Related
please if you have a english pocketpc running on your phone and you have a serial kable
this will only take 5 minutes !
please dump the rum doing the following
Here is the steps to backup the ROM to a file:
1. Connect via Serial cable to XDA II
2. Put XDA II into Bootloader Mode (power button+any direction+reset)
2b. get HyperTerminal Private Edition ftp://ftp.hilgraeve.com/htpe/htpe63.exe
3. Run Hyper Terminal 115200 baud, 8n1, direct to com port.
4. Issue d2s command to backup ROM to SD. You'll need an empty SD card with 64Mb or more size (i used 128)
5. Once the ROM is dumped, reset your XDA.
6. Put the SD card to your card reader.
7. Use ntrw (http://home.comcast.net/~kenzhao8/downloads.htm, it is in cfutils.zip):
ntrw read test.nb1 m:
This assumes your SD card has drive letter M:
8. Copy the nb1 rom file to a zip and post it to a site.
Then we can download the ROM, unzip, use ntrw to write back to SD and go into bootloader mode with SD card inserted, hit camera button and flash our MDA II to english rom.
thanks to PalMop for the info
Update, I got a copy of the English ROM !!! It was dumped via pmemdump (http://www.xs4all.nl/~itsme/projects/xda/tools.html) using:
osimage: 'pmemdump 0x80040000 0x01fc0000 osimage.nb1'
bootloader: 'pmemdump 0x80000000 0x00040000 bootloader.nb0'
I am still trying to figure out how to dump this image to SD. My ntrw.exe method above works, if you created the SD via serial. The pmemdump method uses ActiveSync and USB cable, so it is easier to create the file. But we don't know how to put it onto SD yet.
So if anyone wants the English ROM created by pmemdump, pm me where to upload (or German one as well)
Have you tried XDA OS Image Tool from http://xda-developers.com/XDArit/?
Guys and gals, I now have a English MDA II. Special thanks goes to Willem and KullTogi for their help.
I compare my original ROM and the English ROM dumped by pmemdump. First 412 bytes were missing. So I added that, removed last 412 bytes, copied the file to SD via ntrw and it works.
I have the patched file and the ntrw.exe for anyone wanting it. If anyone can open a FTP to host, I can upload there for everyone's use.
One note, after upgrade, the checksum will fail at the end of process. But don't worry.
Awesome!!! I want it.
Palmop:
How big is the file you need to upload? I want to get my hands on the english ROM!!!
Thanks,
Fernando
File is 16Mb. It is being uploaded to a FTP site , Akira will provide details shortly
strange for an rom to be 16 mb
thought ppc2003 was 32 at least
I said file is, not rom is , there is the good old zip compression. If anyone can arrange FTP access, I can upload it there. I have no access to a FTP server, I am looking to setup one.
PalMop
i just mailed you a new one
Please post the ftp site here...
for those of us itching to download. Thanks !!!
Fernando
I have an FTP site that can host this.
Palmop:
I can host it here:
ftp://www.shawus.com
username: hydrosphere
password: 12345
Please upload it there and post a message here when its done.
Thanks!!!
Fernando
http://www.vogtschmidtoutdoorcenter...h ROM by PalMop/xdaii-usa-rom-1-03-palmop.zip
ill leave it for 48 hours
note: it did not work for me
when i put it in booloader, and pres camera it says
SD DOWNLOAD
Section=1
Not allow update!
**update :
did same as palmop
downloaded my down rom, and hexedited it, copyd the header part
replaced it in the new rom
tried again and worked
It said on my 2 devices:
SD DOWNLOAD
Section=1
Press Power to download
(or something similar, I hit the power button and update is done)
My file I sent to you via FTP was already patched (the first 412 bytes), weird
it failed
Upload to Orinoco's FTP is complete as well
Steb-by-Step Instructions?
Akira and Palmop:
Would it be too much to ask a step-by-step to get this done properly. I want to do it, but am afraid to screw up my new device. Thanks in advance for all your efforts.
Fernando
It was in the text file (how to.txt), inside the ZIP I uploaded
Here it is:
1. Extract the files to a folder.
2. Put 64Mb or larger SD to SD card reader.
3. Go to command prompt, switch to the folder from step 1.
4. Type:
Ntrw write 1-03-00-USA-xdaii-patched.nb1 g:
(assuming SD card reader has drive letter g:, change accordingly)
5. Once copying is finished, wait a minute, get the SD out, insert into MDA II, select Nein if it wants to format the card.
6. Go to Bootloader mode (power + direction + reset), hit Camera button couple of times
7. When it asks to press power button to flash, do so.
8. It will flash the rom, at the end there will be a checksum error, that is normal as the bootloader has not been changed.
9. Reset.
10. Device is ready to use.
it worked !
problem is , everybody needs to implant their own header, i think its header sensitive.
ik used a hex editor and deleted the first 420 bytes
not that word part that you see in the file. first time i also selected the word part at the end of the header.
and then copied the header from my own rom
and placed it their
now it works
Hi all !
I dumped my original ROM (German) from XDA2 and read with 'ntrw' but the file size is 128.450.560 bytes.
Something wrong ? Or what ?
THX any replay
Treo Pro on CDMA networks - ROMs, Instructions, Tips & Tricks
Flashing...
[size=+1]Instructions:
First, if you have GSM treo pro (NOT CDMA, NOT SPRINT/VERIZON/TELUS), this is not intended for your device. see this post on GSM treo pro's current status: http://forum.ppcgeeks.com/showpost.p...7&postcount=55
steps:
0) if you have Vista or Windows 7, make sure you have latest WMDC.
1) download Hard-SPL package from attachment, extract to an empty local folder.
2) you must Have Phone Synced with PC in Windows Mobile!
3) run PANTHER_CDMA_HSPL exe from the folder
4) follow steps in the program!
5) it should go to tricolour screen now, i.e. SSPL mode, and show 0.32.SSPL. now follow steps in the RUU that's launched by now.
6) SPL flashes, device automatically reboots, job done. if you get any errors, follow the instructions offered by the program.
7) to confirm you got it installed, go into bootloader mode (tricolour screen!) and verify the screen shows 0.36.CMONEX.
NOTE: you will not see the SPL version during normal boot!
to enter bootloader mode to see version: with the device turned on, press and hold the Camera button along with the Power button, then press the reset button with the stylus tip, then release the Camera and Power buttons when bootloader tricolour screen appears.
NOTE 2: anyone having problems with the device entering SSPL automatically or problems with USB connection after SSPL was loaded, please copy SSPL-Manual-PantherCDMA.exe from the SSPLManual.zip attachment to the device and run it. then once the screen is in SSPL, run RUU manually. i.e. you run the RUU on the PC, if it isn't obvious.
NOTE 3: this is unsigned Hard-SPL. no limitations on flashing ROMs. also, this has overwrite protection, if someone needs to revert to stock SPL for warranty reasons, a stock SPL downgrade package will soon be posted.
NOTE 4: do not use this RUU to flash anything else! this is only intended for flashing the HardSPL.
Finally, if you wish to thank me with a donation, you can do so by clicking the link the HardSPL program offers, or here: http://hpcmonex.net/htc/pantc/panther.htm
Troubleshooting tips:
- READ THE INSTRUCTIONS
- READ THE INSTRUCTIONS
- READ THE INSTRUCTIONS
- if you have USB issues:
1. anyone having problems with the device entering SSPL automatically or problems with USB connection after SSPL was loaded, please copy SSPL-Manual-PantherCDMA.exe from the SSPLManual.zip attachment to the device and run it (make sure USB is plugged in). then once the screen is in SSPL, run RUU manually. i.e. you run the RUU on the PC, if it isn't obvious.
2. if it still has connection error in SSPL screen, try unplugging and replugging the USB
3. try different USB port, PC, etc.
4. when there are sync issues, the program also suggests installing this file on the phone: http://hpcmonex.net/roms/enablerapinew.cab, just making a note here too.
5. it's been verified that you can flash HardSPL from SD in SSPL, see instructions below.
Updates:
HardSPL NBH file is now downloadable from 1st post! you can flash this from SD now; rename this NBH to PANTIMG.NBH, put it on a fat32 formatted SD, and then run SSPL-Manual-PantherCDMA.exe on the phone.
steps for stock SPL restore:
0. only use this for warranty service! for no other purpose!!! also before flashing this, make sure you already have stock ROM flashed.
1. download Stock_SPL_Restore_036.zip attachment from 1st post, extract it.
2. get customRUU and flash this file. can also do SD flash (PANTIMG.NBH).[/size]
ROMs - CDMA
BigE Rom 23518 v 1.0 - SPRINT
BigE Rom 23511 v 1.2 - SPRINT
CFAY Treo Pro 6.5 Rom - SPRINT
Reserved 3
This is reserved for future use...
Reserved 4
This is reserved for future use...
Reserved 5
This is reserved for future use...
Sprint Treo Pro on Boost Mobile. Will the stock roms also be posted in this thread?
Video Drivers?
Any video drivers like on the touch pro ?
link death, please upload thanks
Stick the list; to get fixed up!
Thx for ROM....
BR
Hello to all.
I want specially thank all of you, because I don't remember names that hels me with their solutions during my chaos. (I read houndreds of thousand pages since 41 hours).
Well my situation was:
I bought my HTC Desire S from Vodafone Turkey.
Android: 2.3.3
HTC Sense: 2.1
Main Version: 20.28I.30.085AU_3805.06.02.03
Build Number: 1.47.468.2
It was S-offed.
41 hours ago, I thought that I must(!) flash new RUU_Saga_S_HTC_Europe_2.10.401.5_Radio_20.4801.30.0822U_3822.10.08.04_M_release_219480_signed...
But something went wrong and I'm stucked on Bootloader with nothing.
I had no GoldCard, no official ROM from Vodafone Turkey (it should something like
RUU_Saga_S_TUR_1.47.468.2_Radio_20.28I.30.085AU_3805.06.02.03_M_release or something)
I had only my Nandroid Backup and OTA-Update for 1.47.468.2.
All of my attacks with fastboot turns without anyresults. I only got same Error "CID Incorrect" with RUU or PG88IMG.zip installations
Firstly I had to find a working Goldcard. That could be the only working method...
Today morning. I read in a forum from a different android site (for an another HTC Phone)that if we have a working WinMo device, we can prepare a GoldCard...
Here is the method for a Goldcard,if you don't have an another Android machine to use and your HTC Desire cannot be controlled with adb commands:
1. Find a working WinMo device (mine is HTC Touch HD)
2. Download RevSkills from its own site
(http://psas.revskills.de/?q=node/6)
3. Get a SDCard <4GB (not a SDHC, only a SD Card can be very chip one, too)
4. Put your SDCard to WinMo
5. Run RevSkills (just run. Should not be as Administrator)
6. Open Menu-Calculators/Generators/HTC Goldcard
7. Than push Get CID from WINCE Device. So you will get CID of SDCard.You will not need Reverse CID, but just in case of get it, too.
8. Go to Free GoldCard Generator site (http://psas.revskills.de/?q=goldcard)
Put your SDCard CID in the blank line (important: do not use reversed do not change first 2 letters as 00). Choose your GoldCard Type as Android and push Download Goldcard! button.
9. Download your Goldcard.img to PC
10. Remove your SDCard, find a SDCard Reader,Format the SDCard as FAT32/4096
10. Download HxD HEX Editor from anywhere (you can find it with googling)
11. Run HxD as Administrator
12. Under Extras choose Open Disk and that choose there Removable Disk (att: uncheck open read only checkbox)
13. Under Extras choose Open Disk Image and find your Goldcard.img from downloaded place on your PC (opens a dialog box, just push OK)
14. In goldcard.img Edit/Select All/Edit/Copy
15. Go to removable disk choose from 000 to 170 (included) and Edit/Paste Insert
16. Save it
17. For controlling remove SDCard and insert again.
If you can see your SDCard on Windows Explorer means everything is OK
Here is the method to flash a RUU again.
1. Put your GoldCard SD to HTC Desire S.
2. Go to bootloader with Power+Volume Down
3. Choose Fastboot.
4. In my case I used
RUU_Saga_HTC_Europe_1.47.401.4_Radio_20.28I.30.085AU_3805.06.02.03_M_release_199410_signed
because I had before a 1.47.468.2 ROM
with 1.28.401.2 probably you will get an error message number 140...
After 10 minutes I've gotmy HTC Desire S back and alive...
Again I want to thank all of XDA-Developers member for their brilliant helps...
PS: If you want you can use your Goldcard as a normal SDCard, because it will stay always as GoldCard. It is not important you format it again or not.But I prefer to keep it in a safe place,just in case of emergency
I had the same issue after flashing radio on my Desire S. It was stuck at bootloader.
Remove SD Card, then boot the phone as normal, once booted remove the corrupt radio from SD card and you should be good.
Hey,
Dude also my phone is opening only bootloader and S-ON. I am not able to find windows mobile phone. My cid is same with yours. Can you share your goldcard?
Thanks.
This is revision 1.5. It works on both currently available HP firmware releases,
1.00.05 and 1.00.08. If you upgrade from '05 to '08 you will need to re-root.
Both releases are Android 4.2 - if there's a 4.3, the method will change.
At a high level, the steps are:
- OEM unlock your bootloader using the Shield naked drivers developed by 1wayjohnny
- boot your device using a CWM originally developed for the Transformer 701 by Drgravy
- on rebooting the CWM, it will offer to root your system. Do so.
- install SuperSU or another SU manager.
- Done.
Prerequisites:
- Willingness to wipe your Slate 8's user memory - this willl happen during the process of unlocking, and, not by accident.
- Android SDK tools from Google
- Java (IIRC, the SDK is looking for 32 bit Java 1.6)
- 1wayjonny's "Naked USB Driver" from the Shield forum on XDA http://forum.xda-developers.com/showthread.php?t=2386956
- Drgravy's Clockwork 6.0.3.7 for the TF 701 available at http://forum.xda-developers.com/showthread.php?t=2524401
- a microSD card and a copy of the update.zip file from HP's website, to attempt a recovery if you hose your device.
I: Preparing ADB on the PC
Download and install the SDK tools. You don't need every single thing the SDK manager offers to fetch; just the minimum to get functioning ADB support, which is the platform tools package.
Put the ADB command set into your PATH variable. In Windows, do this by using the system settings tool, Advanced... Environmental Variables.. System Variables. Scroll down until you see 'PATH" click the Edit button and append the path to the directory with the ADB.EXE and FASTBOOT.EXE files in it.
In win 7, that path is C:\Users\username\AppData\Local\Android\android-sdk\platform-tools\
Next, find the .android environment folder on your computer. In win7, it is
C:\Users\username\.android
You need to create a adb_usb.ini file here that contains the vendor ID string for your Slate.
The value is
0x03F0
Reboot your PC and be sure that from a command prompt, typing adb start-server results in
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
II Enabling ADB in Android
Go to your device and tap on the build number field 8 times (in System.. About Tablet)
That enables developer mode. In the new developer options menu that is now available, tick "enable USB debugging"
III Installing and Testing the Drivers to Talk to Your Device via ADB
Download and install the Naked driver.
Connect your Slate to your USB port. You should get an unknown device followed by a failure to install driver message. Right-click on the device and manually install the ADB composite driver from the Naked driver android_winusb.inf file, choosing the nvidia shield as your device. You will get a warning that the driver is unsigned.
Once the driver is installed, open a command prompt and type
adb devices
You should get
List of devices attached
CND34609YG device
IV Unlock the Bootloader
Now type
adb reboot-bootloader
Your device restarts. A screen shows up all black with white lettering; this screen is telling you your boot loader is locked
Go to device manager; you should have a new device without a driver.
Navigate to the Naked driver folder and manually install the driver from the android_apxusb.inf file.
(that is, not the file you installed the regular ADB driver using)
Install the Shield fastboot driver.
At the command prompt, type
fastboot -i 0x03F0 oem unlock
The display on your Slate should change, warning you that you're about to void the warranty and erase all data on your device.
Use the volume up and volume down key to navigate the menu that comes up on your slate and choose "unlock."
This will erase all data on your Slate, and reinstall existing /system apps. It will not remove /system apps you shouldn't have put there in the first place!
Let your device restart and rerun its setup routine.
V Rooting the device
Connect the USB cable to the fully booted device. Open a command prompt and navigate to the directory the Clockwork recovery is downloaded to.
type
adb reboot-bootloader
At the bootloader screen, use the volume down button to select "Fastboot Protocol" and press the power button once
Now, type
fastboot -i 0x03F0 boot recovery.img
The command prompt will tell you how long it took to download the recovery; the display will
tell you it is booting from the donwloaded image.
Give it a minute or two, and your device will boot into clockwork.
Choose reboot.
Clockwork will notice that you are not rooted, and offer to drop su into /system for you.
It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently.
V Reinstalling HP software using Clockwork
This is fairly simple to do. You need to have booted into Clockwork and to have a copy of one of the HP zip files that contains a full software update, available from HP.
Those HP files are flashable in clockwork with a little editing:
To get the recovery to install, I found I needed to edit the recovery script from HP a bit:
- unzip the recovery
- navigate to
\update\META-INF\com\google\android
Open the updater-script in a text editor
delete the first few lines:
assert(!less_than_int(1381289516, getprop("ro.build.date.utc")));
assert(getprop("ro.product.device") == "fig" ||
getprop("ro.build.product") == "fig");
assert(getprop("ro.product.name") == "kadota_w_a");
those values were not being retrieved and that stopped the update from flashing.
Save updater-script
Re-zip everything below \\update\
Verify that your zipfile is structured correctly, ie, at the top level you have
- meta-inf
- recovery
- system
- blob
- boot.img
You can then put your update.zip on an sdcard and navigate to it in Clockwork (only the volume up key works for navigation as of now) or get into the advanced menu in Clockwork and do an adb sideload.
Successfully rooted and bootloader unlocked.
Ta muchly.
:good:
Updated to 1.0.8 by accident
Unfortunately, I updated my slate 8 pro to 1.0.8 by accident and now have lost my root. Is there a way to revert back to 1.0.5 or is there a method of rooting 1.0.8 yet?
Thanks for the help!
boomboom, I'm in the same boat right now.
The possibilities are:
- figure out how to get the nvidia shield / note 7 boot and root image to work on our devices
- come up with a new exploit allowing root (keep looking for Cydia updates)
- try to force the recovery boot and reload the '05 firmware via recovery.
I was not able to get that to work this weekend and am now looking into linux boot a la the gnurou disks.
The 1.00.05 files are up on the HP site still, as a zip file at
http://h10025.www1.hp.com/ewfrf/wc/...en&cc=us&dlc=en&sw_lang=&product=6608624#N147
supposedly you can place that zip (be sure it's called update.zip) on an sdcard, power your device off, put the sdcard in, and power on while holding volume down.
In the menu that comes up, use the volume down button to highlight "recovery kernel" and click the power button to start recovery.
I was not able to get this technique to restore my device to '05 but hope others have better luck.
Part of my problem was not realizing that even though the recovery looks as if nothing is happening, if you leave it alone long enough, the device eventually restarts, implying that there may be a recovery process going on which is just impossible to monitor.
If that's true, the recovery is installing the update again regardless of what's on the card, though.
thats a lot of info. thanks for posting it
Damn. Through sheer blind luck my 1.00.08 update failed when I tried it... Makes me wonder what was different between our tablets for mine to fail and yours to update?
UPDATE:
In case anyone else is stuck rooted on 1.00.05 like I have been... here's what I found with my limited experience/knowledge of this kinda stuff. So my 1.00.08 update failed because I removed some of the system apps - which meant that the 'assert' commands were failing in the 'updater-script'. Luckily, I kept a backup of all the ones I removed. Putting them back in the system and then re-flashing the 1.00.08 update zip via CWM recovery and rooting via the OP's method worked. Now on rooted 1.00.08.
kenneth2008 said:
Damn. Through sheer blind luck my 1.00.08 update failed when I tried it... Makes me wonder what was different between our tablets for mine to fail and yours to update?
UPDATE:
In case anyone else is stuck rooted on 1.00.05 like I have been... here's what I found with my limited experience/knowledge of this kinda stuff. So my 1.00.08 update failed because I removed some of the system apps - which meant that the 'assert' commands were failing in the 'updater-script'. Luckily, I kept a backup of all the ones I removed. Putting them back in the system and then re-flashing the 1.00.08 update zip via CWM recovery and rooting via the OP's method worked. Now on rooted 1.00.08.
Click to expand...
Click to collapse
Sorry, but i didn't get it...
i thought after updating a rooted 1.00.05 to 1.00.08 the root is lost?
Take a look at the update in the first post. '08 is now rootable.
There is a CWR originally written by Drgravy for the TF701 which will boot the Slate 8 as well.
It's a fully functional CWR, lets you flash zips and the whole nine yards.
It also sees if you're not rooted and offers to fix it for you.
I borked my partition table completely. I just finished repairing it and getting the OS reinstalled. I'll detail that tomorrow, but if anyone is willing to share what a "stock" layout looks like, I'd love to see one.
Very short version: image the damaged internal memory. Repair gpt in linux. Reimage back to device. Assign correct names using gdisk. Reinstall OS using CWR.
the output from these commands would be great:
mount
cat /proc/mounts
cat /proc/partitions
and one other - this one requires grabbing a copy of a utility called gptfdisk and running it. (It's fdisk for gpt based disks; like fdisk, it does not commit changes without asking.)
http://dl.dropbox.com/u/64885133/gptfdisk.zip is where the file lives (originally compiled by meghd00t)
Copy gdisk to your device and make it executable
adb push gdisk /system/bin/gdisk
adb shell
# chmod 777 gdisk
invoke by
# gdisk /dev/block/mmcblk0
then
p for print
On a nexus 7, the output looks like this:
[email protected]:/ # gdisk /dev/block/mmcblk0
gdisk /dev/block/mmcblk0
GPT fdisk (gdisk) version 0.8.4
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Command (? for help): p
p
Disk /dev/block/mmcblk0: 60424192 sectors, 28.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Partition table holds up to 32 entries
First usable sector is 34, last usable sector is 60424158
Partitions will be aligned on 2-sector boundaries
Total free space is 1526010 sectors (745.1 MiB)
Number Start (sector) End (sector) Size Code Name
1 131072 306143 85.5 MiB 0700 radio
2 393216 399359 3.0 MiB FFFF modemst1
3 399360 405503 3.0 MiB FFFF modemst2
4 524288 554287 14.6 MiB 8300 persist
5 655360 656919 780.0 KiB FFFF m9kefs1
6 656920 658479 780.0 KiB FFFF m9kefs2
7 786432 787991 780.0 KiB FFFF m9kefs3
8 787992 794135 3.0 MiB FFFF fsg
9 917504 920503 1.5 MiB FFFF sbl1
10 920504 923503 1.5 MiB FFFF sbl2
11 923504 927599 2.0 MiB FFFF sbl3
12 927600 937839 5.0 MiB FFFF aboot
13 937840 938863 512.0 KiB FFFF rpm
14 1048576 1081343 16.0 MiB FFFF boot
15 1179648 1180671 512.0 KiB FFFF tz
16 1180672 1180673 1024 bytes FFFF pad
17 1180674 1183673 1.5 MiB FFFF sbl2b
18 1183674 1187769 2.0 MiB FFFF sbl3b
19 1187770 1198009 5.0 MiB FFFF abootb
20 1198010 1199033 512.0 KiB FFFF rpmb
21 1199034 1200057 512.0 KiB FFFF tzb
22 1310720 3031039 840.0 MiB 8300 system
23 3031040 4177919 560.0 MiB 8300 cache
24 4194304 4196351 1024.0 KiB FFFF misc
25 4325376 4345855 10.0 MiB FFFF recovery
26 4456448 4456463 8.0 KiB FFFF DDR
27 4456464 4456479 8.0 KiB FFFF ssd
28 4456480 4456481 1024 bytes FFFF m9kefsc
29 4587520 4587583 32.0 KiB FFFF metadata
30 4718592 60424158 26.6 GiB 8300 userdata
thanks very much. If you're willing to post here, great; if you want to discuss offline, PM me?
Hi roustabout,
due to the fact that I'm not sure which part of your OP step by step guide relates to 1.05 and which to 1.08 I will wait for your update.
In the meantime I prepared my PC with and unlocked the bootloader.
Everything is installed and working, so I'm ready for your instructions
Big Thanx for your work !!!
heino69 said:
Hi roustabout,
due to the fact that I'm not sure which part of your OP step by step guide relates to 1.05 and which to 1.08 I will wait for your update.
In the meantime I prepared my PC with and unlocked the bootloader.
Everything is installed and working, so I'm ready for your instructions
Big Thanx for your work !!!
Click to expand...
Click to collapse
You're ready - the OP is updated. The CWM method using Drgravy's CWM works to root both the '05 and '08 releases.
fastboot -i 0x03F0 boot recovery.img will boot you up into Clockwork and once you choose reboot it'll offer to root for you.
Works like a charm!
Thank you very much for your help
all the best an a rooted new year...
very good disassembly guide
HP has a well-done document on how to take the Slate apart:
http://www.hp.com/hpinfo/globalciti...Country/disassembly_notebo_20139302303720.pdf
The illustrations are accurate. The process is very simple (to start, at least) - gently put a fingernail or pick between the glass bezel edge and the plastic at the top of the device, and work sideways until a few latches are released. Then pick one of the sides and continue gently freeing it, repeat on the other.
Now you can go back up and get the top corners of the shell off, there's enough slack.
Once that's done, the bottom can be slide off over the USB and HDMI connectors.
I did this mostly to get a look at the speakers, and found that removing the rubber strips which communicate with the outward edges of the speaker housings and then piercing the case bottom with a heated safety pin seems to give a bit more volume out.
I would recommend against piercing the speakers themselves; they actually seem to make some use of the air chambers behind the speaker membranes.
The main thing to be aware of is that in this release of Android and this configuration, few if any of the tools that are often used to try increasing volume will work - volume +, equalizers, etc. So far, most of them actually decrease volume when in use.
I'd love to hear it if anyone finds an EQ that can improve volume output.
I have xposed running now as well (now that I can remove it with CWR if needed) and it has a module that lets you wake the device with the volume rocker.
Seems to eat battery, though.
Slate 21 here - I wish this method would work here. Unfortunately, fastboot (any image you throw at it) simply reboots the slate 21.
Could someone please paste here the output of /proc/partitions please? lets see if they are the same, maybe CWM could be installed there..
Sorry to hear that - I'd hoped that this image would help you as well.
I'm curious: when your device is in fastboot mode, what happens when you issue the commands
fastboot getvar all
or
fastboot reboot-bootloader
I'm wondering if your device is responding to the fastboot commands in full or if it's only getting a gimped set of them.
And I really wish we had access to your stock recovery image. I know there are folks who could do useful things with that.
When your device is in the stock recovery mode, it turns out you can issue a very limited set of commands usefully via ADB.
I was able to do an adb ls / and see the recovery file tree and then did an
adb pull /etc/recovery.fstab
adb shell bombs, but I was pretty interested to see I could do
adb ls /
adb ls /etc/
and so on, and then pull files once I knew what they were. I seem to remember the fellow who did the Shield root via Linux thought he could get that to work on the Slate if he had the recovery fstab - but I also think you've posted elsewhere that you don't ever get a post screen booting from that image.
My partition table's almost certainly not what you need, since I've so far only been able to get about 5 partitions going on it - boot, recovery, cache, system and data. The device is running OK but I'd really prefer to get it back to the stock layout. My memory is that there were around 12 partitions available before I hosed the gpt and sorta-kinda reestablished it.
don't get me wrong, I'm happy to have my Slate 1.0.8 unlocked and rooted, but just to know:
1.) Is it possible to unroot it again?
2.) Is it possible to lock the boot loader again (i.g. fastboot -i 0x03F0 oem lock)?
And last question:
From the past i know, that as soon as you install a CWM (i.g. with Rom Manager), the original OTA update feature from the manufacturer is broken - so this could be a good way to protect the Slate against a root lost because of updates, right?
THANX and br,
heino69 said:
don't get me wrong, I'm happy to have my Slate 1.0.8 unlocked and rooted, but just to know:
1.) Is it possible to unroot it again?
Click to expand...
Click to collapse
Absolutely. You can unroot using SuperSU or manually just go in with an adb shell, remount /system rw and remove the su binary. If you're considering doing this before returning it for service, probably best to boot from Clockwork and actually format /system and /cache, then install the OS completely clean.
2.) Is it possible to lock the boot loader again (i.g. fastboot -i 0x03F0 oem lock)?
Click to expand...
Click to collapse
Absolutely. I don't know whether or not the device remembers it's been unlocked, though, nor whether a device return would be checked for that.
And last question:
From the past i know, that as soon as you install a CWM (i.g. with Rom Manager), the original OTA update feature from the manufacturer is broken - so this could be a good way to protect the Slate against a root lost because of updates, right?
Click to expand...
Click to collapse
I am not sure that's true in this case. How sensitive OTAs are to device configuration varies from OEM to OEM.
My rooted '05 certainly downloaded and installed the '08 update.
There is a step in the recovery script that updates the recovery partition, and that step would fail if the partition had been overwritten with CWM. I think that's the last step in the update, or the second to last, though. The stuff at the head end of the OTAs (so far) is doing a set of checks only to be sure that it's applying to the right device.
To get the OTA to apply by CWM, I deleted the checks in the updater-script, which are these:
assert(!less_than_int(1381289516, getprop("ro.build.date.utc")));
assert(getprop("ro.product.device") == "fig" ||
getprop("ro.build.product") == "fig");
assert(getprop("ro.product.name") == "kadota_w_a");
The next commands start the process of formatting. There may be pre-scripts that I didn't see that inspect recovery or update it first, I'm not sure what the order is, though.
cwm flashable '09 update
If you've rooted and installed clockwork, vanilla ota updates fail.
It's very easy to make them flashable by removing the checks.
If you use the Xposed framework, some elements of the ota that target framework files may fail silently.
My system booted fine when I was done, though. I accepted cwm's offer to re-root and to disable stock recovery.
http://www.mediafire.com/?vebsg3yxtc0vh35
is a cwm flashable 08 to 09 updater. Only use it if you're already on 08.
09 update
Hi roustabout,
my rooted 08 (still with original recovery partition, no CWM mod) downloaded the 09 update today, but not installed till now.
If i install this update, i think my root will be lost again, right?
If so, can i root it again with the same trick (booting the TF 701 recovery.img) and select re-root?
PS: In your OP you talking about:
-> It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently. <-
Is there a easy way to create a backup of the original recovery partition?
Currently i'm not sure if i should replace the recovery with CWM.
I only will do this, if there is a way back, and i think for a full factory restore, i will need this HP recovery partition, right?
Thanx a lot!
heino69 said:
Hi roustabout,
my rooted 08 (still with original recovery partition, no CWM mod) downloaded the 09 update today, but not installed till now.
If i install this update, i think my root will be lost again, right?
If so, can i root it again with the same trick (booting the TF 701 recovery.img) and select re-root?
Click to expand...
Click to collapse
Yes, you can. If you wanted to, you could copy my file to your device, do a
fastboot boot recovery.img with the 701 recovery, and then apply the update using CWM. As you rebooted, CWM would prompt to re-root your system.
At the same time, if you have an SD card in your system, you could make a backup with CWM's excellent backup menu. I think, but haven't tested, that CWM can both backup and restore the stock recovery - the latter would likely work best done in this sequence:
- fastboot boot CWM.img
- backup entire system or selected partitions to SD card
- reboot bootloader
- boot CWM.img
- test a restore of recovery- basically.
PS: In your OP you talking about:
-> It will also offer to disable the onboard recovery system from updating. You probably don't want to do so until
- you've backed up the recovery partition
- you've decided to install Clockwork permanently. <-
Is there a easy way to create a backup of the original recovery partition?
Currently i'm not sure if i should replace the recovery with CWM.
I only will do this, if there is a way back, and i think for a full factory restore, i will need this HP recovery partition, right?
Thanx a lot!
Click to expand...
Click to collapse
I was able to get a full restore after I'd flashed CWM. I'd hosed my system pretty thoroughly, so I flashed CWM to recovery, rebooted into it, and then did an adb sideload install of the HP system file (after editing out the file checks.)
It's been running well since I did so.
I was not able to get the HP recovery to restore my system at the point where I'd gotten it to, but then again to get my restore I needed to do a fair amount of work on repairing the partition table.
with booting the TF 701 recovery.img and installing your mod. zip File and fix the root again via CWM it updated without any problems!
As soon as I got my new microSD and will try to save the factory recovery and install CWM afterwards.
Thanx again for your great support!!!
Hello all, so long story short I had bought a BLU G9 Pro which came with Android 9 Pie. The only device-specific guide I could find online about obtaining root was: https://www.getdroidtips.com/root-blu-g9-pro/
The information on that guide is trivial and can be applicable to almost any device. The root method worked, however, there was an OTA update to Android 10 (and then later a security update) which I took. I then attempted to re-root the device utilizing the same method. However, now it seems that everytime I flash a Magisk modded boot.img my device gets stuck in a bootloop and will not go past the bootloader. I believe that this device may be uncharted territory but it is a great phone and I would love to have both Magisk root and the latest Android 10 firmware. I have found that Magisk supports both Android 10 and A-only devices so I do not see what is causing the problem. Additionally, I attempted to flash an AOSP GSI of Android 10 which refused to boot before I even installed Magisk. I am new to modern Android devices with Project Treble so please forgive me if there is something obvious I am missing. Any help is appreciated, thanks in advance!
@eLatErbI
Try flashing GSI like said in https://source.android.com/setup/build/gsi#flashing-gsis
May be vbmeta flashing is required for your device.
You can get vbmeta.img from your stock firmware.
It seems that Verified Boot could definitely be getting in the way. Could this possibly explain why Magisk is working on the Android 9.0 version of the stock ROM but not Android 10? However, I thought Magisk disabled verified boot in the kernel (boot.img) also I do not have a vbmeta.img in any stock firmware for this phone. Any other means of disabling verified boot? Thanks in advance!
Hi, I have the same problem with my G9 PRO, I tried to boot all kinds of GSI roms with and without magisk and it doesn't work (bootloop). I cannot find the vbmeta partition anywhere so I am hesitant to try to flash it without a backup. There is a mention of it in the fstab of the boot partition, however it is not in the stock firmware or in my own backups. Magisk did also work for me before the Android 10 update. Does anyone have an idea of how AVB works without a vbmeta partition or a verity file?
You can extract the boot.img from your phone if you updated to 10. I updated and used SP Flash to read the boot.img and WwR_MTK to get the partition length and starting value for the boot.img and patched it using Magisk and reflashed it over fastboot. I know this thread is a bit old but if anyone is interested, reply and I will post the link that explains. I have Android 10 running on my Blu G9 pro rooted.
tuffasagong said:
You can extract the boot.img from your phone if you updated to 10. I updated and used SP Flash to read the boot.img and WwR_MTK to get the partition length and starting value for the boot.img and patched it using Magisk and reflashed it over fastboot. I know this thread is a bit old but if anyone is interested, reply and I will post the link that explains. I have Android 10 running on my Blu G9 pro rooted.
Click to expand...
Click to collapse
Hi. Please post the link. It will be very helpful for me. I have the BLU_G0231WW android 10.
Here is the link: https://forum.hovatek.com/thread-21970.html
This is what I did to root the phone:
Download WwR_MTK 2.30 and SP Flash (I used version 5.2112)
**Open WwR_MTK 2.30 and create a basic Scatter File by choosing the Platform Type (processor) which for Blu G9 Pro is MT6771. Click create and save as - I saved all files in one folder.
**Open SP Flash Tool and under the download tab choose the scatter file we just created it will have only Preloader under it.
**Go to the Readback tab press Add -- Double click on what was added and just keep it saved as ROM_0 (once again I saved it in the same folder as the scatter file) -- the Start Address is in the scatter file as "physical_start_addr:" it should be 0x0 and the length is "partition_size:" and the value should be 0x80000. Keep the Region as EMMC_USER unless you want the preloader but to get the boot.img we don't need that. Turn off your phone and press the Read Back button with the Arrow and plug your phone into the computer. It will read the file and give you a big Green Check to let you know it completed succesfully.
**Once you have the ROM_0 open it up in WwR_MTK 2.30 Under Step 3 (Choose the EMMC_USER partition in the prepared backup) you will get an error that says "The file size is smaller than the start position of the LK (uboot)" press OK -- You will get another error that says "To determine the ype of process and memory.... blah blah blah" Press OK
**Click the Scatter File tab -- Under the Name field find boot. We now get the starting value of the boot.img and the partition length. We need these values to put back into SP Flash.
**Go to SP Flash and Readback tab again. Press add. Double Click the new add and save it as boot.img -- Region is EMMC_USER and the start address is going to be the HEX value next to Boot and length the length address next to boot. For the BLU_G0231WW_V10.0.04.07_GENERIC Build these addresses are:
Start: 0x20C00000 and Length: 0x2000000
Push ok when you put the start address and length for the boot.img and once again push Readback and connect your phone while off. The File size I got was a boot.img of 32,768 KB in size which is much bigger than the boot.img of the Android 9 (which was like 9 MB in size).
**Install Magisk on the phone and patch the boot.img and flash it with fastboot and boom, you have a rooted BLU G9 Pro with the latest Update. Keep your stock boot.img as I rooted my phone with the 10.0.04.04 update and could not update to 10.0.04.07 until I reflashed the stock boot.img in case there is another update.
That is all there is to it and you should be able to use this tutorial to root if BLU pushes anymore updates.
tuffasagong said:
Here is the link: https://forum.hovatek.com/thread-21970.html
This is what I did to root the phone:
Download WwR_MTK 2.30 and SP Flash (I used version 5.2112)
**Open WwR_MTK 2.30 and create a basic Scatter File by choosing the Platform Type (processor) which for Blu G9 Pro is MT6771. Click create and save as - I saved all files in one folder.
**Open SP Flash Tool and under the download tab choose the scatter file we just created it will have only Preloader under it.
**Go to the Readback tab press Add -- Double click on what was added and just keep it saved as ROM_0 (once again I saved it in the same folder as the scatter file) -- the Start Address is in the scatter file as "physical_start_addr:" it should be 0x0 and the length is "partition_size:" and the value should be 0x80000. Keep the Region as EMMC_USER unless you want the preloader but to get the boot.img we don't need that. Turn off your phone and press the Read Back button with the Arrow and plug your phone into the computer. It will read the file and give you a big Green Check to let you know it completed succesfully.
**Once you have the ROM_0 open it up in WwR_MTK 2.30 Under Step 3 (Choose the EMMC_USER partition in the prepared backup) you will get an error that says "The file size is smaller than the start position of the LK (uboot)" press OK -- You will get another error that says "To determine the ype of process and memory.... blah blah blah" Press OK
**Click the Scatter File tab -- Under the Name field find boot. We now get the starting value of the boot.img and the partition length. We need these values to put back into SP Flash.
**Go to SP Flash and Readback tab again. Press add. Double Click the new add and save it as boot.img -- Region is EMMC_USER and the start address is going to be the HEX value next to Boot and length the length address next to boot. For the BLU_G0231WW_V10.0.04.07_GENERIC Build these addresses are:
Start: 0x20C00000 and Length: 0x2000000
Push ok when you put the start address and length for the boot.img and once again push Readback and connect your phone while off. The File size I got was a boot.img of 32,768 KB in size which is much bigger than the boot.img of the Android 9 (which was like 9 MB in size).
**Install Magisk on the phone and patch the boot.img and flash it with fastboot and boom, you have a rooted BLU G9 Pro with the latest Update. Keep your stock boot.img as I rooted my phone with the 10.0.04.04 update and could not update to 10.0.04.07 until I reflashed the stock boot.img in case there is another update.
That is all there is to it and you should be able to use this tutorial to root if BLU pushes anymore updates.
Click to expand...
Click to collapse
Thank tuffasagong.
I now have my blu g9 pro magisk rooted on Android 10. I added viper4Android, Adaway and more tweaks.
Have you noticed the desktop mode when screen casting to second display? I wonder if there is a way to reduce lag when using bluetooth mous.
&oot4peace said:
Thank tuffasagong.
I now have my blu g9 pro magisk rooted on Android 10. I added viper4Android, Adaway and more tweaks.
Have you noticed the desktop mode when screen casting to second display? I wonder if there is a way to reduce lag when using bluetooth mous.
Click to expand...
Click to collapse
flashed magisk but bricked phone Does anyone happen to have g9 pro v10 firmware G0230WW or G0231WW readback rom? please i need to unbrick and firmware on web wont work. Please help..
Tesh3180 said:
flashed magisk but bricked phone Does anyone happen to have g9 pro v10 firmware G0230WW or G0231WW readback rom? please i need to unbrick and firmware on web wont work. Please help..
Click to expand...
Click to collapse
Search here: BLU Stock Firmware Repository (Mediafire)
lopestom said:
Search here: BLU Stock Firmware Repository (Mediafire)
Click to expand...
Click to collapse
thanks but already tried that file and wont work..
Tesh3180 said:
thanks but already tried that file and wont work..
Click to expand...
Click to collapse
Which version were you on? The latest at the time? A little more info did you flash a Magisk patched boot image?
Blu pushed out a new update 10.0.04.08 a couple weeks ago. Reflash the stock Boot image to update. Boot image has the same length and start addresses. I just reflashed the magisk Boot image I made with 10.0.04.07 and works fine.
tuffasagong said:
Here is the link: https://forum.hovatek.com/thread-21970.html
This is what I did to root the phone:
Download WwR_MTK 2.30 and SP Flash (I used version 5.2112)
**Open WwR_MTK 2.30 and create a basic Scatter File by choosing the Platform Type (processor) which for Blu G9 Pro is MT6771. Click create and save as - I saved all files in one folder.
**Open SP Flash Tool and under the download tab choose the scatter file we just created it will have only Preloader under it.
**Go to the Readback tab press Add -- Double click on what was added and just keep it saved as ROM_0 (once again I saved it in the same folder as the scatter file) -- the Start Address is in the scatter file as "physical_start_addr:" it should be 0x0 and the length is "partition_size:" and the value should be 0x80000. Keep the Region as EMMC_USER unless you want the preloader but to get the boot.img we don't need that. Turn off your phone and press the Read Back button with the Arrow and plug your phone into the computer. It will read the file and give you a big Green Check to let you know it completed succesfully.
**Once you have the ROM_0 open it up in WwR_MTK 2.30 Under Step 3 (Choose the EMMC_USER partition in the prepared backup) you will get an error that says "The file size is smaller than the start position of the LK (uboot)" press OK -- You will get another error that says "To determine the ype of process and memory.... blah blah blah" Press OK
**Click the Scatter File tab -- Under the Name field find boot. We now get the starting value of the boot.img and the partition length. We need these values to put back into SP Flash.
**Go to SP Flash and Readback tab again. Press add. Double Click the new add and save it as boot.img -- Region is EMMC_USER and the start address is going to be the HEX value next to Boot and length the length address next to boot. For the BLU_G0231WW_V10.0.04.07_GENERIC Build these addresses are:
Start: 0x20C00000 and Length: 0x2000000
Push ok when you put the start address and length for the boot.img and once again push Readback and connect your phone while off. The File size I got was a boot.img of 32,768 KB in size which is much bigger than the boot.img of the Android 9 (which was like 9 MB in size).
**Install Magisk on the phone and patch the boot.img and flash it with fastboot and boom, you have a rooted BLU G9 Pro with the latest Update. Keep your stock boot.img as I rooted my phone with the 10.0.04.04 update and could not update to 10.0.04.07 until I reflashed the stock boot.img in case there is another update.
That is all there is to it and you should be able to use this tutorial to root if BLU pushes anymore updates.
Click to expand...
Click to collapse
I've followed this and have gotten quite far but I can't seem to find any working fastboot drivers for the G9 pro, I have tried several different ones and with every one I get absolutely no hits on "fastboot devices" and upon any attempts to flash, it leaves me at "waiting for device" I just want to know if you had a specific driver or if it's different issue
Cathedralruins said:
I've followed this and have gotten quite far but I can't seem to find any working fastboot drivers for the G9 pro, I have tried several different ones and with every one I get absolutely no hits on "fastboot devices" and upon any attempts to flash, it leaves me at "waiting for device" I just want to know if you had a specific driver or if it's different issue
Click to expand...
Click to collapse
Use the Platform Tools for A9 or A10.
Downloads - Read and accept the terms.: platform-tools-latest-windows.zip
Device need OEM Unlock & USB Debugging enable.
Maybe your PC need USB Drivers: drivers USB OEM
Maybe need MTK USB driver: MTK Driver
lopestom said:
Use the Platform Tools for A9 or A10.
Downloads - Read and accept the terms.: platform-tools-latest-windows.zip
Device need OEM Unlock & USB Debugging enable.
Maybe your PC need USB Drivers: drivers USB OEM
Maybe need MTK USB driver: MTK Driver
Click to expand...
Click to collapse
First off, thank you for your really speedy assistance with this, I appreciate it.
A couple things, to note, the device has already had OEM unlocking and usb debugging enabled, it works with adb, but is not recognized at all by fastboot itself, I'm definitely going to try those drivers and that version of the platform tools. Is there any log, device list, or any other info I can dump that would be useful in troubleshooting this?
Thanks again for your assistance, lopestom.
Cathedralruins said:
First off, thank you for your really speedy assistance with this, I appreciate it.
A couple things, to note, the device has already had OEM unlocking and usb debugging enabled, it works with adb, but is not recognized at all by fastboot itself, I'm definitely going to try those drivers and that version of the platform tools. Is there any log, device list, or any other info I can dump that would be useful in troubleshooting this?
Thanks again for your assistance, lopestom.
Click to expand...
Click to collapse
Bootloader unlocked?
Authorization PC vs device already has with USB debugging?
If yes so look drivers.
Hello there,
My technical skills when comes to android phones is next to zero, but I have been running linux (Fedora, Endeavour, currently Debian 11), I am not affraid of the terminal.
I have bought a Blu g9 pro, like 3 months ago, it came out of the box with android 9, then It updated to android 10.
It is very close to stock android, and I am ok with it, exept for a few creepy apps that I would like to remove,
I would like your input on what is the safest aproach, can I just 'debloat' the current system? or might as well replace it with something else?
Thank you.
I attempted to flash the patched boot image from Magisk but my G9 Pro started boot looping. I've tried to flash every firmware that I can find for this model but I keep getting an error message from the Flash tool.
Any guidance?
tuffasagong said:
Here is the link: https://forum.hovatek.com/thread-21970.html
This is what I did to root the phone:
Download WwR_MTK 2.30 and SP Flash (I used version 5.2112)
**Open WwR_MTK 2.30 and create a basic Scatter File by choosing the Platform Type (processor) which for Blu G9 Pro is MT6771. Click create and save as - I saved all files in one folder.
**Open SP Flash Tool and under the download tab choose the scatter file we just created it will have only Preloader under it.
**Go to the Readback tab press Add -- Double click on what was added and just keep it saved as ROM_0 (once again I saved it in the same folder as the scatter file) -- the Start Address is in the scatter file as "physical_start_addr:" it should be 0x0 and the length is "partition_size:" and the value should be 0x80000. Keep the Region as EMMC_USER unless you want the preloader but to get the boot.img we don't need that. Turn off your phone and press the Read Back button with the Arrow and plug your phone into the computer. It will read the file and give you a big Green Check to let you know it completed succesfully.
**Once you have the ROM_0 open it up in WwR_MTK 2.30 Under Step 3 (Choose the EMMC_USER partition in the prepared backup) you will get an error that says "The file size is smaller than the start position of the LK (uboot)" press OK -- You will get another error that says "To determine the ype of process and memory.... blah blah blah" Press OK
**Click the Scatter File tab -- Under the Name field find boot. We now get the starting value of the boot.img and the partition length. We need these values to put back into SP Flash.
**Go to SP Flash and Readback tab again. Press add. Double Click the new add and save it as boot.img -- Region is EMMC_USER and the start address is going to be the HEX value next to Boot and length the length address next to boot. For the BLU_G0231WW_V10.0.04.07_GENERIC Build these addresses are:
Start: 0x20C00000 and Length: 0x2000000
Push ok when you put the start address and length for the boot.img and once again push Readback and connect your phone while off. The File size I got was a boot.img of 32,768 KB in size which is much bigger than the boot.img of the Android 9 (which was like 9 MB in size).
**Install Magisk on the phone and patch the boot.img and flash it with fastboot and boom, you have a rooted BLU G9 Pro with the latest Update. Keep your stock boot.img as I rooted my phone with the 10.0.04.04 update and could not update to 10.0.04.07 until I reflashed the stock boot.img in case there is another update.
That is all there is to it and you should be able to use this tutorial to root if BLU pushes anymore updates.
Click to expand...
Click to collapse
Saved me - TY. This worked for me for Mintt Ultramintt Y3 - basically an Aussie rebadged Blu G9 Pro. I used this method for it with Pie 9 (before allowing update to 10). Cheers