compare in case you want and does not require root
also here is my boot.img unpacked BOOT BROKENDOWN
i think you did not get a chance to read the attached file yet but inside you find that lg flashing software does :
Code:
Skip writing [MODEM_ST1;MODEM_ST2;DRM;MPT;CACHE;USERDATA;MODEM_BACKUP;PERSIST;BOOT_LOGO_IMAGE;] partition
Code:
Size of the [WALLPAPER] partition is zero \tab\par
00000463\tab 717.36279297\tab [4244] [13:16:39] Size of the [MODEM_BACKUP] partition is zero \tab\par
00000464\tab 717.36285400\tab [4244] [13:16:39] Size of the [misc] partition is zero \tab\par
00000465\tab 717.36291504\tab [4244] [13:16:39] Size of the [MODEM_ST1] partition is zero \tab\par
00000466\tab 717.36297607\tab [4244] [13:16:39] Size of the [MODEM_ST2] partition is zero \tab\par
00000467\tab 717.36303711\tab [4244] [13:16:39] Skip writing [MODEM_BACKUP] partition \tab\par
00000468\tab 717.36309814\tab [4244] [13:16:39] Skip writing [PERSIST] partition \tab\par
00000469\tab 717.36315918\tab [4244] [13:16:39] Size of the [CACHE] partition is zero \tab\par
00000470\tab 717.36322021\tab [4244] [13:16:39] Size of the [DRM] partition is zero \tab\par
00000471\tab 717.36328125\tab [4244] [13:16:39] Size of the [FOTA] partition is zero \tab\par
00000472\tab 717.36328125\tab [4244] [13:16:39] Size of the [USERDATA] partition is zero \tab\par
00000473\tab 717.36334229\tab [4244] [13:16:39] Size of the [DLOAD] partition is zero \tab\par
00000474\tab 717.36340332\tab [4244] [13:16:39] Skip writing [BOOT_LOGO_IMAGE] partition \tab\par
00000475\tab 717.36346436\tab [4244] [13:16:39] Size of the [MPT] partition is zero \tab\par
00000476\tab 717.36352539\tab [4244] [13:16:39] Size of the [ENCRYPT] partition is zero \tab\par
00000477\tab 717.36370850\tab [4244] [13:16:39] Size of the [rct] partition is zero \tab\par
it means none of these are inside the .kdz
about kdz could you send me direct link to firmware you are trying to root ?
e430 europe latest is v10c and its easly rootable using vroot so i will try to flash yours and see if i can get success
Hello, before you read my repply, I know you can get some tots (or kdz) from other places, but I will really appreciate you get me a link for the offical KDZ link generation url http://csmg.lgmobile.com:9002/...(and so on). Since I can extract the kdz to .cab, I want to know if yours is actually packed with different headers and if so that will give more info 'bout what tools need to get updated.
I will first answer to your request for the .kdz file I'm working on: http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW238195432109876543213/V10B_00.kdz
as for the .kdz file extractor, I have been testing several ones until I got to this one (attached).
run it from a command prompt, can you give me the url produced for yor IMEI from the link I have provided in first post? It would let me accelerate testing for your particular case.
After you use that extractor with -kdz argument, you will get a .cab, open with winrar, you should get a .tot and a .dll file
if you get to extract your own kdz and obtain the .tot proceed as follows:
use LGBinExtractor to unpack the .tot from https://github.com/Xonar/LGBinExtractor, I provide a .exe with code updates to support e431g tot magic and headers..
use the -daph argument with your .tot and you should get output about partitions inside the firmware with this format:
Code:
AP HEADER
----------
Magic Number 0x0 : 44 DD 55 AA
0x8 : 97 4A EB 9F
0xC : 4C 47 45 34
0x10 : 33 31 67 00
0x14 : 00 00 00 00
0x18 : 00 00 00 00
0x1C : 00 00 00 00
0x600 : AA BB 00 CC
0x2000 : 33 EC 55 AA
Number of Partitions 25
PARTITION ENTRIES
-----------------
PARTITION ENTRY
------------
Data Block Name QCSBL
Data Block ID 2
Size on File 1024
File Offset 0
Size on Disk 2089
Disk Offset 0
PARTITION ENTRY
------------
Data Block Name OEMSBL
Data Block ID 3
Size on File 2048
File Offset 1024
Size on Disk 8192
Disk Offset 2089
If you get any error from the command "LGBinExtractor -daph file.tot" instead of the partitions list then you need to use the "LGBinExtractor -ebh file.tot" command to extract a copy of its header and attach it to the LGBinExtractor thread so the author will get the magic headers added to the app in https://github.com/Xonar/LGBinExtractor . If this is the case and you get a .tot from the KDZ but not IMG files from the TOT with LGBinExtractor, besides posting the headers to the author's thread, also upload here your header.bin with the link to your official .kdz so I can make some testing.
Note: in case you get the .tot but it's not supported by lgbinextractor, you can also setup a linux box (win 2012 hyper-v / virtualbox / etc..) and try to make the needed changes, then use that windows makefile I have attached and it will produce a .exe with your changes (or author's added changes in case he didn't share the .exe with the most recent changes you or someone else requested for their devices). You can use the default makefile and test inside the linux box with header.bin file until you get the partitions list, then you can produce the .exe and try unpack the whole .tot in your windows box.
If you can't get the .tot from your official kdz then we need to get the source for the LGExtract (kdz extractor) and make the needed changes in order to support your version.
cheers
http://ul.to/myyrb8ie <- the extractors and the makefile
IGGYVIP said:
i have tried unpacking .dz before but i was never successful as all of tools are outdated
only way i found to extract the .kdz is flashing it to phone and adb dd and pull from device but for that you need root (did you check the latest vroot ?
anyway i have made tool to dump and name all(skipping the sdcard) partitions from phone(L3 II) found HERE
also i made a tool to list ALL of files in phone in easy to read directory format found HERE*this also includes my filelist.txt for compare in case you want and does not require root
also here is my boot.img unpacked BOOT BROKENDOWN
i think you did not get a chance to read the attached file yet but inside you find that lg flashing software does :
Code:
Skip writing [MODEM_ST1;MODEM_ST2;DRM;MPT;CACHE;USERDATA;MODEM_BACKUP;PERSIST;BOOT_LOGO_IMAGE;] partition
Code:
Size of the [WALLPAPER] partition is zero \tab\par
00000463\tab 717.36279297\tab [4244] [13:16:39] Size of the [MODEM_BACKUP] partition is zero \tab\par
00000464\tab 717.36285400\tab [4244] [13:16:39] Size of the [misc] partition is zero \tab\par
00000465\tab 717.36291504\tab [4244] [13:16:39] Size of the [MODEM_ST1] partition is zero \tab\par
00000466\tab 717.36297607\tab [4244] [13:16:39] Size of the [MODEM_ST2] partition is zero \tab\par
00000467\tab 717.36303711\tab [4244] [13:16:39] Skip writing [MODEM_BACKUP] partition \tab\par
00000468\tab 717.36309814\tab [4244] [13:16:39] Skip writing [PERSIST] partition \tab\par
00000469\tab 717.36315918\tab [4244] [13:16:39] Size of the [CACHE] partition is zero \tab\par
00000470\tab 717.36322021\tab [4244] [13:16:39] Size of the [DRM] partition is zero \tab\par
00000471\tab 717.36328125\tab [4244] [13:16:39] Size of the [FOTA] partition is zero \tab\par
00000472\tab 717.36328125\tab [4244] [13:16:39] Size of the [USERDATA] partition is zero \tab\par
00000473\tab 717.36334229\tab [4244] [13:16:39] Size of the [DLOAD] partition is zero \tab\par
00000474\tab 717.36340332\tab [4244] [13:16:39] Skip writing [BOOT_LOGO_IMAGE] partition \tab\par
00000475\tab 717.36346436\tab [4244] [13:16:39] Size of the [MPT] partition is zero \tab\par
00000476\tab 717.36352539\tab [4244] [13:16:39] Size of the [ENCRYPT] partition is zero \tab\par
00000477\tab 717.36370850\tab [4244] [13:16:39] Size of the [rct] partition is zero \tab\par
it means none of these are inside the .kdz
about kdz could you send me direct link to firmware you are trying to root ?
e430 europe latest is v10c and its easly rootable using vroot so i will try to flash yours and see if i can get success
Click to expand...
Click to collapse
gattytto said:
Hello, before you read my repply, I know you can get some tots (or kdz) from other places, but I will really appreciate you get me a link for the offical KDZ link generation url http://csmg.lgmobile.com:9002/...(and so on). Since I can extract the kdz to .cab, I want to know if yours is actually packed with different headers and if so that will give more info 'bout what tools need to get updated.
I will first answer to your request for the .kdz file I'm working on: http://csmgdl.lgmobile.com/dn/downloader.dev?fileKey=FW238195432109876543213/V10B_00.kdz
as for the .kdz file extractor, I have been testing several ones until I got to this one (attached).
run it from a command prompt, can you give me the url produced for yor IMEI from the link I have provided in first post? It would let me accelerate testing for your particular case.
After you use that extractor with -kdz argument, you will get a .cab, open with winrar, you should get a .tot and a .dll file
if you get to extract your own kdz and obtain the .tot proceed as follows:
use LGBinExtractor to unpack the .tot from https://github.com/Xonar/LGBinExtractor, I provide a .exe with code updates to support e431g tot magic and headers..
use the -daph argument with your .tot and you should get output about partitions inside the firmware with this format:
Code:
AP HEADER
----------
Magic Number 0x0 : 44 DD 55 AA
0x8 : 97 4A EB 9F
0xC : 4C 47 45 34
0x10 : 33 31 67 00
0x14 : 00 00 00 00
0x18 : 00 00 00 00
0x1C : 00 00 00 00
0x600 : AA BB 00 CC
0x2000 : 33 EC 55 AA
Number of Partitions 25
PARTITION ENTRIES
-----------------
PARTITION ENTRY
------------
Data Block Name QCSBL
Data Block ID 2
Size on File 1024
File Offset 0
Size on Disk 2089
Disk Offset 0
PARTITION ENTRY
------------
Data Block Name OEMSBL
Data Block ID 3
Size on File 2048
File Offset 1024
Size on Disk 8192
Disk Offset 2089
If you get any error from the command "LGBinExtractor -daph file.tot" instead of the partitions list then you need to use the "LGBinExtractor -ebh file.tot" command to extract a copy of its header and attach it to the LGBinExtractor thread so the author will get the magic headers added to the app in https://github.com/Xonar/LGBinExtractor . If this is the case and you get a .tot from the KDZ but not IMG files from the TOT with LGBinExtractor, besides posting the headers to the author's thread, also upload here your header.bin with the link to your official .kdz so I can make some testing.
Note: in case you get the .tot but it's not supported by lgbinextractor, you can also setup a linux box (win 2012 hyper-v / virtualbox / etc..) and try to make the needed changes, then use that windows makefile I have attached and it will produce a .exe with your changes (or author's added changes in case he didn't share the .exe with the most recent changes you or someone else requested for their devices). You can use the default makefile and test inside the linux box with header.bin file until you get the partitions list, then you can produce the .exe and try unpack the whole .tot in your windows box.
If you can't get the .tot from your official kdz then we need to get the source for the LGExtract (kdz extractor) and make the needed changes in order to support your version.
cheers
http://ul.to/myyrb8ie <- the extractors and the makefile
Click to expand...
Click to collapse
quick post
MY CURRENT FIRMWARE
*updating
Code:
F:\>mas -extract E430_TSC_UK.tot
Reading AP Header...
Reading GPT Header...
Does not contain GPT at first data block
Writing Files...
Writing File : 2-QCSBL.img -- DONE --
Writing File : 3-OEMSBL.img -- DONE --
Writing File : 4-EXT.img -- DONE --
Writing File : 5-APPSSBL.img -- DONE --
Writing File : 6-WALLPAPER.img -- DONE --
Writing File : 7-MODEM_BACKUP.img -- DONE --
Writing File : 8-misc.img -- DONE --
Writing File : 9-APPS.img -- DONE --
Writing File : 10-MODEM_ST1.img -- DONE --
Writing File : 11-MODEM_ST2.img -- DONE --
Writing File : 12-MODEM.img -- DONE --
Writing File : 13-MODEM_BACKUP.img -- DONE --
Writing File : 14-SYSTEM.img -- DONE --
Writing File : 15-PERSIST.img -- DONE --
Writing File : 16-CACHE.img -- DONE --
Writing File : 17-RECOVERY.img -- DONE --
Writing File : 18-DRM.img -- DONE --
Writing File : 19-FOTA.img -- DONE --
Writing File : 20-USERDATA.img -- DONE --
Writing File : 21-DLOAD.img -- DONE --
Writing File : 22-BOOT_LOGO_IMAGE.img -- DONE --
Writing File : 23-MPT.img -- DONE --
Writing File : 24-ENCRYPT.img -- DONE --
Writing File : 25-CUST.img -- DONE --
Writing File : 26-rct.img -- DONE --
Finished
IGGYVIP said:
quick post
MY CURRENT FIRMWARE
*updating
Click to expand...
Click to collapse
Almost done, but don't want to use KDZ, but LG FlashTool instead, but it's complaining about the CRC check.. anyone with some debugging skills to help us ollydbg patch the dll/exe to bypass the crc check? or maybe someone knows how this check is being performed?
thanks in advance
also this is killing me inside:
Code:
5-APPSSBL.img: Hitachi SH big-endian COFF object, not stripped
what does this mean? Hitachi SH is SH2 or SH3 or SH4 which is a chip, and this phone has ARM MSM7225A, why does this file get recognized as a SH3/4 instruction set? pleeeeeeeeeeeeeease! someone clarify this for me!!