Related
Several people have already figured out the details on their own, but I have gotten requests to do a more comprehensive tutorial on how the boot and recovery images are structured, and how you can edit them.
Background
Your phone has several devices which hold different parts of the filesystem:
Code:
#cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 04380000 00020000 "system"
mtd4: 04380000 00020000 "cache"
mtd5: 04ac0000 00020000 "userdata"
In this tutorial, we will deal with "recovery" and "boot". The "boot" device holds the files that are automatically loaded onto the root of your filesystem every time you boot (details below).
"system" holds everything that gets mounted in your system/ directory, and userdata/ is everything that shows up in data/ (this is all the apps you've installed, your preferences, etc).
The recovery and boot partitions are at /dev/mtd/mtd1 and /dev/mtd/mtd2, and before you do anything else you should back these up (note: this may not be the best way of doing this because it may not deal properly with bad blocks etc, but it's all we've got until somebody comes up with a better method, and besides you will probably be restoring from update.zip anyway):
Code:
# cat /dev/mtd/mtd1 > /sdcard/mtd1.img
# cat /dev/mtd/mtd2 > /sdcard/mtd2.img
The other thing you should do is put your favorite update.zip file into the root directory of your sd card so that if you screw up your boot partition you can boot into recovery mode and re-apply the update. You probably want one of the pre-rooted recovery images found elsewhere on the forums.
There is also another important file you should know about. In /system/recovery.img there is a full copy of everything that is loaded on mtd1. This file is automatically flashed onto mtd1 every time you shut down. That means two things: 1. Any changes you make directly to /dev/mtd/mtd1 get blown away on reboot and 2. If you want to change /dev/mtd/mtd1 you're probably better off just sticking the image in /system/recovery.img and rebooting. When creating your own custom update.zip files (especially when adapting the stock images), you can get tripped up if you forget to replace /system/recovery.img and it ends up overwriting /dev/mtd/mtd1 unbeknownst to you. Watch out.
Structure of boot and recovery images
The boot and recovery images are not proper filesystems. Instead, they are a custom android format consisting of a 2k header, followed by a gzipped kernel, followed by a ramdisk, followed by a second stage loader (optional, we have not seen these in the wild yet). This structure is outlined in mkbootimg.h:
Code:
+-----------------+
| boot header | 1 page
+-----------------+
| kernel | n pages
+-----------------+
| ramdisk | m pages
+-----------------+
| second stage | o pages
+-----------------+
n = (kernel_size + page_size - 1) / page_size
m = (ramdisk_size + page_size - 1) / page_size
o = (second_size + page_size - 1) / page_size
0. all entities are page_size aligned in flash
1. kernel and ramdisk are required (size != 0)
2. second is optional (second_size == 0 -> no second)
A ramdisk is basically a small filesystem containing the core files needed to initialize the system. It includes the critical init process, as well as init.rc, which is where you can set many system-wide properties. If you really want to know more about it, here is the documentation. Here's a list of files on a typical ramdisk:
Code:
./init.trout.rc
./default.prop
./proc
./dev
./init.rc
./init
./sys
./init.goldfish.rc
./sbin
./sbin/adbd
./system
./data
The recovery image typically has a few extra files, which constitute the recovery binary and supporting files (the application that gets run if you hold down home+power when rebooting). These files are:
Code:
./res
./res/images
./res/images/progress_bar_empty_left_round.bmp
./res/images/icon_firmware_install.bmp
./res/images/indeterminate3.bmp
./res/images/progress_bar_fill.bmp
./res/images/progress_bar_left_round.bmp
./res/images/icon_error.bmp
./res/images/indeterminate1.bmp
./res/images/progress_bar_empty_right_round.bmp
./res/images/icon_firmware_error.bmp
./res/images/progress_bar_right_round.bmp
./res/images/indeterminate4.bmp
./res/images/indeterminate5.bmp
./res/images/indeterminate6.bmp
./res/images/progress_bar_empty.bmp
./res/images/indeterminate2.bmp
./res/images/icon_unpacking.bmp
./res/images/icon_installing.bmp
./sbin/recovery
Unpacking, Editing, and Re-Packing the images
Note: below I give you the details for unpacking and repacking manually, but I have attached two perl scripts that do most of this for you
If you are good with a hex editor, you can open up any of these images and strip off the first 2k of data. Then, look for a bunch of zeroes followed by the hex 1F 8B (which is the magic number of a gzip file). Copy everything from the first line of the file, through the zeroes, and stopping at the 1F 8B. That is the kernel. Everything from the 1F 8B through the end is the ramdisk. You could save each of these files separately. In order to see the contents of the ramdisk, you need to un-gzip it and then un-cpio it. You could use a command like this (ideally after creating a new directory and cd'ing into it):
Code:
gunzip -c ../your-ramdisk-file | cpio -i
That will place all of the files from the ramdisk in your working directory. You can now edit them.
In order to re-create the ramdisk, you need to re-cpio them and re-gzip those files, with a command like the following (remember, cpio will include everything in the current working directory, so you probably want to remove any other cruft you might have in there):
Code:
find . | cpio -o -H newc | gzip > ../newramdisk.cpio.gz
The final step is to combine the kernel and your new ramdisk into the full image, using the mkbootimg program (which you should download and compile from the git repository):
Code:
mkbootimg --cmdline 'no_console_suspend=1 console=null' --kernel your-kernel-file --ramdisk newramdisk.cpio.gz -o mynewimage.img
Now, there's a lot of hassle in pulling apart files in hex editors and remembering all of these commands, so I wrote unpack and repack perl scripts for you (attached). Hooray.
Flashing your new image back onto the phone
You will probably only ever be flashing boot images directly to the phone, given the fact that /system/recovery.img automatically flashes the recovery device for you (as noted above). If you have created a new recovery image, just stick it in /system/recovery.img and reboot. If you are flashing a boot image, stick it on your phone via adb (a tool included in the Android SDK):
Code:
adb push ./mynewimage.img /sdcard
Then, open a shell to your phone via 'adb shell', get root, and do the following two commands to flash your new boot image:
Code:
# cat /dev/zero >> /dev/mtd/mtd2
write: No space left on device [this is ok, you can ignore]
# flash_image boot /sdcard/mynewimage.img
Reboot.
If your phone starts all the way up, congratulations. If not, you did something wrong and you'll need to boot into recovery mode and apply your update.zip file (reboot while holding down home+power, when you get the recovery screen press alt+L and then alt+S).
Something fun to do with your new found power
If you place a file titled initlogo.rle in the root directory of your boot image, the phone will display this image upon boot (after the "G1" image and before the Android animation). In order to create this file, you need to create a 320x480 image in Photoshop or Gimp and save it as a "raw image" file. You then need to compress that image with the program to565. More details on that here.
This is not the same thing as applying an update.zip
You will see other places on the forums that describe how to create customized update.zip files, as well as update.zip files that people are sharing. For example, there is a recent update.zip which is a modified version of rc30 (with the anti-root aspects disabled). The update.zip files include new boot images, recovery images, and typically replacements for the entire system/ directory as well as other updates. If you are creating a custom boot or recovery image, it is typically a good idea to start with the image distributed with the most recent update you have applied (flashing an image from an older release could have unintended consequences).
Questions?
hooray! you're awesome
Where does boot.img flash? What is the corresponding part of the system?
Dimath said:
Where does boot.img flash? What is the corresponding part of the system?
Click to expand...
Click to collapse
I'm not sure what exactly you mean, but when you do flash_image boot imagefile.img it will write imagefile.img to /dev/mtd/mtd2, which is where your phone looks for the boot files. Did that answer your question?
For your command...
Code:
cat /dev/zero >> /dev/mtd/mtd2
Do you mean
Code:
cat /dev/zero > /dev/mtd/mtd2
?
The idea being that you erase flash in the version with one '>', whereas you... append to the end of a device in the version with two '>'s? I can see the utility of erasing flash with one '>' but appending seems... odd. Am I missing something?
Is this any different than using the Dalvik Debug Monitor (DDMS) file manager found the the Android SDK? I'm able to push, pull, and delete files on my G1 with no problem.
Would this be the only way to rebuild a system app (i.e. Settings.apk) with more debug (Log. to extract via adb logcat over usb), then rebuild the entire system.img, then flash into the G1?
eckzow said:
For your command...
Code:
cat /dev/zero >> /dev/mtd/mtd2
Do you mean
Code:
cat /dev/zero > /dev/mtd/mtd2
?
The idea being that you erase flash in the version with one '>', whereas you... append to the end of a device in the version with two '>'s? I can see the utility of erasing flash with one '>' but appending seems... odd. Am I missing something?
Click to expand...
Click to collapse
I think you're right. I copied that from somebody else's instructions and it certainly seems to make more sense with one '>'. Anybody know for sure?
In any event, this is unnecessary in most cases because flash_image should overwrite the whole thing. The only exception is when you have an identical header on your image to the one that is already on the device. This shouldn't happen in my instructions (mkbootimg creates a header that includes the build timestamp) but I kept the instruction there just for good measure.
andonnguyen said:
Is this any different than using the Dalvik Debug Monitor (DDMS) file manager found the the Android SDK? I'm able to push, pull, and delete files on my G1 with no problem.
Click to expand...
Click to collapse
The adb push command I gave is no different, but you would still have to unpack/repack and flash_image according to my instructions.
I've tried these instructions on RC30 1.3. Basically I extracted, unpacked, and repacked, just to see if it would work. The resultant file is too large; it fails when you run flash_image.
I'm trying to modify my boot image of my ADP1 using the perl scripts, but I receive the following warning while decompressing the ramdisk:
Code:
$ unpack-bootimg.pl mtd2.img
kernel written to mtd2.img-kernel.gz
ramdisk written to mtd2.img-ramdisk.cpio.gz
removed old directory mtd2.img-ramdisk
[B]gzip: ../mtd2.img-ramdisk.cpio.gz: decompression OK, trailing garbage ignored
462 blocks[/B]
extracted ramdisk contents to directory mtd2.img-ramdisk/
Is this warning expected? Is safe to continue?
Also, I've found that the size of the modified packed image is far smaller than the original one
Code:
$ ll mtd2.img mtd2-modified.img
-rwx------ 1 ris ris 2621440 2009-01-07 19:19 mtd2.img
-rw-r--r-- 1 ris ris 1533952 2009-01-07 20:49 mtd2-modified.img
Update: I've tried anyway.
For the record, I've obtained the boot.img using cat, uncompressed with the perl script, modified default.prop, repacked with the perl script.
As you see from the code above, the img file is much smaller (Opening with a hex editor you can see that the end of the original image is full of 0xFF, so I believe it's ok, both the gzip warning and the different file sizes).
Reflashed it from recovery mode, using
fastboot flash boot mt2-modified.img
fastboot reboot
... and worked flawlessly
I'm leaving the coment for future references.
Thanks for the tutorial
[RiS] said:
gzip: ../mtd2.img-ramdisk.cpio.gz: decompression OK, trailing garbage ignored
462 blocks
Is this warning expected? Is safe to continue?
Click to expand...
Click to collapse
Yes, you would expect trailing zeroes, which would give you that error. The trailing zeroes exist in order to pad the image size to the nearest page boundary. They are added by mkbootimg.
[RiS] said:
Also, I've found that the size of the modified packed image is far smaller than the original one
As you see from the code above, the img file is much smaller (Opening with a hex editor you can see that the end of the original image is full of 0xFF, so I believe it's ok, both the gzip warning and the different file sizes).
Click to expand...
Click to collapse
Yep, that's exactly why. Nothing to worry about.
Thanks for the informative clarification.
alansj said:
There is also another important file you should know about. In /system/recovery.img there is a full copy of everything that is loaded on mtd1. This file is automatically flashed onto mtd1 every time you shut down. That means two things: 1. Any changes you make directly to /dev/mtd/mtd1 get blown away on reboot and 2. If you want to change /dev/mtd/mtd1 you're probably better off just sticking the image in /system/recovery.img and rebooting.
Click to expand...
Click to collapse
I'm using an stock ADP1, and the file /system/recovery.img does not exist. Is this expected?
Also, I've found out in JFv.1.31 that the recovery image is in /data/recovery.img (although there is no /data/recovery.img in my ADP1 neither..)
[RiS] said:
I'm using an stock ADP1, and the file /system/recovery.img does not exist. Is this expected?
Also, I've found out in JFv.1.31 that the recovery image is in /data/recovery.img (although there is no /data/recovery.img in my ADP1 neither..)
Click to expand...
Click to collapse
It deletes it after it flashes on the first bootup after you apply the update.
JesusFreke said:
It deletes it after it flashes on the first bootup after you apply the update.
Click to expand...
Click to collapse
Are you refering to /data/recovery.img or /system/recovery.img? or both?
[RiS] said:
Are you refering to /data/recovery.img or /system/recovery.img? or both?
Click to expand...
Click to collapse
I'm referring to /data/recovery.img in JFv1.2 and up (although there was a bug in the RC8 version of JFv1.2 that prevented it from being deleted)
So is there any reason why there is no /system/recovery.img on my ADP1?
When I use the unpack script on JF1.31 boot.img, it prints out like this:
"Could not find any embedded ramdisk images. Are you sure this is a full boot image?"
Any help?
[RiS] said:
So is there any reason why there is no /system/recovery.img on my ADP1?
Click to expand...
Click to collapse
Stock or JFv1.3?
JesusFreke said:
Stock or JFv1.3?
Click to expand...
Click to collapse
"Stock". I've just modified boot img to change default.prop
* What is Nandroid Backup v2.0?
Nandroid Backup is a set of tools and a script that will enable anyone who has root on their G1 and has the engineering/dev spl bootloader [1] (or has a dev phone) + a recovery image with busybox and adbd running as root [2] to make full system backups. These can then be restored using the fastboot [3] commandline tool and your phone in SPL/bootloader mode (hold camera + power). This allows you to create regular backups of your entire phones NAND flash so that you can restore a backup when something breaks. Its backup method works on a level that allows you to completely break, wipe or corrupt any or all partitions and still restore the phone to a working state within a few minutes. This works great for those who use their G1 for normal activities but also want to test their ideas which might break the phone, or when not having an extra G1 to keep purely as a development phone.
* Requirements for use
- Android G1 phone in recovery mode with busybox installed, including appropriate symlinks to at least tar and md5sum, as well as 'adb shell' support running as root. I recommend using JesusFreke US RC30 or UK RC8 v1.2 recovery image. You can flash the RC30 v1.2 recovery.img on your G1 if you don't want to bother constructing your own image. Of course you are free to use your own recovery image and it will work if you set it up correctly.
- dump_image-arm and mkyaffs2image|mkyaffs2image-$ARCH compiled in the current dir, as well as root on a linux/mac (POSIX) machine for constructing system and data images. root is required because the uid, gid and file permissions need to be preserved while extracting and creating the yaffs2 images. You are free to run the script as a normal user and then run the appropriate commands yourself as root; the commands are printed when you run the script as a regular user.
If you don't trust the provided binaries, you are free to compile them yourself. The source for the tools are included. For dump_image, edit nandtools/android-imagetools/Makefile so that you use the proper cross compiling gcc. For mkyaffs2img, just running make in tartools/yaffs2/utils/ should give you a binary. You are on your own in getting stuff compiled, but it should be easy to figure out from the Makefile.
* How to use this (the easy part)
Just boot your phone in recovery mode with the correct recovery.img (one that has adb shell as root + busybox installed with symlinks to tar, md5sum etc) and connect it to your pc/laptop/server. Then run the nandroid.sh script. If something is wrong or missing, it will tell you.
* What about restore?
If you have the dev phone or have root on the G1 and flashed the engineering/dev bootloader, then you can power on your phone while holding camera to get into the bootloader/SPL. It should then show some androids on skateboards (if not, you don't have the engineering/dev bootloader). Plug in your USB cable and push back until it says FASTBOOT instead of Serial0. Now you can fire up fastboot flash {partition} {file.img}.
Fastboot itself is part of the android SDK. If you download and compile your own mydroid build, it should sit in mydroid/out/host/linux-x86/bin/fastboot Perhaps in a future version I'll include a restore script, but for now I don't see the need.
One tip, if you are in fastboot mode on your phone and 'fastboot devices' doesn't show anything, try as root. You might need to edit your udev setup to allow your user to access the phone's usb device (which is different from the one you're in when in recovery or normal boot).
* Where's the source?
Sources are included. They are copies of the Android sources with various changes mostly made by Brainaid.
Everything in the zip is also also available through subversion:
svn co http://svn.infernix.net/nandroid/
Note that I DO NOT recommend checking out the latest revision unless you know damn well what you are doing. No guarantees if you play with fire. At the very least do diff against the latest released version.
* Credits
Bash script hacked together by infernix.
dump_image adapted from flash_image and extended by Brainaid.
Original mtdutils source and mkyaffs2image source by Google.
[1] http://forum.xda-developers.com/showthread.php?t=455860
[2] http://forum.xda-developers.com/showthread.php?t=443713
[3] http://www.gotontheinter.net/fastboot
DOWNLOAD HERE or:
wget http://dx.infernix.net/nandroid-2.0.zip
Originally Posted by trmacdonal
How to Restore your phone on a Windows PC using a Nandroid backup
I am going to assume you already have a Nandroid backup created on your SD card using JF 1.31's recovery Alt-B feature. The backup will create a folder called nandroid on your SD.
What you need:
The Android SDK:
Fastboot Windows Binary in this post:http://forum.xda-developers.com/showpost.php?p=3083753&postcount=1
From your Nandroid backup you need three files:
data.img
system.img
boot.img
Steps to restore your phone
1) Put the files Adb and AdbWinApi.dll from the tools folder in the Android SDK into C:\WINDOWS\System32 folder on your PC. Substitute the correct drive letter if windows is not installed on you C: drive
2) Put the Windows Fastboot.exe into the C:\WINDOWS\System32 folder on your PC
3) Create a folder on the C: drive of your PC called android. The path should be C:\Android.
4) Copy the Nandroid backup files data.img, system.img, and boot.img from your SD card to the folder called Android you created by mounting your SD card as removable disk.
5) Unplug the USB cord and power off your phone
6) Power up your phone by holding CAMERA+POWER, you should see three androids on skateboards. If you don't see this go install the Engineering boot loader
7) Plug the USB cord back into your phone and press back. The screen on your phone should say fastboot.
8) Make sure your pc is using the correct driver. Open the device manager on your pc. It is helpfull to have all other USB storage devices besides your phone unplugged for this part. Look for a USB Mass Storage device in the list of the USB devices. Right click on it and update the driver. Pick the option to browse for a driver on your pc. The driver is located in the Android SDK your downloaded in the folder called usb_driver. If this is done right you will now see a device called HTC Dream
9) Press start, go to run and type cmd (If you are on Vista just type cmd in the search box and hit enter). The command prompt will pop up.
10) Type cd C:\android
then enter the following commands:
fastboot flash system system.img
it will say Sending, then writing and say OKAY if it was successful
then type
fastboot flash userdata data.img
wait for the second OKAY and type
fastboot flash boot boot.img
wait for the second OKAY and type
fastboot reboot
Your phone should now be restored exactly as you had it when it was backed up.
This sounds great! I just recently used the other script to make a backup, but this sounds like it's been a bit more polished
I attempted to compile the yaffs2 utils under OS X 10.5 and I encountered a problem during linking:
ln -s ../yaffs_ecc.c yaffs_ecc.c
gcc -c -I/usr/include -I.. -O2 -Wall -DCONFIG_YAFFS_UTIL -Wshadow -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -Wredundant-decls -Wnested-externs -Winline -static yaffs_ecc.c -o yaffs_ecc.o
gcc -c -I/usr/include -I.. -O2 -Wall -DCONFIG_YAFFS_UTIL -Wshadow -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -Wredundant-decls -Wnested-externs -Winline -static mkyaffsimage.c -o mkyaffsimage.o
mkyaffsimage.c:120: warning: ‘yaffs_CalcNameSum’ defined but not used
gcc -o mkyaffsimage yaffs_ecc.o mkyaffsimage.o
ld: absolute addressing (perhaps -mdynamic-no-pic) used in _process_directory from mkyaffsimage.o not allowed in slidable image
collect2: ld returned 1 exit status
make: *** [mkyaffsimage] Error 1
Any thoughts? I'm heading off to google to figure out what a 'slidable image' is.
-jwb
No idea, and I don't have access to a mac. You could change the makefile and skip compiling of mkyaffsimage, you only need mkyaffs2image, but you'll probably get similar errors.
infernix said:
No idea, and I don't have access to a mac. You could change the makefile and skip compiling of mkyaffsimage, you only need mkyaffs2image, but you'll probably get similar errors.
Click to expand...
Click to collapse
Google seems to imply its a common issue, possibly solved in a later XCode rev.. We'll see how that pans out.
mkyaffs2image on mac
It built just fine for me when I did the whole mydroid build. It's in out/host/darwin-x86/bin.
Is there some way to mount the yaffs2 image, though? Does one need to do the kernel patch etc on a linux box and then use loop?
Wow this a awesome. Thanks for all the hard work everyone.
you are are ridiculous.....ly good!
so you telling me if we have root and jf's modified rc30 v1.2 and be brick our phone, there's another quarter in your pocket after you die (game over) and you can start a whole new game?
hbguy
hbguy said:
so you telling me if we have root and jf's modified rc30 v1.2 and be brick our phone, there's another quarter in your pocket after you die (game over) and you can start a whole new game?
Click to expand...
Click to collapse
If you have flashed the engineering bootloader (the androids on skateboards appear when powering on your phone while holding camera button), yes.
haha very nice ::borat voice::
P.S. For the borat fans out there, he is making a new movie, insider info baby
hbguy!
Error messages but still makes backups?
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
error: device not found
start adb portforward on port 4531
error: device not found
checking free space on cache
error: device not found
./nandroid.sh: line 152: [: -le: unary operator expected
pushing tools to /cache: dump_image-arm... error: device not found
done
Getting md5sum on device for boot...error: device not found
done ()
Dumping boot from device over tcp to backup_2008-12-19//boot.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for boot.img
Getting md5sum on device for recovery...error: device not found
done ()
Dumping recovery from device over tcp to backup_2008-12-19//recovery.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for recovery.img
Getting md5sum on device for misc...error: device not found
done ()
Dumping misc from device over tcp to backup_2008-12-19//misc.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for misc.img
Getting md5sum on device for tar for system...error: device not found
done ()
Dumping tar file for system backup_2008-12-19//system.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for system.tar
To convert system.tar to system.img, run the following commands as root:
mkdir /tmp/-system-tmp
tar x -C /tmp/-system-tmp -f backup_2008-12-19//system.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-system-tmp/system backup_2008-12-19//system.img
Make sure that /tmp/-system-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for data...error: device not found
done ()
Dumping tar file for data backup_2008-12-19//data.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for data.tar
To convert data.tar to data.img, run the following commands as root:
mkdir /tmp/-data-tmp
tar x -C /tmp/-data-tmp -f backup_2008-12-19//data.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-data-tmp/data backup_2008-12-19//data.img
Make sure that /tmp/-data-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for cache...error: device not found
done ()
Dumping tar file for cache backup_2008-12-19//cache.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for cache.tar
To convert cache.tar to cache.img, run the following commands as root:
mkdir /tmp/-cache-tmp
tar x -C /tmp/-cache-tmp -f backup_2008-12-19//cache.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-cache-tmp/cache backup_2008-12-19//cache.img
Make sure that /tmp/-cache-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
removing tools from /cache: dump_image-arm... error: device not found
done
unmounting system and data on device
error: device not found
error: device not found
Backup successful.
brocktice said:
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
[/QUOTE]
This didn't work at all.
What I don't really get is that it continues at all, if the device isn't connected it should not even start.
It's a bit hard to tell because I don't have a mac here. Please run the following commands on your mac and post them:
[code]which adb
adb devices
BLAH=foo
echo "without $BLAH"
echo "with ${BLAH}"
I'll look at this soon, should have access to a mac sometime in the next few weeks
Click to expand...
Click to collapse
brocktice said:
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
error: device not found
start adb portforward on port 4531
error: device not found
checking free space on cache
error: device not found
./nandroid.sh: line 152: [: -le: unary operator expected
pushing tools to /cache: dump_image-arm... error: device not found
done
Getting md5sum on device for boot...error: device not found
done ()
Dumping boot from device over tcp to backup_2008-12-19//boot.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for boot.img
Getting md5sum on device for recovery...error: device not found
done ()
Dumping recovery from device over tcp to backup_2008-12-19//recovery.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for recovery.img
Getting md5sum on device for misc...error: device not found
done ()
Dumping misc from device over tcp to backup_2008-12-19//misc.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for misc.img
Getting md5sum on device for tar for system...error: device not found
done ()
Dumping tar file for system backup_2008-12-19//system.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for system.tar
To convert system.tar to system.img, run the following commands as root:
mkdir /tmp/-system-tmp
tar x -C /tmp/-system-tmp -f backup_2008-12-19//system.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-system-tmp/system backup_2008-12-19//system.img
Make sure that /tmp/-system-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for data...error: device not found
done ()
Dumping tar file for data backup_2008-12-19//data.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for data.tar
To convert data.tar to data.img, run the following commands as root:
mkdir /tmp/-data-tmp
tar x -C /tmp/-data-tmp -f backup_2008-12-19//data.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-data-tmp/data backup_2008-12-19//data.img
Make sure that /tmp/-data-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for cache...error: device not found
done ()
Dumping tar file for cache backup_2008-12-19//cache.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for cache.tar
To convert cache.tar to cache.img, run the following commands as root:
mkdir /tmp/-cache-tmp
tar x -C /tmp/-cache-tmp -f backup_2008-12-19//cache.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-cache-tmp/cache backup_2008-12-19//cache.img
Make sure that /tmp/-cache-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
removing tools from /cache: dump_image-arm... error: device not found
done
unmounting system and data on device
error: device not found
error: device not found
Backup successful.
Click to expand...
Click to collapse
I had this problem too but disconnecting and reconnecting the usb cable fixed it.
SplasPood said:
I had this problem too but disconnecting and reconnecting the usb cable fixed it.
Click to expand...
Click to collapse
Well the script is supposed to check for a device and stop when theres a problem.
also if this can happen at all then other things might go wrong on mac too. I think mac requires bash variables to be called like #{VAR} and doesn't handle $VAR for some reason.
update on mac issues
OK, it seems it was all a problem on my end -- didn't have the correct set-up. I now have the appropriate recovery image (thought I did, but I guess I didn't) and it seems to work, except for this:
Code:
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
The images and such now have non-zero filesize, though. That's an improvement over before.
yeah i've gotten some more reports. will make it mac OS X compatible soonish
I can't seem to figure out how to get this to work. If someone who knows linux can IM me, that'd be great. (or is there a way to do this on XP?)
AIM:adventninja
Thanks in advance
Does this also back up radio and htc secure nand partitions?
tranks
backed up successfully.
for those who get errors in the script.
i assume you have installed modiffied recovery image + jesusfreke's rc30v2 and
before running the script check this.
this steps involves having linux i dont know how its done in windows maybe its the same i dont know.
1: disconnect usb cable
2: check that you have adb program in your path, eg: /usr/bin/adb
if you dont know what adb is, adb is a program to comunicate with phone via usb (its not the same as transfering files between pc and g1),
adb program is found in android-sdk-linux_x86-1.0_r2, unpack it, and copy adb to your path, just google and find latest android sdk.
once you downloaded sdk unpacked it and copied the executable file adb to /usr/bin go to next step.
3: boot the phone into recovery mode ( power up the phone and holding "power + home" keys and a triangle will appear on its screen.
4: in your pc open konsole, su root, and plug your USB G1
5: type adb devices
if the response to this command is "HTC G1 bla bla.. found.", then you are ready to execute the script, it will no give errors and you will backup its contents.
if you dont see HTC G1 words, then its likely your phone was detected as "USB MASS STORAGE", and we dont want that. we need that its detected as a "HTC DIRECT ACCESS DEVICE".
a: control +c
b: killall adb (this is important)
c: unplug USB, plug it in another port,
d: go to step 5
hope it helps.
infernix said:
* What is Nandroid Backup v2.0?
Nandroid Backup is a set of tools and a script that will enable anyone who has root on their G1 and has the engineering/dev spl bootloader [1] (or has a dev phone) + a recovery image with busybox and adbd running as root [2] to make full system backups. These can then be restored using the fastboot [3] commandline tool and your phone in SPL/bootloader mode (hold camera + power). This allows you to create regular backups of your entire phones NAND flash so that you can restore a backup when something breaks. Its backup method works on a level that allows you to completely break, wipe or corrupt any or all partitions and still restore the phone to a working state within a few minutes. This works great for those who use their G1 for normal activities but also want to test their ideas which might break the phone, or when not having an extra G1 to keep purely as a development phone.
* Requirements for use
- Android G1 phone in recovery mode with busybox installed, including appropriate symlinks to at least tar and md5sum, as well as 'adb shell' support running as root. I recommend using JesusFreke US RC30 or UK RC8 v1.2 recovery image. You can flash the RC30 v1.2 recovery.img on your G1 if you don't want to bother constructing your own image. Of course you are free to use your own recovery image and it will work if you set it up correctly.
- dump_image-arm and mkyaffs2image|mkyaffs2image-$ARCH compiled in the current dir, as well as root on a linux/mac (POSIX) machine for constructing system and data images. root is required because the uid, gid and file permissions need to be preserved while extracting and creating the yaffs2 images. You are free to run the script as a normal user and then run the appropriate commands yourself as root; the commands are printed when you run the script as a regular user.
If you don't trust the provided binaries, you are free to compile them yourself. The source for the tools are included. For dump_image, edit nandtools/android-imagetools/Makefile so that you use the proper cross compiling gcc. For mkyaffs2img, just running make in tartools/yaffs2/utils/ should give you a binary. You are on your own in getting stuff compiled, but it should be easy to figure out from the Makefile.
* How to use this (the easy part)
Just boot your phone in recovery mode with the correct recovery.img (one that has adb shell as root + busybox installed with symlinks to tar, md5sum etc) and connect it to your pc/laptop/server. Then run the nandroid.sh script. If something is wrong or missing, it will tell you.
* What about restore?
If you have the dev phone or have root on the G1 and flashed the engineering/dev bootloader, then you can power on your phone while holding camera to get into the bootloader/SPL. It should then show some androids on skateboards (if not, you don't have the engineering/dev bootloader). Plug in your USB cable and push back until it says FASTBOOT instead of Serial0. Now you can fire up fastboot flash {partition} {file.img}.
Fastboot itself is part of the android SDK. If you download and compile your own mydroid build, it should sit in mydroid/out/host/linux-x86/bin/fastboot Perhaps in a future version I'll include a restore script, but for now I don't see the need.
One tip, if you are in fastboot mode on your phone and 'fastboot devices' doesn't show anything, try as root. You might need to edit your udev setup to allow your user to access the phone's usb device (which is different from the one you're in when in recovery or normal boot).
* Where's the source?
Sources are included. They are copies of the Android sources with various changes mostly made by Brainaid.
Everything in the zip is also also available through subversion:
svn co http://svn.infernix.net/nandroid/
Note that I DO NOT recommend checking out the latest revision unless you know damn well what you are doing. No guarantees if you play with fire. At the very least do diff against the latest released version.
* Credits
Bash script hacked together by infernix.
dump_image adapted from flash_image and extended by Brainaid.
Original mtdutils source and mkyaffs2image source by Google.
[1] http://forum.xda-developers.com/showthread.php?t=455860
[2] http://forum.xda-developers.com/showthread.php?t=443713
[3] http://www.gotontheinter.net/fastboot
DOWNLOAD HERE or:
wget http://dx.infernix.net/nandroid-2.0.zip
Click to expand...
Click to collapse
hey infernix, did you happen to get a mac version of this together? thanks!
I've been unsuccesfully searching the forum for a zipfile containing the stock recovery for the TF101/nvflash/install script. Can someone help me find or get it ?
You can download the stock firmware from the ASUS website- unzip it, unzip it again, then use the blobunpack tools on the juicy blob it contains. The blob.SOS will be the stock recovery which can be flashed directly with nvflash. And by directly, I mean after a little editing of the flash.cfg file to point the SOS partition to your recently unblob'ed SOS file.
So after you flash all that, be advised that the stock recovery has the stock kernel that matches the ROM. This might be incompatible with your bootloader and have side effects such as bootloops, memory loss, nausea, constipation, and bootloops.
Thanks ! about your warning: say I've got an installed 8.6.5.21 and rooted it and installed CWM and then I do what you said and unblob the 8.6.5.21 firmware zip, won't I then have the correct bootloader ?
I would most likely say yes, but it all depends on how you got your 8.6.5.21 rom. If you rooted it using a pure root method like brk's or moshi's method, from a stock 8.6.5.21, then it's the stock bootloader for 8.6.5.21. If you used nvflash to erase and flash, then the bootloader will probably be whatever nvflash used- usually bootloader.bin that is in the zip with it. If you flashed a rooted 8.6.5.21 zip, it might have flashed the EBT as well, but this isn't always the case.
To make it more complex, there are two kernels on your TF- one in the LNX partition (boot.img) and one in the SOS (recovery).
The bootloops aren't well understood, so matching them might not make a difference. If you have access to nvflash, it's not that big a deal since you can simply reflash. If you have a later model, be careful since there aren't any second chances.
So, how did you get to the 8.6.5.21 rom?
Ohh, you can check you bootloader version by turning off your tf and then booting into recovery (power and volume down). The bootloader version will be in the white text at the top of the screen.
sent from my cyanogen(mod) vision
Fortunately I can use nvflash since my serial starts with B50.
I used the 8.6.5.13 zip that contains nvflash and download.bat first and used APX and ran the download.bat. Then I upgraded to 8.6.6.19 and rooted with Razorclaw. Then I updated to 8.6.5.21
Does that make sense to you to determine what bootloader I got ? Another problem that I got is that I have windows PCs here only and I don't know how I can compile the blobtools on a windows pc.
gee one said:
Ohh, you can check you bootloader version by turning off your tf and then booting into recovery (power and volume down). The bootloader version will be in the white text at the top of the screen.
sent from my cyanogen(mod) vision
Click to expand...
Click to collapse
8.6.6.19-20111101
is that helpful ?
That's great. I suppose you could try the stock recovery with the 8.6.5.21 kernel. The worse that will happen is that you will have to reflash another recovery. Plus, your 8.6.5.21 rom seems to be doing fine.
I have no idea how to compile with windows, but lucky for you there are pre-compiled versions of the tools. I haven't used them for windows, but I suppose they would have some instructions. You'll probably have to use them from the command line or maybe powershell?
https://github.com/AndroidRoot/BlobTools/downloads
the nvflash ccommands will be something like this:
You probably don't have to change the flash.cfg file since you aren't using the --create command. Also, bootloader.bin is probably fine as is since it won't write this either. In the second nvflash command, the 5 indicates that you want to write the SOS partition. This corresponds to the id # in the flash.cfg file.
Code:
nvflash.exe --bct transformer.bct --setbct --configfile flash.cfg --bl bootloader.bin --odmdata 0x300d8011 --sbk 0x1682CCD8 0x8A1A43EA 0xA532EEB6 0xECFE1D98 --sync
nvflash.exe --resume --download 5 /path/to/your/blob.SOS
nvflash.exe --resume --go
good luck!
Thanks for your help. In about half an hour its bedtime for me an coming days I have no time for my own things so it will be a few days before I will try out what you said. I had already searched for the windows binaries but couldnt find them so thanks !
Hello gee one !
i have nearly the same problem and I hope you can help me...but my englisch is poor, so please be patient.
I had to go back from revolverrom to StockWWE-rom (because of warranty). I ( hope) had unroot my devive with brk´s files .
I am not shure the way i rooted it in the pas,t but i think it was with the brk also.
i have Clockwork Recovery 3.2.0.1-roach2010-tf101-r11 and bootloader8.6.5.13 2011.09.25- hope this information is helpfull.
Witch steps had i to do to have all stock?
can i take brktool rootkit7.1 and the option restore backup / restore preverious backup-boot recovery+system ?
then i use /select the downloaded stockrom wwe from asus webside .?
Or am i wrong?
Kind regards
gandalf
(My model is a B60)
I have an opinion about unrooting for warranty purposes- either live with it or know how to unroot before you root. If your rooting method had said that it was not possible to unroot so your warranty would be irrevocably void, would you still have rooted your tf?
yes , i prove it- it is still rooted.
But i have another (maybe for the same reason) problem: ican´t wipe data -factory reset with clockwork mod.
the message: error removing data/system /packages.
-And i think thats also the reason for the freeze+ bootloops if i flash a custom-rom.
Kind regards
gandalf
by the way- i trie to find out the rootng method-
nvflash usage
Hi,
gee one said:
You probably don't have to change the flash.cfg file since you aren't using the --create command. Also, bootloader.bin is probably fine as is since it won't write this either. In the second nvflash command, the 5 indicates that you want to write the SOS partition. This corresponds to the id # in the flash.cfg file.
Code:
nvflash.exe --bct transformer.bct --setbct --configfile flash.cfg --bl bootloader.bin --odmdata 0x300d8011 --sbk 0x1682CCD8 0x8A1A43EA 0xA532EEB6 0xECFE1D98 --sync
nvflash.exe --resume --download 5 /path/to/your/blob.SOS
nvflash.exe --resume --go
Click to expand...
Click to collapse
Thanks gee one for the nice tip (not tried yet).
I'm in a similar situation. Is there some documentation on nvflash (command line arguments and configuration file)?
Mikael
McKael said:
Hi,
Thanks gee one for the nice tip (not tried yet).
I'm in a similar situation. Is there some documentation on nvflash (command line arguments and configuration file)?
Mikael
Click to expand...
Click to collapse
There isn't a lot of documentation. I think you basically have to take a few things apart to see what is going on. Other devices use it too, so broaden your search to include the xoom, the galaxy tab, notion ink?, or anything else that uses the tegra 2. Once you see a few commands, you see what it does.
There is a paragraph at the end of this:
http://androidroot.mobi/2011/06/13/nvflash-on-asus-transformer/
I think nvidia has or had some flash tools on their developer website and you can check out some of the other forums for gamers and overclockers that might use nvflash to flash their gpus.
Also, there is a secret document hidden in the tool itself that I extracted by typing "nvflash --help"
Code:
Nvflash started
nvflash action [options]
action (one or more) =
--help (or -h)
displays this page
--cmdhelp cmd(or -ch)
displays command help
--resume (or -r)
send the following commands to an already-running bootloader
--quiet (or -q)
surpress excessive console output
--wait (or -w)
waits for a device connection (currently a USB cable)
--create
full initialization of the target device using the config file
--download N filename
download partition filename to N
--setboot N
sets the boot partition to partition N
--format_partition N
formats contents of partition N
--read N filename
reads back partition N into filename
--getpartitiontable filename
reads back the partition table into filename
--getbit filename
reads back BIT into filename
--getbct
reads back the BCT from mass storage
--odm C Data
ODM custom 32bit command 'C' with associated 32bit data
--go
continues normal execution of the downloaded bootloader
options =
--configfile filename
indicates the configuration file used with the following commands:
--create, --format_all
--bct filename
indicates the file containing the BCT
--sbk 0x00000000 00000000 00000000 00000000
indicates the secure boot key for the target device
--bl filename
downloads and runs the bootloader specified by filename
--odmdata N
sets 32bit customer data into a field in the BCT, either hex or
decimal
--diskimgopt N
sets 32bit data required for disk image convertion tool
--format_all
formats all existing partitions on the target device using the config file,
including partitions and the bct
--setbootdevtype S
sets the boot device type fuse value for the device name.
allowed device name string mentioned below:
emmc, nand_x8, nand_x16, nor, spi
--setbootdevconfig N
sets the boot device config fuse value either hex or decimal
--verifypart N
verifies data for partition id = N specified. N=-1
indicates all partitions
Intended to be used with --create command only.
--setbct
updates the chip specific settings of the BCT in mass storage to
the bct supplied,used with --create, should not be with --read,and
--format(delete)_all,format(delete)_partition,--download, and--read
--sync
issues force sync commad
--rawdeviceread S N filename
reads back N sectors starting from sector S into filename
--rawdevicewrite S N filename
writes back N sectors from filename to device starting from sector S
Thanks for your answer, much appreciated.
I did some research but finding specific stuff isn't easy at all
gee one said:
There isn't a lot of documentation. I think you basically have to take a few things apart to see what is going on. Other devices use it too, so broaden your search to include the xoom, the galaxy tab, notion ink?, or anything else that uses the tegra 2. Once you see a few commands, you see what it does.
There is a paragraph at the end of this:
...
Click to expand...
Click to collapse
Thanks, I had seen the page but I missed this paragraph.
gee one said:
Also, there is a secret document hidden in the tool itself that I extracted by typing "nvflash --help"
Code:
...
--setbct
updates the chip specific settings of the BCT in mass storage to
the bct supplied,used with --create, should not be with --read,and
--format(delete)_all,format(delete)_partition,--download, and--read
Click to expand...
Click to collapse
The help says the --setbct command shouldn't be used along with --download, is that the reason why you used 3 steps (3 commands)?
Mikael
No, that's more of a suggestion, as far as I can tell. It's more like read shouldn't be used with create. Setbct won't do much without create.
Info is pretty spare, I suggest backing up your data and then get flash happy. Get your hands dirty and after a few bootloops, you'll figure it out.
sent from my cyanogen(mod) vision
gee one said:
No, that's more of a suggestion, as far as I can tell. It's more like read shouldn't be used with create. Setbct won't do much without create.
Info is pretty spare, I suggest backing up your data and then get flash happy. Get your hands dirty and after a few bootloops, you'll figure it out.
Click to expand...
Click to collapse
Ok, I'll give it a try!
BTW, on a B60 TF101 Transformer is it relatively safe to play with nvflash? (In other words, should I still be able to reflash everything with nvflash even if I break everything up?)
Mikael
Based on info from the internet, you should have access to nvflash with your b60. There is an unbricking thread in development.
sent from my cyanogen(mod) vision
McKael said:
Ok, I'll give it a try!
Mikael
Click to expand...
Click to collapse
Well... FYI it worked perfectly. Everything looks right now and I was able to apply the latest OTA ICS update.
(What I'm wondering is why my attempts from Android itself, using dd, were not successful.)
And, for the record, there are useful information there:
http://www.cyber.com.au/~twb/doc/tf101.html
Thanks again gee one!
Mikael
Hi, I want to (re-)flash the stock 4.1.2 rom on my Photon Q, because I recently run into some problems of the phone sending messages to the number 8737 even after I had removed the stock sms app.
This should be the right rsd file:
Code:
asanti_c_sprint-user-4.1.2-9.8.2Q-122_XT897_FFW-5-6-release-keys-cid9.xml.zip (MD5: 88f43a03d313bbcc262db78f15ac957c)
I'm on linux and I don't have any Windows system I could install and run RSDLite on. So I decided to take the fastboot way: I unzipped the above file and tried flashing the rom manually. But I always run in to the following error output:
Code:
# fastboot flash cdrom cdrom
(bootloader) Variable not supported!
target reported max download size of 31457280 bytes
Invalid sparse file format at header magi
error: write_sparse_skip_chunk: don't care size 22923264 is not a multiple of the block size 4096
fastboot: ../libsparse/sparse.c:143: write_all_blocks: Assertion `pad >= 0' failed.
Note that "fastboot devices" lists the Photon Q as "T069503UAP fastboot". The same or a similar error messages applies to "fastboot flash system system.img" etc. I use fastboot from the Fedora 20 "android-tools" package (version 20130123git98d0789-2).
Any ideas what's the problem here? Solution?
Thanks in advance!
It's dangerous to try and fastboot the items yourself. Would be better to borrow a Windows PC or something to use RSD (virtual machines are also NOT recommended for this).
But perhaps you should just try to fastboot the other partitions. Not sure 'cdrom' is needed. Either way, I strongly, STRONGLY advise against doing what you are doing.
Okay, thanks for your advice!
The same or similar error messages appear when flashing the other partitions (as already mentioned in the first post). Unfortunately, it's really hard to find somebody with a Windows system, at the moment. I thought RSDLite uses fastboot internally anyway.
I'm not sure if the FXZ images can be flashed as they are, via fastboot.
I believe they should be converted to the standard ext4 format via the simg2img.py pytoon script, before being usable.
I repeat I'm not sure, but I believe that hardly motorola's own format is handled correctly by the fastboot command.
Whatever, for your convenience, I attach the mentioned converter script.
Aside fastboot, can be used for a variety of other purposes, the ext4 images can be mounted straight in Linux via loopback device or extracted in windows with a bunch of tools, personally I use Ftk Imager.
Thanks, that tool is great! After conversion, I was indeed able to mount the system partition as follows:
Code:
# mount -o ro,loop system_converted.img /some/mnt/path
But it doesn't help with the other files (cdrom, boot.img, recovery.img), because they seem to have a different format. However, the system partition was all I wanted. Now, instead of reflashing, I'm going to compare the system partition's files (especially in the "app" folder) and see what might have caused my problem.
tuxor1337 said:
But it doesn't help with the other files (cdrom, boot.img, recovery.img),
Click to expand...
Click to collapse
The boot, recovery and similar partitions aren't written on top of a filesystem like /system or /data.
they are written as they are on top of the physical media.
you can safely flash them in any way: fastboot, restore by recovery and so on.
unlike the filesystem based partitions, they are always in the same format.
If you need to edit the boot or recovery content you need a special script to unpack and repack them, many android kitchens have it
I was just wondering whether flashing on Linux will work when using "moto fastboot" like this one: http://forum.xda-developers.com/showthread.php?t=1138092
I don't really need this functionality anymore. But out of curiosity: What do you think?
My photon has a broken USB connector, so I can't test it in first person.
Btw, I believe that testing is the only way to understand what is flashable and what not, obviously taking handy a good full nandroid backup.
Good afternoon-
I recently picked up a NVIDIA Shield from a friend of mine because it would not turn back on for him. It is currently stuck at the NVIDIA Boot screen. I can access the Bootloader and I can access stock recovery. However, when I attempted to use Fastboot to unlocked the bootloader I receive the below...
(bootloader) Showing Options on Display.
(bootloader) Use device keys for selection.
(bootloader) erasing userdata...
(bootloader) erasing userdata done
(bootloader) erasing cache...
(bootloader) erasing cache done
(bootloader) unlocking...
FAILED (remote: ()
finished. total time: 3.872s
I am using "Fastboot OEM Unlock" and it does prompt me on the Shield to unlock, but once I select unlock it bounces right back to the bootloader and fails. I tried wiping data and factory reset via stock recovery, but when I do I receive an E: Failed to Mount /Cache (Invalid Argument). It will not let me read/write any of my user data files at all. It seems as if they are corrupt, but I am not quite sure.
I am looking for a way to get this thing back up and running. I am perfectly fine with losing all data on it. Is there a stock kernal that I can flash with a locked bootloader? I fear the issue is with the bootloader or corrupted EMMC. I am open to any and all suggestions!
Make sure that your USB cable is plugged into a USB 2.0 port directly connected to your motherboard as sometimes USB 3.0 ports can cause problems and front panel USB connections can be unreliable.
from: https://forum.xda-developers.com/showthread.php?t=2399737
In case it is interesting, (if someone get managed) it should be possible to boot into twrp recovery with locked bootloader.
- Linux only - (I have not tested and can not confirm if this works. maybe i have a thinking blunder)
first we need a u-boot from another unlocked (similar) device (not sure about size?)
Code:
dd if=/dev/mmcblk0boot0 of=u-boot-dtb-tegra.bin bs=1048576 count=1
second we can boot this u-boot without flashing
Code:
tegra-uboot-flasher exec u-boot-dtb-tegra.bin
third we can boot twrp from fastboot
Code:
fastboot boot twrp-3.3.1-0-shieldtablet.img
Pre-requisites
you need to create your own cbootimage-config
https://github.com/NVIDIA/cbootimage-configs/tree/master/tegra124/nvidia
Adding Board Support
====================
If that doesn't work out, you may create the required configuration files
using the following process:
1)
Extract the BCT from the existing device. Various methods exist to do this:
1a)
Recent versions of tegrarcm now have the capability to read the BCT from the
device without requiring any HW-specific binaries, nor code already installed
on the device:
tegrarcm --bct board.bct readbct
1b)
If you have access to Linux running on the device already, then you can use
dump the memory device directly:
For devices which boot from eMMC:
dd if=/dev/mmcblk0boot0 of=bct.bin bs=65536 count=1
For devices which boot from SPI:
dd if=/dev/mtd0ro of=bct.bin bs=65536 count=1
1c)
If you have a working nvflash for your device, then this can also extract the
BCT:
nvflash --bl fastboot.bin --getbct --bct board.bct
If that doesn't work, you could try reading the content of the BCT partition
or the start of the raw device, then extracting the BCT:
nvflash --bl fastboot.bin --read 2 board.bct
or:
nvflash --bl fastboot.bin --rawdeviceread 0 128 board.bct
Note that some of the above commands extract many more bytes of data that is
strictly required. However, this avoids updating these instructions for each
new chip; Tegra20's BCT is just under 4KiB, Tegra30's around 6KiB, etc.
2)
Convert the BCT to a cbootimage configuration file:
bct_dump board.bct > board.bct.cfg
This will de-compile the extracted BCT binary into a text configuration file
suitable for later use by cbootimage.
To follow the same structure as the rest of the configuration files in this
project, it's then best to split up board.bct.cfg into separate board.bct.cfg
(DevType, DeviceParam, and SDRAM lines), and board.img.cfg (all other header
parameters). Use the existing configuration files as a guide.
Once you have performed these steps, you will have configuration files
suitable for your personal use. We don't accept contributions to this project
that were derived in this fashion. We encourage you to contact the vendor
and request them to submit their own configuration files.
Click to expand...
Click to collapse
tegra-uboot-flasher
https://github.com/NVIDIA/tegra-uboot-flasher-scripts
Introduction
============
This project provides scripts and data that provide a simple way of using
tegrarcm and U-Boot to write U-Boot (or an alternative image) to the boot
flash of a Tegra device.
The flash images handled by this tool include just the bootloader and any
other data necessary for the bootloader to execute (i.e. the BCT). Creating or
flashing a root filesystem, either on the Tegra device's built-in flash, or on
external storage media, is a separate step unrelated to this tool.
Pre-requisites
==============
This document assumes that the instructions in README-developer.txt have
already been followed. Those instructions generate various files that the
flashing process uses. These include host-based utilities such as tegrarcm,
U-Boot binaries that run on the Tegra target device, and the flash images to
write to the Tegra device.
If you are using a distribution package of this tool, the development steps
have likely already been followed, and you need only follow the instructions
in this file.
If you are working with the source code to this tool, you almost certainly
need to follow the instructions in README-developer.txt first.
Board Configurations
====================
Every Tegra board design has a name. Examples are Harmony or Cardhu.
Each board may exist in a number of different configurations; perhaps the
RAM size or speed varies, or a different type of boot flash is supported.
Each of these configurations is also given a name. tegra-uboot-flasher's
user-interface uses these configuration names exclusively. Examples are
harmony, cardhu-a02-1gb, cardhu-a04-1gb.
You may find a list of valid values for configname by executing:
tegra-uboot-flasher list-configs
Simple Usage - Flashing
=======================
To flash a board, connect a USB cable from your host PC to the Tegra device,
place that board into USB recovery mode, and execute the following as root
on the host machine:
tegra-uboot-flasher flash CONFIG
This will download code and data to the Tegra device and execute a flashing
routine. Once this is complete, the system will reboot into the freshly
flashed boot image, and the system will proceed to boot normally. Depending
on the board and U-Boot support, the flashing process may be observed via the
debug serial port, or on a built-in LCD panel.
Simple Usage - Testing U-Boot
=============================
If you simply want to download an unmodified U-Boot to the Tegra device and
execute it, execute the following as root on the host machine:
tegra-uboot-flasher exec CONFIG
This can be useful for quickly testing changes to U-Boot without writing it
to flash every time. This mode of operation is a very simple wrapper around
tegrarcm, which eliminates the need to remember which BCT to use for each
board configuration.
Advanced Options
================
A number of command-line options exist to control tegra-uboot-flasher's
behaviour. For example, you may specify an alternate image to be written
to boot flash, load configuration data from an alternate location, save
the temporary files created during execution for later analysis, etc.
Execute tegra-uboot-flasher with the --help option to see a description
of these options.
Click to expand...
Click to collapse