Hi, after some my tests I sucesfully runing photon wince rom in my aria android phone. But I done it using jtag, so I opening this thread for devs that is interested for creating software based flasher without using jtag! If someone have asm, c ...etc knownledge please help here! After geting aria flash back to phone I catched some logs from my box that is comunicated with aria procesor and I want to share it here. Nand config writing log:
Code:
T0BAC 002:778 JLINK_Halt()
T0BAC 002:870 JLINK_WriteU32(0xA900026C, 0x00000009)
T0BAC 002:879 JLINK_WriteU32(0xA0B00000, 0x00000000)
T0BAC 002:880 JLINK_WriteU32(0xA0A00000, 0x0000000B)
T0BAC 002:881 JLINK_WriteU32(0xA0A00010, 0x00000001)
T0BAC 002:882 JLINK_ReadMemU32(0xA0A00014, 0x0001 Items, ...) - Data: 0x00003020
T0BAC 002:884 JLINK_ReadMemU32(0xA0A00040, 0x0001 Items, ...) - Data: 0x5500BCEC
T0BAC 002:892 JLINK_ReadMemU32(0xA0A00020, 0x0001 Items, ...) - Data: 0xAB5400C0
T0BAC 002:894 JLINK_ReadMemU32(0xA0A00024, 0x0001 Items, ...) - Data: 0x000B0477
T0BAC 002:896 JLINK_ReadMemU32(0xA0A00020, 0x0001 Items, ...) - Data: 0xAB5400C0
T0BAC 002:898 JLINK_ReadMemU32(0xA0A00024, 0x0001 Items, ...) - Data: 0x000B0477
T0BAC 002:900 JLINK_ReadMemU32(0xA0A00024, 0x0001 Items, ...) - Data: 0x000B0477
T0BAC 024:448 JLINK_WriteU32(0xA0A00000, 0x0000000B)
T0BAC 024:450 JLINK_WriteU32(0xA0A00004, 0x4AC80000)
T0BAC 024:451 JLINK_WriteU32(0xA0A00008, 0x00000000)
T0BAC 024:452 JLINK_WriteU32(0xA0A0000C, 0x00000004)
T0BAC 024:453 JLINK_WriteU32(0xA0A00010, 0x00000000)
T0BAC 024:454 JLINK_WriteU32(0xA0A00014, 0x00003020)
T0BAC 024:455 JLINK_WriteU32(0xA0A00018, 0xFFFF0000)
T0BAC 024:456 JLINK_WriteU32(0xA0A0001C, 0x00000020)
T0BAC 024:457 JLINK_WriteU32(0xA0A00020, 0xAA5400C0)
T0BAC 024:458 JLINK_WriteU32(0xA0A00024, 0x000A7476)
T0BAC 024:461 JLINK_WriteU32(0xA0A00028, 0x00000000)
T0BAC 024:462 JLINK_WriteU32(0xA0A0002C, 0x00000000)
T0BAC 024:464 JLINK_WriteU32(0xA0A00030, 0xAAD4001A)
T0BAC 024:466 JLINK_WriteU32(0xA0A00034, 0x002101BD)
T0BAC 024:468 JLINK_WriteU32(0xA0A00038, 0x00000000)
T0BAC 024:470 JLINK_WriteU32(0xA0A0003C, 0x00000000)
T0BAC 024:472 JLINK_WriteU32(0xA0A00040, 0x5500BCEC)
T0BAC 024:474 JLINK_WriteU32(0xA0A00044, 0x00000000)
T0BAC 024:475 JLINK_WriteU32(0xA0A00048, 0x00000000)
T0BAC 024:477 JLINK_WriteU32(0xA0A0004C, 0x00000000)
T0BAC 024:479 JLINK_WriteU32(0xA0A00050, 0x00000000)
T0BAC 024:481 JLINK_WriteU32(0xA0A00054, 0x00000000)
T0BAC 024:483 JLINK_WriteU32(0xA0A00058, 0x00000000)
T0BAC 024:485 JLINK_WriteU32(0xA0A0005C, 0x00000000)
T0BAC 024:487 JLINK_WriteU32(0xA0A00060, 0x00000000)
T0BAC 024:489 JLINK_WriteU32(0xA0A00064, 0x00000000)
T0BAC 024:492 JLINK_WriteU32(0xA0A00068, 0x00000000)
T0BAC 024:494 JLINK_WriteU32(0xA0A0006C, 0x00000000)
T0BAC 024:496 JLINK_WriteU32(0xA0A00070, 0x04E00480)
T0BAC 024:498 JLINK_WriteU32(0xA0A00074, 0x49F04999)
T0BAC 024:500 JLINK_WriteU32(0xA0A00078, 0x85E08580)
T0BAC 024:502 JLINK_WriteU32(0xA0A0007C, 0xC400C400)
T0BAC 024:504 JLINK_WriteU32(0xA0A00080, 0xC000C000)
T0BAC 024:506 JLINK_WriteU32(0xA0A00084, 0xC000C000)
T0BAC 024:508 JLINK_WriteU32(0xA0A00088, 0xC000C000)
T0BAC 024:510 JLINK_WriteU32(0xA0A0008C, 0x00000000)
T0BAC 024:512 JLINK_WriteU32(0xA0A00090, 0x00000000)
T0BAC 024:514 JLINK_WriteU32(0xA0A00094, 0x00000000)
T0BAC 024:515 JLINK_WriteU32(0xA0A00098, 0x00000000)
T0BAC 024:517 JLINK_WriteU32(0xA0A0009C, 0x00000000)
T0BAC 024:520 JLINK_WriteU32(0xA0A000A0, 0x1080D060)
T0BAC 024:521 JLINK_WriteU32(0xA0A000A4, 0xF00F3000)
T0BAC 024:523 JLINK_WriteU32(0xA0A000A8, 0xF0FF7090)
T0BAC 024:526 JLINK_WriteU32(0xA0A000AC, 0x0000001D)
T0BAC 024:528 JLINK_WriteU32(0xA0A000B0, 0x00000000)
T0BAC 024:530 JLINK_WriteU32(0xA0A000B4, 0x00000000)
T0BAC 024:532 JLINK_WriteU32(0xA0A000B8, 0x00000000)
T0BAC 024:534 JLINK_WriteU32(0xA0A000BC, 0x00000000)
T0BAC 024:536 JLINK_WriteU32(0xA0A000C0, 0x00000000)
T0BAC 024:538 JLINK_WriteU32(0xA0A000C4, 0x00000000)
T0BAC 024:540 JLINK_WriteU32(0xA0A000C8, 0x00000000)
T0BAC 024:542 JLINK_WriteU32(0xA0A000CC, 0x00000000)
T0BAC 024:544 JLINK_WriteU32(0xA0A000D0, 0xF0FF7090)
T0BAC 024:546 JLINK_WriteU32(0xA0A000D4, 0x00800000)
T0BAC 024:548 JLINK_WriteU32(0xA0A000D8, 0x00F30094)
T0BAC 024:550 JLINK_WriteU32(0xA0A000DC, 0x000040E0)
T0BAC 024:552 JLINK_WriteU32(0xA0A000E0, 0x00000000)
T0BAC 024:554 JLINK_WriteU32(0xA0A000E4, 0x00000000)
T0BAC 024:556 JLINK_WriteU32(0xA0A000E8, 0x00000000)
T0BAC 024:558 JLINK_WriteU32(0xA0A000EC, 0x00000000)
T0BAC 024:560 JLINK_WriteU32(0xA0A000F0, 0x000001FF)
T0BAC 024:562 JLINK_WriteU32(0xA0A000F4, 0x00000000)
T0BAC 024:564 JLINK_WriteU32(0xA0A000F8, 0x00000000)
T0BAC 024:566 JLINK_WriteU32(0xA0A000FC, 0x00000000)
This parts of logs was procedure when I pushed nand config (previously dumped) to phone! From my analyse I got some knownledge. Lets analyse it:
- Halt() not sure but I think it stoping procesor?
- 0xa900026c is TLMM_INT_JTAG_CTL
- 0xa0b00000 is DISABLE_NAND_MPU
- 0xa0a00000 is NAND_FLASH_BASE
- 0xa0a00004 is NAND_ADDR0
- 0xa0a00008 is NAND_ADDR1
- 0xa0a0000c is NAND_FLASH_CHIP_SELECT
- 0xa0a00010 is NAND_EXEC_CMD
- 0xa0a00014 is NAND_FLASH_STATUS
- 0xa0a00018 is NAND_BUFFER_STATUS
- 0xa0a0001c not know
- 0xa0a00020 is NAND_DEV0_CFG0
- 0xa0a00024 is NAND_DEV0_CFG1
- 0xa0a00028 not know
- 0xa0a0002c not know
- 0xa0a00030 is NAND_DEV1_CFG0
- 0xa0a00034 is NAND_DEV1_CFG1
- 0xa0a00038 not know
- 0xa0a0003c not know
- 0xa0a00040 is NAND_FLASH_ID_DATA
- ...etc ... here is all we need:
Code:
<flashmode>3</flashmode>
<id>00E0</id>
<id>0170</id>
<id>0190</id>
<id>0180</id>
<id>0080</id>
<id>0083</id>
<id>0240</id>
<id>03C0</id>
<id>01B1</id>
<id>0100</id>
<NAND_FLASH_BASE>A0A00000</NAND_FLASH_BASE>
<NAND_FLASH_CMD>A0A00000</NAND_FLASH_CMD>
<NAND_EXEC_CMD>A0A00010</NAND_EXEC_CMD>
<NAND_FLASH_STATUS>A0A00014</NAND_FLASH_STATUS>
<NAND_BUFFER_STATUS>A0A00018</NAND_BUFFER_STATUS>
<NAND_FLASH_READ_STATUS>A0A00044</NAND_FLASH_READ_STATUS>
<NAND_FLASH_BUFFER>A0A00100</NAND_FLASH_BUFFER>
<NAND_FLASH_ID_DATA>A0A00040</NAND_FLASH_ID_DATA>
<NAND_FLASH_CHIP_SELECT>A0A0000C</NAND_FLASH_CHIP_SELECT>
<FLASH_MACRO1_REG>A0A00064</FLASH_MACRO1_REG>
<NAND_DEV0_CFG0>A0A00020</NAND_DEV0_CFG0>
<NAND_DEV0_CFG1>A0A00024</NAND_DEV0_CFG1>
<NAND_DEV1_CFG0>A0A00030</NAND_DEV1_CFG0>
<NAND_DEV1_CFG1>A0A00034</NAND_DEV1_CFG1>
<FLASH_XFR_STEP1>A0A00070</FLASH_XFR_STEP1>
<FLASH_XFR_STEP2>A0A00074</FLASH_XFR_STEP2>
<FLASH_XFR_STEP3>A0A00078</FLASH_XFR_STEP3>
<FLASH_XFR_STEP4>A0A0007C</FLASH_XFR_STEP4>
<FLASH_XFR_STEP5>A0A00080</FLASH_XFR_STEP5>
<FLASH_XFR_STEP6>A0A00084</FLASH_XFR_STEP6>
<FLASH_XFR_STEP7>A0A00088</FLASH_XFR_STEP7>
<FLASH_DEV_CMD0>A0A000A0</FLASH_DEV_CMD0>
<FLASH_DEV_CMD1>A0A000A4</FLASH_DEV_CMD1>
<FLASH_DEV_CMD2>A0A000A8</FLASH_DEV_CMD2>
<FLASH_DEV_CMD3>A0A000D0</FLASH_DEV_CMD3>
<FLASH_DEV_CMD4>A0A000D4</FLASH_DEV_CMD4>
<FLASH_DEV_CMD5>A0A000D8</FLASH_DEV_CMD5>
<FLASH_DEV_CMD6>A0A000DC</FLASH_DEV_CMD6>
<FLASH_DEV_CMD_VLD>A0A000AC</FLASH_DEV_CMD_VLD>
<EBI2_MISR_SIG_REG>A0A000B0</EBI2_MISR_SIG_REG>
<NAND_ADDR0>A0A00004</NAND_ADDR0>
<NAND_ADDR1>A0A00008</NAND_ADDR1>
<NAND_ADDR2>A0A000C0</NAND_ADDR2>
<NAND_ADDR3>A0A000C4</NAND_ADDR3>
<NAND_ADDR4>A0A000C8</NAND_ADDR4>
<NAND_ADDR5>A0A000CC</NAND_ADDR5>
<SFLASHC_BURST_CFG>A0A000E0</SFLASHC_BURST_CFG>
<NAND_EBI2_ECC_BUF_CFG>A0A000F0</NAND_EBI2_ECC_BUF_CFG>
<TLMM_INT_JTAG_CTL>A900026C</TLMM_INT_JTAG_CTL>
<NAND_CMD_RESET>1</NAND_CMD_RESET>
<NAND_CMD_ABORT>31</NAND_CMD_ABORT>
<NAND_CMD_PAGE_READ>32</NAND_CMD_PAGE_READ>
<NAND_CMD_PAGE_READ_ECC>33</NAND_CMD_PAGE_READ_ECC>
<NAND_CMD_PAGE_READ_ALL>34</NAND_CMD_PAGE_READ_ALL>
<NAND_CMD_SEQ_PAGE_READ>15</NAND_CMD_SEQ_PAGE_READ>
<NAND_CMD_PRG_PAGE>36</NAND_CMD_PRG_PAGE>
<NAND_CMD_PRG_PAGE_ECC>37</NAND_CMD_PRG_PAGE_ECC>
<NAND_CMD_PRG_PAGE_ALL>39</NAND_CMD_PRG_PAGE_ALL>
<NAND_CMD_ERASE_BLOCK>3A</NAND_CMD_ERASE_BLOCK>
<NAND_CMD_FETCH_ID>B</NAND_CMD_FETCH_ID>
<NAND_CMD_STATUS>C</NAND_CMD_STATUS>
<NAND_CMD_RESET_MEMORY>D</NAND_CMD_RESET_MEMORY>
<init addr="TLMM_INT_JTAG_CTL" MODE="4" VAL="A900026C">9</init>
<init addr="DISABLE_NAND_MPU" MODE="4" VAL="A0B00000">0</init>
After puting nand config to device I executed "nand init" and got this log:
Code:
T0830 150:335 JLINK_CP15_ReadEx(CRn = 1, CRm = 0, op1 = 0, op2 = 0, ...) >0x80 JTAG> -- Data = 0x00053078 (0003ms, 16772ms total)
T0830 150:335 returns 0x00 (0003ms, 16772ms total)
T0830 150:338 JLINK_CP15_WriteEx(CRn = 1, CRm = 0, op1 = 0, op2 = 0, Data = 0x00053078) returns 0x00 (0000ms, 16775ms total)
And here is detailed log:
Code:
T0830 145:178 JLINK_WriteU32(0xA0A00000, 0x0000000B) - Writing 0x04 bytes @ 0xA0A00000 -- WriteRemote(4 bytes @ 0xA0A00000) returns 0x00 (0003ms, 16618ms total)
T0830 145:181 JLINK_WriteU32(0xA0A00004, 0x4AC80000) - Writing 0x04 bytes @ 0xA0A00004 -- WriteRemote(4 bytes @ 0xA0A00004) returns 0x00 (0003ms, 16621ms total)
T0830 145:184 JLINK_WriteU32(0xA0A00008, 0x00000000) - Writing 0x04 bytes @ 0xA0A00008 -- WriteRemote(4 bytes @ 0xA0A00008) returns 0x00 (0002ms, 16624ms total)
T0830 145:186 JLINK_WriteU32(0xA0A0000C, 0x00000004) - Writing 0x04 bytes @ 0xA0A0000C -- WriteRemote(4 bytes @ 0xA0A0000C) returns 0x00 (0002ms, 16626ms total)
T0830 145:188 JLINK_WriteU32(0xA0A00010, 0x00000000) - Writing 0x04 bytes @ 0xA0A00010 -- WriteRemote(4 bytes @ 0xA0A00010) returns 0x00 (0003ms, 16628ms total)
T0830 145:191 JLINK_WriteU32(0xA0A00014, 0x00003020) - Writing 0x04 bytes @ 0xA0A00014 -- WriteRemote(4 bytes @ 0xA0A00014) returns 0x00 (0003ms, 16631ms total)
T0830 145:195 JLINK_WriteU32(0xA0A00018, 0xFFFF0000) - Writing 0x04 bytes @ 0xA0A00018 -- WriteRemote(4 bytes @ 0xA0A00018) returns 0x00 (0002ms, 16634ms total)
T0830 145:198 JLINK_WriteU32(0xA0A0001C, 0x00000020) - Writing 0x04 bytes @ 0xA0A0001C -- WriteRemote(4 bytes @ 0xA0A0001C) returns 0x00 (0002ms, 16636ms total)
T0830 145:201 JLINK_WriteU32(0xA0A00020, 0xAA5400C0) - Writing 0x04 bytes @ 0xA0A00020 -- WriteRemote(4 bytes @ 0xA0A00020) returns 0x00 (0003ms, 16638ms total)
T0830 145:204 JLINK_WriteU32(0xA0A00024, 0x000A7476) - Writing 0x04 bytes @ 0xA0A00024 -- WriteRemote(4 bytes @ 0xA0A00024) returns 0x00 (0003ms, 16641ms total)
T0830 145:207 JLINK_WriteU32(0xA0A00028, 0x00000000) - Writing 0x04 bytes @ 0xA0A00028 -- WriteRemote(4 bytes @ 0xA0A00028) returns 0x00 (0003ms, 16644ms total)
T0830 145:210 JLINK_WriteU32(0xA0A0002C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0002C -- WriteRemote(4 bytes @ 0xA0A0002C) returns 0x00 (0002ms, 16647ms total)
T0830 145:212 JLINK_WriteU32(0xA0A00030, 0xAAD4001A) - Writing 0x04 bytes @ 0xA0A00030 -- WriteRemote(4 bytes @ 0xA0A00030) returns 0x00 (0003ms, 16649ms total)
T0830 145:215 JLINK_WriteU32(0xA0A00034, 0x002101BD) - Writing 0x04 bytes @ 0xA0A00034 -- WriteRemote(4 bytes @ 0xA0A00034) returns 0x00 (0003ms, 16652ms total)
T0830 145:218 JLINK_WriteU32(0xA0A00038, 0x00000000) - Writing 0x04 bytes @ 0xA0A00038 -- WriteRemote(4 bytes @ 0xA0A00038) returns 0x00 (0003ms, 16655ms total)
T0830 145:221 JLINK_WriteU32(0xA0A0003C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0003C -- WriteRemote(4 bytes @ 0xA0A0003C) returns 0x00 (0003ms, 16658ms total)
T0830 145:224 JLINK_WriteU32(0xA0A00040, 0x5500BCEC) - Writing 0x04 bytes @ 0xA0A00040 -- WriteRemote(4 bytes @ 0xA0A00040) returns 0x00 (0003ms, 16661ms total)
T0830 145:227 JLINK_WriteU32(0xA0A00044, 0x00000000) - Writing 0x04 bytes @ 0xA0A00044 -- WriteRemote(4 bytes @ 0xA0A00044) returns 0x00 (0003ms, 16664ms total)
T0830 145:231 JLINK_WriteU32(0xA0A00048, 0x00000000) - Writing 0x04 bytes @ 0xA0A00048 -- WriteRemote(4 bytes @ 0xA0A00048) returns 0x00 (0002ms, 16667ms total)
T0830 145:234 JLINK_WriteU32(0xA0A0004C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0004C -- WriteRemote(4 bytes @ 0xA0A0004C) returns 0x00 (0002ms, 16669ms total)
T0830 145:237 JLINK_WriteU32(0xA0A00050, 0x00000000) - Writing 0x04 bytes @ 0xA0A00050 -- WriteRemote(4 bytes @ 0xA0A00050) returns 0x00 (0002ms, 16671ms total)
T0830 145:240 JLINK_WriteU32(0xA0A00054, 0x00000000) - Writing 0x04 bytes @ 0xA0A00054 -- WriteRemote(4 bytes @ 0xA0A00054) returns 0x00 (0002ms, 16673ms total)
T0830 145:243 JLINK_WriteU32(0xA0A00058, 0x00000000) - Writing 0x04 bytes @ 0xA0A00058 -- WriteRemote(4 bytes @ 0xA0A00058) returns 0x00 (0003ms, 16675ms total)
T0830 145:246 JLINK_WriteU32(0xA0A0005C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0005C -- WriteRemote(4 bytes @ 0xA0A0005C) returns 0x00 (0003ms, 16678ms total)
T0830 145:249 JLINK_WriteU32(0xA0A00060, 0x00000000) - Writing 0x04 bytes @ 0xA0A00060 -- WriteRemote(4 bytes @ 0xA0A00060) returns 0x00 (0003ms, 16681ms total)
T0830 145:252 JLINK_WriteU32(0xA0A00064, 0x00000000) - Writing 0x04 bytes @ 0xA0A00064 -- WriteRemote(4 bytes @ 0xA0A00064) returns 0x00 (0002ms, 16684ms total)
T0830 145:254 JLINK_WriteU32(0xA0A00068, 0x00000000) - Writing 0x04 bytes @ 0xA0A00068 -- WriteRemote(4 bytes @ 0xA0A00068) returns 0x00 (0003ms, 16686ms total)
T0830 145:257 JLINK_WriteU32(0xA0A0006C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0006C -- WriteRemote(4 bytes @ 0xA0A0006C) returns 0x00 (0003ms, 16689ms total)
T0830 145:260 JLINK_WriteU32(0xA0A00070, 0x04E00480) - Writing 0x04 bytes @ 0xA0A00070 -- WriteRemote(4 bytes @ 0xA0A00070) returns 0x00 (0003ms, 16692ms total)
T0830 145:264 JLINK_WriteU32(0xA0A00074, 0x49F04999) - Writing 0x04 bytes @ 0xA0A00074 -- WriteRemote(4 bytes @ 0xA0A00074) returns 0x00 (0002ms, 16695ms total)
T0830 145:267 JLINK_WriteU32(0xA0A00078, 0x85E08580) - Writing 0x04 bytes @ 0xA0A00078 -- WriteRemote(4 bytes @ 0xA0A00078) returns 0x00 (0002ms, 16697ms total)
T0830 145:270 JLINK_WriteU32(0xA0A0007C, 0xC400C400) - Writing 0x04 bytes @ 0xA0A0007C -- WriteRemote(4 bytes @ 0xA0A0007C) returns 0x00 (0002ms, 16699ms total)
T0830 145:273 JLINK_WriteU32(0xA0A00080, 0xC000C000) - Writing 0x04 bytes @ 0xA0A00080 -- WriteRemote(4 bytes @ 0xA0A00080) returns 0x00 (0002ms, 16701ms total)
T0830 145:276 JLINK_WriteU32(0xA0A00084, 0xC000C000) - Writing 0x04 bytes @ 0xA0A00084 -- WriteRemote(4 bytes @ 0xA0A00084) returns 0x00 (0002ms, 16703ms total)
T0830 145:279 JLINK_WriteU32(0xA0A00088, 0xC000C000) - Writing 0x04 bytes @ 0xA0A00088 -- WriteRemote(4 bytes @ 0xA0A00088) returns 0x00 (0002ms, 16705ms total)
T0830 145:282 JLINK_WriteU32(0xA0A0008C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0008C -- WriteRemote(4 bytes @ 0xA0A0008C) returns 0x00 (0002ms, 16707ms total)
T0830 145:285 JLINK_WriteU32(0xA0A00090, 0x00000000) - Writing 0x04 bytes @ 0xA0A00090 -- WriteRemote(4 bytes @ 0xA0A00090) returns 0x00 (0003ms, 16709ms total)
T0830 145:288 JLINK_WriteU32(0xA0A00094, 0x00000000) - Writing 0x04 bytes @ 0xA0A00094 -- WriteRemote(4 bytes @ 0xA0A00094) returns 0x00 (0003ms, 16712ms total)
T0830 145:291 JLINK_WriteU32(0xA0A00098, 0x00000000) - Writing 0x04 bytes @ 0xA0A00098 -- WriteRemote(4 bytes @ 0xA0A00098) returns 0x00 (0003ms, 16715ms total)
T0830 145:294 JLINK_WriteU32(0xA0A0009C, 0x00000000) - Writing 0x04 bytes @ 0xA0A0009C -- WriteRemote(4 bytes @ 0xA0A0009C) returns 0x00 (0002ms, 16718ms total)
T0830 145:296 JLINK_WriteU32(0xA0A000A0, 0x1080D060) - Writing 0x04 bytes @ 0xA0A000A0 -- WriteRemote(4 bytes @ 0xA0A000A0) returns 0x00 (0003ms, 16720ms total)
T0830 145:300 JLINK_WriteU32(0xA0A000A4, 0xF00F3000) - Writing 0x04 bytes @ 0xA0A000A4 -- WriteRemote(4 bytes @ 0xA0A000A4) returns 0x00 (0002ms, 16723ms total)
T0830 145:303 JLINK_WriteU32(0xA0A000A8, 0xF0FF7090) - Writing 0x04 bytes @ 0xA0A000A8 -- WriteRemote(4 bytes @ 0xA0A000A8) returns 0x00 (0002ms, 16725ms total)
T0830 145:306 JLINK_WriteU32(0xA0A000AC, 0x0000001D) - Writing 0x04 bytes @ 0xA0A000AC -- WriteRemote(4 bytes @ 0xA0A000AC) returns 0x00 (0002ms, 16727ms total)
T0830 145:309 JLINK_WriteU32(0xA0A000B0, 0x00000000) - Writing 0x04 bytes @ 0xA0A000B0 -- WriteRemote(4 bytes @ 0xA0A000B0) returns 0x00 (0002ms, 16729ms total)
T0830 145:312 JLINK_WriteU32(0xA0A000B4, 0x00000000) - Writing 0x04 bytes @ 0xA0A000B4 -- WriteRemote(4 bytes @ 0xA0A000B4) returns 0x00 (0002ms, 16731ms total)
T0830 145:315 JLINK_WriteU32(0xA0A000B8, 0x00000000) - Writing 0x04 bytes @ 0xA0A000B8 -- WriteRemote(4 bytes @ 0xA0A000B8) returns 0x00 (0002ms, 16733ms total)
T0830 145:318 JLINK_WriteU32(0xA0A000BC, 0x00000000) - Writing 0x04 bytes @ 0xA0A000BC -- WriteRemote(4 bytes @ 0xA0A000BC) returns 0x00 (0002ms, 16735ms total)
T0830 145:321 JLINK_WriteU32(0xA0A000C0, 0x00000000) - Writing 0x04 bytes @ 0xA0A000C0 -- WriteRemote(4 bytes @ 0xA0A000C0) returns 0x00 (0002ms, 16737ms total)
T0830 145:324 JLINK_WriteU32(0xA0A000C4, 0x00000000) - Writing 0x04 bytes @ 0xA0A000C4 -- WriteRemote(4 bytes @ 0xA0A000C4) returns 0x00 (0002ms, 16739ms total)
T0830 145:327 JLINK_WriteU32(0xA0A000C8, 0x00000000) - Writing 0x04 bytes @ 0xA0A000C8 -- WriteRemote(4 bytes @ 0xA0A000C8) returns 0x00 (0003ms, 16741ms total)
T0830 145:331 JLINK_WriteU32(0xA0A000CC, 0x00000000) - Writing 0x04 bytes @ 0xA0A000CC -- WriteRemote(4 bytes @ 0xA0A000CC) returns 0x00 (0002ms, 16744ms total)
T0830 145:334 JLINK_WriteU32(0xA0A000D0, 0xF0FF7090) - Writing 0x04 bytes @ 0xA0A000D0 -- WriteRemote(4 bytes @ 0xA0A000D0) returns 0x00 (0002ms, 16746ms total)
T0830 145:336 JLINK_WriteU32(0xA0A000D4, 0x00800000) - Writing 0x04 bytes @ 0xA0A000D4 -- WriteRemote(4 bytes @ 0xA0A000D4) returns 0x00 (0002ms, 16748ms total)
T0830 145:339 JLINK_WriteU32(0xA0A000D8, 0x00F30094) - Writing 0x04 bytes @ 0xA0A000D8 -- WriteRemote(4 bytes @ 0xA0A000D8) returns 0x00 (0002ms, 16750ms total)
T0830 145:342 JLINK_WriteU32(0xA0A000DC, 0x000040E0) - Writing 0x04 bytes @ 0xA0A000DC -- WriteRemote(4 bytes @ 0xA0A000DC) returns 0x00 (0003ms, 16752ms total)
T0830 145:346 JLINK_WriteU32(0xA0A000E0, 0x00000000) - Writing 0x04 bytes @ 0xA0A000E0 -- WriteRemote(4 bytes @ 0xA0A000E0) returns 0x00 (0002ms, 16755ms total)
T0830 145:350 JLINK_WriteU32(0xA0A000E4, 0x00000000) - Writing 0x04 bytes @ 0xA0A000E4 -- WriteRemote(4 bytes @ 0xA0A000E4) returns 0x00 (0002ms, 16757ms total)
T0830 145:353 JLINK_WriteU32(0xA0A000E8, 0x00000000) - Writing 0x04 bytes @ 0xA0A000E8 -- WriteRemote(4 bytes @ 0xA0A000E8) returns 0x00 (0002ms, 16759ms total)
T0830 145:356 JLINK_WriteU32(0xA0A000EC, 0x00000000) - Writing 0x04 bytes @ 0xA0A000EC -- WriteRemote(4 bytes @ 0xA0A000EC) returns 0x00 (0002ms, 16761ms total)
T0830 145:359 JLINK_WriteU32(0xA0A000F0, 0x000001FF) - Writing 0x04 bytes @ 0xA0A000F0 -- WriteRemote(4 bytes @ 0xA0A000F0) returns 0x00 (0002ms, 16763ms total)
T0830 145:362 JLINK_WriteU32(0xA0A000F4, 0x00000000) - Writing 0x04 bytes @ 0xA0A000F4 -- WriteRemote(4 bytes @ 0xA0A000F4) returns 0x00 (0002ms, 16765ms total)
T0830 145:365 JLINK_WriteU32(0xA0A000F8, 0x00000000) - Writing 0x04 bytes @ 0xA0A000F8 -- WriteRemote(4 bytes @ 0xA0A000F8) returns 0x00 (0002ms, 16767ms total)
T0830 145:368 JLINK_WriteU32(0xA0A000FC, 0x00000000) - Writing 0x04 bytes @ 0xA0A000FC -- WriteRemote(4 bytes @ 0xA0A000FC) returns 0x00 (0003ms, 16769ms total)
T0830 150:335 JLINK_CP15_ReadEx(CRn = 1, CRm = 0, op1 = 0, op2 = 0, ...) >0x80 JTAG> -- Data = 0x00053078 (0003ms, 16772ms total)
T0830 150:335 returns 0x00 (0003ms, 16772ms total)
T0830 150:338 JLINK_CP15_WriteEx(CRn = 1, CRm = 0, op1 = 0, op2 = 0, Data = 0x00053078) returns 0x00 (0000ms, 16775ms total)
Dumped nand config is:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 0B 00 00 00 00 00 C8 4A 00 00 00 00 04 00 00 00 ......ČJ........
00000010 00 00 00 00 20 30 00 00 00 00 FF FF 20 00 00 00 .... 0....˙˙ ...
00000020 C0 00 54 AA 76 74 0A 00 00 00 00 00 00 00 00 00 Ŕ.TŞvt..........
00000030 1A 00 D4 AA BD 01 21 00 00 00 00 00 00 00 00 00 ..ÔŞ˝.!.........
00000040 EC BC 00 55 00 00 00 00 00 00 00 00 00 00 00 00 ěĽ.U............
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070 80 04 E0 04 99 49 F0 49 80 85 E0 85 00 C4 00 C4 €.ŕ.™IđI€…ŕ….Ä.Ä
00000080 00 C0 00 C0 00 C0 00 C0 00 C0 00 C0 00 00 00 00 .Ŕ.Ŕ.Ŕ.Ŕ.Ŕ.Ŕ....
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000A0 60 D0 80 10 00 30 0F F0 90 70 FF F0 1D 00 00 00 `Đ€..0.đ.p˙đ....
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000D0 90 70 FF F0 00 00 80 00 94 00 F3 00 E0 40 00 00 .p˙đ..€.”.ó.ŕ@..
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000F0 FF 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ˙...............
This is only part of log but I have full log (45mb) and if you help here and we create an initial simple code that will work from this part of log, I will create an php bassed log convertor to c code and will convert whole log to c code, but first I need to see an example c code for this part of log (and I will try that compiled code in my device!)!
Lets speak here!
Tried to get nand id with simple function executed from wifi_nvs.c but android could not boot Any ideas why?
Code:
#ifdef HACK
#include <linux/mtd/mtd.h>
#include <linux/mtd/blktrans.h>
#include <mach/msm_iomap.h>
#include <linux/crc32.h>
#include <linux/io.h>
void lets_see_if_it_working(void) {
//uint32_t disable_nand_mpu = 0xa0b00000;
//uint32_t mpu_off = 0x00000000;
uint32_t nand_flash_base = 0xa0a00000;
uint32_t NAND_CMD_FETCH_ID = 0x0000000b;
//uint32_t nand_exec = 0xa0a00010;
//uint32_t nand_exec_cmd = 0x00000001;
uint32_t NAND_FLASH_ID_DATA = 0xa0a00040;
uint32_t data;
//writel(mpu_off, disable_nand_mpu);
writel(NAND_CMD_FETCH_ID, nand_flash_base);
//writel(nand_exec_cmd, nand_exec);
data = readl(NAND_FLASH_ID_DATA);
printk("NAND ID=%08X\n", data);
}
#endif
rewrote lk bootloader now to boot up with writeable AMSS partition:
log of kernel:
Code:
<6>NAND_EBI2_ECC_BUF_CFG: 1ff
#MTD# parts in atag = 8
Creating 8 MTD partitions on "msm_nand":
0x000002820000-0x000002840000 : "lkbootloader"
0x000002840000-0x000003240000 : "boot"
0x000003240000-0x000003c40000 : "recovery"
0x000003c40000-0x000003ce0000 : "misc"
0x000003ce0000-0x00000dce0000 : "system"
0x00000dce0000-0x00001eee0000 : "userdata"
0x00001f000000-0x000020000000 : "cache"
0x000000540000-0x000001d40000 : "AMSS"
would be nice if you can give it a try to flash it via fastboot or android (nandwrite). I have just tested to dump it via nanddump and that worked fine!
i applied bootloader bin for haret boot and nb image, whatever you prefer
Hi, there is one problem! Example: if you dump whole nand with nanddump or dd or cat or any other method usind "android" and compare that dump with jtag dump that I posted..., you will see for example: htc partition is dumped but you will see there big diference (only 0xFF is there, and many other secured partitions is with 0xFF!)... I compared already nand dump and jtag dump and there is big diference and some parts can not be dumped!!! Maybe amss will be dumped (I will try) but hmmm, will be good if it will be possible! Wait moment I will post an diff!
EDIT:
yes, its not posible, see 0x130 from start of the amss partition:
photon jtag_dump:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00540000 7F 45 4C 46 01 01 01 61 00 00 00 00 00 00 00 00 .ELF...a........
00540010 02 00 28 00 01 00 00 00 00 00 E0 0C 34 00 00 00 ..(.......ŕ.4...
00540020 00 00 00 00 02 02 00 00 34 00 20 00 08 00 00 00 ........4. .....
00540030 00 00 00 00 01 00 00 00 00 10 00 00 00 50 E2 0E .............Pâ.
00540040 00 50 E2 0E B4 00 00 00 00 10 00 00 00 00 20 02 .Pâ.´......... .
00540050 00 00 00 00 01 00 00 00 00 80 00 00 00 00 00 F0 .........€.....đ
00540060 00 00 E0 0C FC C5 01 00 B8 1E 02 00 07 00 00 00 ..ŕ.üĹ..¸.......
00540070 00 80 00 00 01 00 00 00 00 C0 02 00 00 40 02 F0 .€.......Ŕ[email protected]đ
00540080 00 40 E2 0C 00 60 00 00 00 60 00 00 06 00 00 00 [email protected]â..`...`......
00540090 00 80 00 00 01 00 00 00 00 80 03 00 00 00 00 B0 .€.......€.....°
005400A0 00 00 E8 0C 87 48 01 00 87 48 01 00 05 00 00 00 ..č.‡H..‡H......
005400B0 00 80 00 00 01 00 00 00 00 00 05 00 00 00 04 B0 .€.............°
005400C0 00 00 EA 0C 84 01 00 00 04 30 01 00 06 00 00 00 ..ę.„....0......
005400D0 00 80 00 00 01 00 00 00 00 10 05 00 00 40 EB 0C .€[email protected]ë.
005400E0 00 40 EB 0C 14 1E 0C 01 00 A0 EE 01 07 00 00 81 [email protected]ë......*î.....
005400F0 00 10 00 00 01 00 00 00 00 30 11 01 00 E0 D9 0E .........0...ŕŮ.
00540100 00 E0 D9 0E 18 00 00 00 E8 60 08 00 06 00 60 01 .ŕŮ.....č`....`.
00540110 00 10 00 00 01 00 00 00 00 40 11 01 00 00 03 B0 [email protected]°
00540120 00 80 E9 0C 00 50 00 00 00 50 00 00 06 00 00 00 .ێ..P...P......
Photon nand_dump from android:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00540000 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540070 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540080 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540090 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400A0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
005400F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540100 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540110 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00540120 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
Amss is protected from writing, but why is protected from reading?
Or another example:
nand dump:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 FF AB FF FF 34 10 D7 73 5A 43 0B 7D FF FF FF FF ˙«˙˙4.×sZC.}˙˙˙˙
00000010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
jtag dump:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 D1 DC 4B 84 34 10 D7 73 5A 43 0B 7D FF FF FF FF ŃÜK„4.×sZC.}˙˙˙˙
00000010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
Did you got first 0x130 bute from your dump with 0xff or you see elf header?
you are right, it doesnt look very useful. what about using fastboot ?
EDIT: ok, did some research, splash screens and radio can only be flashed by spl on lowest level, when running lkbootloader, amss is already executed.
it really seems we need hspl or at least uspl. didnt you say you have patched spl with super cid ? maybe we can simply create a uspl
Hi, no, I have super cid device but super cid is not in spl "but we can get super cid if we can patch spl", offset for scid "in nand" is 0x4c0800, just have replaced VODAP30400000071 with 1111111100000071 ... this is in htc partition! Maybe cotula patched sspl give us something if we go to 3 color SSpl screen? I tried decompiling spl without succes. You think we can not read "low level" if amss is runing? Maybe you know what I need to edit in lets_see_if_it_working(void); to get that function working?
schlund said:
what about using fastboot ?
Click to expand...
Click to collapse
Already tried fastboot in lk, creaded an partition with size from 0 to 0x2820000, using fastboot erase jtag - it erase jtag partition without error but after reboot its not erased, when trying to write it working with for example 0x20000 size "but not working with full size of the 0x2820000 it say out of spaace", but again after writing/reboot data is not writen in protected memory... I think we need to disable mmu, mpu, nand mpu...etc before trying to write? Also see this =-> http://pof.eslack.org/HTC/splxploit/ what you think? ...We need only this in spl (SuperCID + flash unsigned code)
i thought about simply flashing created amss partition and trying to reflash it. mpu should already be disabled in fastbode mode by bootloader.
but i will take a log on your links now,
could you be so nice to dump all the radio partition images from aria and photon ? would be very useful for my research!
Ok, offsets (from to)?
Now I going to see asm diference between leo hspl and spl (have leo hspl dump, and found same version standard spl)... we will try to patch photon spl?
. sorry .
maby this??????
maby this??????
EDIT:
Guys, need hspl 1.31.0000 version... please search google, I could not found any link![/QUOTE]
what about using another version. like 1.06 if you can't find 1.31 ?
The Partitions you could dump for me:
MIBIB: Address: 0x00000000 - 0x00140000
QCSBL: Address: 0x00140000 - 0x001C0000
OEMSBL1: Address: 0x001C0000 - 0x00280000
OEMSBL2: Address: 0x00280000 - 0x00340000
HTC: Address: 0x00340000 - 0x00540000
AMSS: Address: 0x00540000 - 0x01D40000
EFS2: Address: 0x01D40000 - 0x022C0000
FOTA: Address: 0x022C0000 - 0x023C0000
RESERVED: Address: 0x023C0000 - 0x02400000
APPSBL: Address: 0x02400000 - 0x024C0000 (should be hboot & spl)
MISC_CFG: Address: 0x024C0000 - 0x02500000
WLAN: Address: 0x02500000 - 0x02540000
EDIT: Also found SPL 1.07 in one of our stock roms
Hi , if it can help on Google : Raphael Cdma Hspl 037 (1.3 Mb)
djfastest said:
maby this??????
Click to expand...
Click to collapse
Maybe you post next time without quotes? And maybe it is not hspl? Maybe it is sspl? And maybe it is exe and maybe you edit your reaply to cut this page?
schlund said:
EDIT: Also found SPL 1.07 in one of our stock roms
Click to expand...
Click to collapse
Ok, will dump but I will edit some personal data in dump like device s/n... etc.
Please give me link to stock rom with spl 1.07 its interested now!
of course, i simply flashed a 1.07.xxxx ROM to get SPL 1.07
and 1.06.xxx to get SPL 1.06 from here: http://shipped-roms.com/index.php?category=windows%20mobile&model=Photon
Spl is patched! Only got supercid now but displaying original cid will try to patch to get super cid on screen... its tested and now I can able to install firmware without gold card
great news!
what exactly have you done ? which spl have you used ? how did you patch it? And how did you copy it to the device ?
Have you tried to flash stock roms from different regions, too ? what about flashing stock aria rom ?
is it secured to be overwritten by stock spl?
Lots of questions, i know
Finaly cid protection is buy buy , instaled using jtag to flash (so we need to find method how to install it without jtag)! Tested: all methods (using sd card without supercid header - it working, installing using htc ruu - it working on all regions, sd card with super cid header - working... ewerything is good)... will try to bypas "flash unsigned code" tomorow and finaly we need hspl overwrite protection
http://img39.imageshack.us/img39/5539/img0991d.jpg
makes me think of a method how to flash it without jtag.
sspl in general could do it, but as i know cotulla disabled radio and spl flash in it. ( i dont know how to enable)
maybe you can try it via fastboot or android nandwrite ? compared to amss its readable there, but i am too scared to brick my device with trying it
if you want me to make another lk for spl when you are to lazy to,just tell me!
may be try to modify hspl patcher for hd2?
Related
cross posting from universal upgrading ... can someone kill the other thread ?
can someone assist me in changing the nk.exe in a way that allows me to change the deviceid from PU10 to HERM100
i succeded in hexediting the hk.nba from PU10 to HERM with the confirmation that Getdevice data recognize it as HERM
http://wiki.xda-developers.com/index...=GetDeviceData
there are 2 places in the nk.nba where the device type is found
00007074h: 48 00 45 00 52 00 4D ; H.E.R.M
00316c74h: 48 00 45 00 52 00 4D ; H.E.R.M
i need to get H.E.R.M.1.0.0 instead (6 bytes to insert)
00007050h: 2C 00 25 00 64 00 2C 00 20 00 4E 00 61 00 6D 00 ; ,.%.d.,. .N.a.m.
00007060h: 65 00 20 00 69 00 73 00 20 00 25 00 73 00 0D 00 ; e. .i.s. .%.s...
00007070h: 0A 00 00 00 48 00 45 00 52 00 4D 00 00 00 00 00 ; ....H.E.R.M.....
00007080h: 4F 45 4D 47 65 74 43 50 4C 44 5F 47 50 49 4F 28 ; OEMGetCPLD_GPIO(
after dumping the rom including the boot XIP i found that the nk.exe contains this data.
the reason to do it is to "help" bbconnect to recognize it as a hermes
anyone can assist me ?
Hi,
Just a thought - wouldn't it be easier to patch BB Connect to recognise the PU10. I would have thought it tricky to "insert" any bytes, and for nk.exe to work, but to shorten a string in a file might work by either terminating the shorter string with a 00 null byte, leaving it's full length intact, or if it's got a preceeding length attribute, then simply amend that to the shorter value, i.e. from 7 to 4?
Cheers,
Steve.
Hi, well I've found the Kernel parameters in the bootloader posted here (Android 2.1 - 2.51 bootonly DOWNLOAD).
The parameters on the SBF are:
Code:
console=ttyS2,115200n8 rw [email protected] init=/init ip=off motobldlabel=none mtdparts=omap2-nand.0:128k(mbr),128k(mbmloader),256k(unused0),512k(mbm),512k(mbmbackup),512k(ebr),512k(bploader),512k(cdt),4m(pds),512k(lbl),512k(lbl_backup),1m(logo),2m(sp),512k(devtree),512k(devtree_backup),4m(bpsw),8m(boot),8m(recovery),13952k(cdrom),384k(unused1),512k(misc),512k(cid),4m(kpanic),334464k(system),384k(unused2),512k(prek),512k(pkbackup),200m(cache),455296k(userdata)
And the parameters in my current stock rom:
Code:
console=ttyS2,115200n8 console=ttyMTD10 rw [email protected] init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mtdparts= mmcparts=mmcblk1:p7(pds),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=normal
Well, that comes from a sbf file, so, I guess if i modify it, the stuff about the original bootloader wont work, ant I guess the mobile wont startup.
Am I right in that?
Im asking because if I pass another parameter (about the Framebuffer OMAP2, the screen driver), I can use X11 native, and that will be great!
the one in 3.4.2-164 :
Code:
Kernel command line: console=/dev/null rw [email protected] init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mmcparts=mmcblk1:p7(pds),p15(boot),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=reboot
got in dmesg or cat /proc/cmdline as root
cocus said:
Hi, well I've found the Kernel parameters in the bootloader posted here (Android 2.1 - 2.51 bootonly DOWNLOAD).
The parameters on the SBF are:
Code:
console=ttyS2,115200n8 rw [email protected] init=/init ip=off motobldlabel=none mtdparts=omap2-nand.0:128k(mbr),128k(mbmloader),256k(unused0),512k(mbm),512k(mbmbackup),512k(ebr),512k(bploader),512k(cdt),4m(pds),512k(lbl),512k(lbl_backup),1m(logo),2m(sp),512k(devtree),512k(devtree_backup),4m(bpsw),8m(boot),8m(recovery),13952k(cdrom),384k(unused1),512k(misc),512k(cid),4m(kpanic),334464k(system),384k(unused2),512k(prek),512k(pkbackup),200m(cache),455296k(userdata)
And the parameters in my current stock rom:
Code:
console=ttyS2,115200n8 console=ttyMTD10 rw [email protected] init=/init ip=off brdrev=P3A androidboot.bootloader=0x0000 mtdparts= mmcparts=mmcblk1:p7(pds),p16(recovery),p17(cdrom),p18(misc),p19(cid),p20(kpanic),p21(system),p22(prek),p23(pkbackup),p24(cache),p25(userdata) androidboot.mode=normal
Well, that comes from a sbf file, so, I guess if i modify it, the stuff about the original bootloader wont work, ant I guess the mobile wont startup.
Am I right in that?
Im asking because if I pass another parameter (about the Framebuffer OMAP2, the screen driver), I can use X11 native, and that will be great!
Click to expand...
Click to collapse
how do you modify the boot parameter?
i found in cdt partition (hexdump), this partition table description, confirmed and completed with sbf_flash tool :
Code:
CG64 - mmcblk1 mbr
xCG63 - mmcblk1p1-mbmloader.??? (128k)
xCG30 - mmcblk1p2-mbm.??? (512k)
CG55 - mmcblk1p3-mbmbackup.??? (512k)
CG64 - mmcblk1p4-ebr.??? (1024)
xCG56 - mmcblk1p5-bploader.??? (512k)
CG31 - mmcblk1p6-cdt.bin (512k) <--- dump show "this partition table" like a mbr
xCG38 - mmcblk1p7-pds.ext3 (4M)
CG34 - mmcblk1p8-lbl.??? (512k)
CG57 - mmcblk1p9-lbl_backup.??? (512k)
CG42 - mmcblk1p10-logo.bin (1M)
xCG41 - mmcblk1p11-sp.??? (2M) <--- dump show "this partition table" like a mbr
CG61 - mmcblk1p12-devtree.??? (512k)
CG62 - mmcblk1p13-devtree_backup.??? (512k)
CG45 - mmcblk1p14-bpsw.??? (4M)
CG35 - mmcblk1p15-boot.cpio.gz (8M)
CG47 - mmcblk1p16-recovery.cpio.gz (8M)
CG33 - mmcblk1p17-cdrom.iso (14M)
xCG44 - mmcblk1p18-misc.??? (512k)
xCG43 - mmcblk1p19-cid.raw (512k)
CG53 - mmcblk1p20-kpanic.raw (4M)
CG39 - mmcblk1p21-system.ext3 (327M)
CG32 - mmcblk1p22-prek.??? (512k)
CG46 - mmcblk1p23-pkbackup.??? (512k)
CG40 - mmcblk1p24-cache.ext3 (200M)
xCG37 - mmcblk1p25-userdata.ext3 (1.3G)
marked ??? are partitions formats to be determined...
xCG : never seen in full sbfs
descriptions :
lbl : Linux Boot Loader (sources in motorola sdks) contains Motorola Cert. 4496 4498
system : /system folder
userdata /data folder
cache /cache folder
cdrom : cdrom iso with defy drivers (by usb ?)
pds : /pds folder ... hmm dunno exactly what it is, used by ClockWorkMod Recovery
recovery : when you boot with bottom volume button
bpsw : something compressed ??? + Motorola Cert. 4504 4506
sp : like cdt, but 3x Motorola Cert. 4496 4498 (maybe old end of file)
prek : Pre Kernel Interface, which switch to recovery mode, Motorola Cert. 4496 4498
devtree : look like /dev content, Motorola Cert. 4496 4498
devtree_backup, misc, cid, kpanic : empty
mbmloader: checks signature of mbm
mbm: verifies all other signatures before allowing the device to boot.
mbr, ebr : master boot record, extended boot record
cdt: Codegroup Descriptor Table (partition table + the kernel command line + Motorola Cert. 4496 4498)
sp seems to be a copy of cdt
johnw.xda said:
how do you modify the boot parameter?
Click to expand...
Click to collapse
Its hardcoded in kernel config and/or set/completed by bootloader...
But maybe there is a way to set additionnal parameters somewhere... like the "androidboot.mode=reboot" parameter
Epsylon3 said:
Its hardcoded in kernel config and/or set/completed by bootloader...
But maybe there is a way to set additionnal parameters somewhere... like the "androidboot.mode=reboot" parameter
Click to expand...
Click to collapse
Edit the SBF bootloader in binary mode. Those parameters are not compressed. You can delete a character and add another to get the same space of the string. But the thing is, in my Bootloader, I have 498M of ram, instead, in the one that I ve seen, there is 488M. And, there are some differences, in my boot, I have the partitions in mmcblk instead in mtdblk. I guess i can brick my phone if I change those.
cocus said:
Edit the SBF bootloader in binary mode. Those parameters are not compressed.
Click to expand...
Click to collapse
If you do so you'l probably destroy the hash of the bootloader and your device won't boot any more. This is the biggest problem of the signed bootloader from motorola
Sqoerk said:
If you do so you'l probably destroy the hash of the bootloader and your device won't boot any more. This is the biggest problem of the signed bootloader from motorola
Click to expand...
Click to collapse
Yep, I was thinking in that in my first post. So I just will keep the information, its usefull to know the partitions and the memory configuration.
Check this: Key To Unlocking Bootloader Found!
Hexdump of cdt partiton (p6)
Code:
00000000 1a 00 08 08 b1 00 00 00 00 00 c0 80 00 01 00 00 |................|
00000010 6d 62 72 00 00 00 00 00 00 00 00 00 00 00 00 00 |mbr.............|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 40 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 |@...............|
00000040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000050 ff ff ff ff 00 00 00 00 00 38 00 83 ff 3f 00 83 |.........8...?..|
00000060 00 00 00 83 01 00 00 00 00 00 ff ff 01 00 00 00 |................|
00000070 00 00 00 00 6d 62 6d 6c 6f 61 64 65 72 00 00 00 |....mbmloader...|
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000090 00 00 00 00 3f 00 00 00 01 00 00 00 01 00 00 00 |....?...........|
000000a0 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
000000b0 ff ff ff ff ff ff ff ff 00 00 00 00 80 ff 01 87 |................|
000000c0 7f 07 02 87 80 07 00 87 03 00 00 00 00 00 ff ff |................|
000000d0 00 00 00 00 00 00 00 00 6d 62 6d 00 00 00 00 00 |........mbm.....|
000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000f0 00 00 00 00 00 00 00 00 1e 00 00 00 04 00 00 00 |................|
00000100 07 00 00 00 02 00 00 00 ff ff ff ff ff ff ff ff |................|
00000110 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000120 00 f8 34 89 ff ff 34 89 00 00 31 89 03 00 00 00 |..4...4...1.....|
00000130 00 00 ff ff 00 00 00 00 00 00 00 00 6d 62 6d 62 |............mbmb|
00000140 61 63 6b 75 70 00 00 00 00 00 00 00 00 00 00 00 |ackup...........|
00000150 00 00 00 00 00 00 00 00 00 00 00 00 37 00 00 00 |............7...|
00000160 08 00 00 00 0b 00 00 00 02 00 00 00 ff ff ff ff |................|
00000170 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000180 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000190 03 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
000001a0 65 62 72 00 00 00 00 00 00 00 00 00 00 00 00 00 |ebr.............|
000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 41 00 01 00 0c 00 00 00 0f 00 00 00 03 00 00 00 |A...............|
000001d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
000001e0 ff ff ff ff 00 00 00 00 00 38 01 83 ff 3f 01 83 |.........8...?..|
000001f0 00 00 01 83 01 00 00 00 00 00 ff ff 01 00 00 00 |................|
00000200 00 00 00 00 62 70 6c 6f 61 64 65 72 00 00 00 00 |....bploader....|
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000220 00 00 00 00 38 00 00 00 10 00 00 00 13 00 00 00 |....8...........|
00000230 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000240 ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff |................|
00000250 ff ff ff ff ff ff ff ff 03 00 00 00 00 00 ff ff |................|
00000260 00 00 00 00 00 00 00 00 63 64 74 2e 62 69 6e 00 |........cdt.bin.|
00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000280 00 00 00 00 00 00 00 00 1f 00 01 00 14 00 00 00 |................|
00000290 17 00 00 00 03 00 00 00 ff ff ff ff ff ff ff ff |................|
000002a0 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
000002b0 00 38 07 89 ff 3f 07 89 00 00 07 89 01 00 00 00 |.8...?..........|
000002c0 00 00 ff ff 04 00 00 00 00 00 00 00 70 64 73 00 |............pds.|
000002d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000002e0 00 00 00 00 00 00 00 00 00 00 00 00 26 00 00 00 |............&...|
000002f0 18 00 00 00 37 00 00 00 00 00 00 00 ff ff ff ff |....7...........|
00000300 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000310 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000320 03 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
00000330 6c 62 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 |lbl.............|
00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000350 22 00 01 00 38 00 00 00 3b 00 00 00 03 00 00 00 |"...8...;.......|
00000360 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000370 ff ff ff ff 00 00 00 00 00 38 d0 80 ff 3f d0 80 |.........8...?..|
00000380 00 00 d0 80 01 00 01 00 00 00 ff ff 01 00 00 00 |................|
00000390 00 00 00 00 6c 62 6c 5f 62 61 63 6b 75 70 00 00 |....lbl_backup..|
000003a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000003b0 00 00 00 00 39 00 01 00 3c 00 00 00 3f 00 00 00 |....9...<...?...|
000003c0 03 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
000003d0 ff ff ff ff ff ff ff ff 00 00 00 00 00 38 d0 80 |.............8..|
000003e0 ff 3f d0 80 00 00 d0 80 01 00 01 00 00 00 ff ff |.?..............|
000003f0 01 00 00 00 00 00 00 00 6c 6f 67 6f 2e 62 69 6e |........logo.bin|
00000400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000410 00 00 00 00 00 00 00 00 2a 00 00 00 40 00 00 00 |........*[email protected]|
00000420 47 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |G...............|
00000430 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000440 00 f8 f6 86 ff ff f6 86 00 00 e7 86 03 00 01 00 |................|
00000450 00 00 ff ff 00 00 00 00 00 00 00 00 73 70 00 00 |............sp..|
00000460 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000470 00 00 00 00 00 00 00 00 00 00 00 00 29 00 00 00 |............)...|
00000480 48 00 00 00 57 00 00 00 00 00 00 00 ff ff ff ff |H...W...........|
00000490 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
000004a0 00 00 00 00 00 f8 2a 89 ff ff 2a 89 00 00 0b 89 |......*...*.....|
000004b0 03 00 01 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
000004c0 64 65 76 74 72 65 65 00 00 00 00 00 00 00 00 00 |devtree.........|
000004d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000004e0 3d 00 01 00 58 00 00 00 5b 00 00 00 00 00 00 00 |=...X...[.......|
000004f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000500 ff ff ff ff 00 00 00 00 00 f8 10 89 ff ff 10 89 |................|
00000510 00 00 09 89 03 00 01 00 00 00 ff ff 01 00 00 00 |................|
00000520 00 00 00 00 64 65 76 74 72 65 65 5f 62 61 63 6b |....devtree_back|
00000530 75 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |up..............|
00000540 00 00 00 00 3e 00 01 00 5c 00 00 00 5f 00 00 00 |....>...\..._...|
00000550 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000560 ff ff ff ff ff ff ff ff 00 00 00 00 00 f8 10 89 |................|
00000570 ff ff 10 89 00 00 09 89 03 00 01 00 00 00 ff ff |................|
00000580 01 00 00 00 00 00 00 00 62 70 73 77 00 00 00 00 |........bpsw....|
00000590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000005a0 00 00 00 00 00 00 00 00 2d 00 02 00 60 00 00 00 |........-...`...|
000005b0 7f 00 00 00 08 00 00 00 ff ff ff ff ff ff ff ff |................|
000005c0 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
000005d0 00 f8 4f 64 ff ff 4f 64 00 00 20 64 03 00 01 00 |..Od..Od.. d....|
000005e0 00 00 ff ff 00 00 00 00 00 00 00 00 62 6f 6f 74 |............boot|
000005f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000600 00 00 00 00 00 00 00 00 00 00 00 00 23 00 01 00 |............#...|
00000610 80 00 00 00 bf 00 00 00 00 00 00 00 ff ff ff ff |................|
00000620 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000630 00 00 00 00 00 f8 8f 81 ff ff 8f 81 00 00 10 81 |................|
00000640 03 00 01 00 00 00 ff ff 02 00 00 00 00 00 00 00 |................|
00000650 72 65 63 6f 76 65 72 79 00 00 00 00 00 00 00 00 |recovery........|
00000660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000670 2f 00 01 00 c0 00 00 00 ff 00 00 00 00 00 00 00 |/...............|
00000680 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000690 ff ff ff ff 00 00 00 00 00 f8 8f 81 ff ff 8f 81 |................|
000006a0 00 00 10 81 03 00 01 00 00 00 ff ff 02 00 00 00 |................|
000006b0 00 00 00 00 63 64 72 6f 6d 00 00 00 00 00 00 00 |....cdrom.......|
000006c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000006d0 00 00 00 00 21 00 05 00 00 01 00 00 6f 01 00 00 |....!.......o...|
000006e0 03 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
000006f0 ff ff ff ff ff ff ff ff 00 00 00 00 00 f8 db 8b |................|
00000700 ff ff db 8b 00 00 00 8b 03 00 00 00 00 00 ff ff |................|
00000710 01 00 00 00 00 00 00 00 6d 69 73 63 00 00 00 00 |........misc....|
00000720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000730 00 00 00 00 00 00 00 00 2c 00 00 00 70 01 00 00 |........,...p...|
00000740 73 01 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |s...............|
00000750 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000760 ff ff ff ff ff ff ff ff ff ff ff ff 03 00 00 00 |................|
00000770 00 00 ff ff 00 00 00 00 00 00 00 00 63 69 64 00 |............cid.|
00000780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000790 00 00 00 00 00 00 00 00 00 00 00 00 2b 00 00 00 |............+...|
000007a0 74 01 00 00 77 01 00 00 00 00 00 00 ff ff ff ff |t...w...........|
000007b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
000007c0 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
000007d0 03 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
000007e0 6b 70 61 6e 69 63 00 00 00 00 00 00 00 00 00 00 |kpanic..........|
000007f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000800 35 00 00 00 78 01 00 00 97 01 00 00 00 00 00 00 |5...x...........|
00000810 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000820 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000830 ff ff ff ff 03 00 00 00 00 00 ff ff 00 00 00 00 |................|
00000840 00 00 00 00 73 79 73 74 65 6d 00 00 00 00 00 00 |....system......|
00000850 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000860 00 00 00 00 27 00 05 00 98 01 00 00 cf 0b 00 00 |....'...........|
00000870 03 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000880 ff ff ff ff ff ff ff ff 00 00 00 00 00 f8 fb 9e |................|
00000890 ff ff fb 9e 00 00 90 8a 03 00 00 00 00 00 ff ff |................|
000008a0 04 00 00 00 00 00 00 00 70 72 65 6b 00 00 00 00 |........prek....|
000008b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000008c0 00 00 00 00 00 00 00 00 20 00 01 00 d0 0b 00 00 |........ .......|
000008d0 d3 0b 00 00 03 00 00 00 ff ff ff ff ff ff ff ff |................|
000008e0 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
000008f0 00 f8 71 8a ff ff 71 8a 00 00 70 8a 03 00 01 00 |..q...q...p.....|
00000900 00 00 ff ff 01 00 00 00 00 00 00 00 70 6b 62 61 |............pkba|
00000910 63 6b 75 70 00 00 00 00 00 00 00 00 00 00 00 00 |ckup............|
00000920 00 00 00 00 00 00 00 00 00 00 00 00 2e 00 01 00 |................|
00000930 d4 0b 00 00 d7 0b 00 00 03 00 00 00 ff ff ff ff |................|
00000940 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000950 00 00 00 00 00 f8 71 8a ff ff 71 8a 00 00 70 8a |......q...q...p.|
00000960 03 00 01 00 00 00 ff ff 01 00 00 00 00 00 00 00 |................|
00000970 63 61 63 68 65 00 00 00 00 00 00 00 00 00 00 00 |cache...........|
00000980 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000990 28 00 00 00 d8 0b 00 00 17 12 00 00 00 00 00 00 |(...............|
000009a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
000009b0 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff |................|
000009c0 ff ff ff ff 03 00 00 00 00 00 ff ff 00 00 00 00 |................|
000009d0 00 00 00 00 75 73 65 72 64 61 74 61 00 00 00 00 |....userdata....|
000009e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000009f0 00 00 00 00 25 00 00 00 18 12 00 00 ff 1f 00 00 |....%...........|
00000a00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000a10 ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff |................|
00000a20 ff ff ff ff ff ff ff ff 03 00 00 00 00 00 ff ff |................|
00000a30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000a60 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000a70 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000a80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000a90 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000aa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000ac0 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff |................|
00000ad0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000ae0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000af0 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
00000b00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000b30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000b40 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000b50 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 00 00 |................|
00000b60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000b90 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000ba0 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 |................|
00000bb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff |................|
00000bc0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000bf0 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000c00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000c10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000c20 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000c30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000c50 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff |................|
00000c60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000c70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000c80 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
00000c90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000cc0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000cd0 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000ce0 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 00 00 |................|
00000cf0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000d20 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000d30 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 |................|
00000d40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff |................|
00000d50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000d80 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000d90 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000da0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000db0 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000dc0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000de0 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff |................|
00000df0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000e00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000e10 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
00000e20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000e50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000e60 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000e70 00 00 00 00 00 00 00 00 00 00 ff ff 00 00 00 00 |................|
00000e80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000eb0 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000ec0 ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 |................|
00000ed0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff |................|
00000ee0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000f10 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000f20 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 |................|
00000f30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000f40 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000f50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000f70 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff |................|
00000f80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
00000f90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000fa0 00 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00 |................|
00000fb0 00 20 00 00 00 20 00 00 e8 ff 03 00 18 00 00 00 |. ... ..........|
00000fc0 ce ff 01 00 32 00 00 00 00 00 00 00 00 00 00 00 |....2...........|
00000fd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00002000 05 00 00 00 01 00 41 54 00 00 00 00 00 10 00 00 |......AT........|
00002010 00 00 00 00 42 00 00 00 09 00 41 54 63 6f 6e 73 |....B.....ATcons|
00002020 6f 6c 65 3d 2f 64 65 76 2f 6e 75 6c 6c 20 72 77 |ole=/dev/null rw|
00002030 20 6d 65 6d 3d 34 39 38 4d 40 30 78 38 30 43 30 | [email protected]|
00002040 30 30 30 30 20 69 6e 69 74 3d 2f 69 6e 69 74 20 |0000 init=/init |
00002050 69 70 3d 6f 66 66 20 62 72 64 72 65 76 3d 50 33 |ip=off brdrev=P3|
00002060 41 20 61 6e 64 72 6f 69 64 62 6f 6f 74 2e 62 6f |A androidboot.bo|
00002070 6f 74 6c 6f 61 64 65 72 3d 30 78 30 30 30 30 20 |otloader=0x0000 |
00002080 20 6d 6d 63 70 61 72 74 73 3d 6d 6d 63 62 6c 6b | mmcparts=mmcblk|
00002090 31 3a 70 37 28 70 64 73 29 2c 70 31 35 28 62 6f |1:p7(pds),p15(bo|
000020a0 6f 74 29 2c 70 31 36 28 72 65 63 6f 76 65 72 79 |ot),p16(recovery|
000020b0 29 2c 70 31 37 28 63 64 72 6f 6d 29 2c 70 31 38 |),p17(cdrom),p18|
000020c0 28 6d 69 73 63 29 2c 70 31 39 28 63 69 64 29 2c |(misc),p19(cid),|
000020d0 70 32 30 28 6b 70 61 6e 69 63 29 2c 70 32 31 28 |p20(kpanic),p21(|
000020e0 73 79 73 74 65 6d 29 2c 70 32 32 28 70 72 65 6b |system),p22(prek|
000020f0 29 2c 70 32 33 28 70 6b 62 61 63 6b 75 70 29 2c |),p23(pkbackup),|
00002100 70 32 34 28 63 61 63 68 65 29 2c 70 32 35 28 75 |p24(cache),p25(u|
00002110 73 65 72 64 61 74 61 29 00 00 00 00 00 00 00 00 |serdata)........|
00002120 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff |................|
00002130 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
000037f0 ff ff ff ff ff ff ff ff ff ff ff ff 04 00 00 00 |................|
00003800 b4 01 00 ca 02 14 da 95 1b 6d dc 97 07 ce 40 ea |[email protected]|
00003810 53 0f 90 20 91 b5 20 dd 2f f3 00 30 ff ff 00 00 |S.. .. ./..0....|
00003820 02 4e 29 96 c8 e8 57 58 1f 75 18 bb b5 76 e1 8a |.N)...WX.u...v..|
00003830 17 57 c8 78 c3 1d 01 02 0c 30 00 11 01 89 07 00 |.W.x.....0......|
00003840 00 00 00 38 00 00 00 03 d3 02 07 6d 23 ff bc be |...8.......m#...|
00003850 5e c2 c1 e9 cb 5c 8c 4c c1 49 e3 ce 38 88 88 67 |^....\.L.I..8..g|
00003860 f7 37 a8 60 bf 43 ec b6 15 7d ad b4 93 03 ce 78 |.7.`.C...}.....x|
00003870 3b a5 4b fc 30 e8 cf 39 b0 5c 9c ac a1 d2 cf 59 |;.K.0..9.\.....Y|
00003880 77 3b ff f8 2c 86 5a e9 48 43 86 0e 9e ac f9 88 |w;..,.Z.HC......|
00003890 61 b2 b3 14 5f c2 58 28 86 44 f6 9a ad be f1 74 |a..._.X(.D.....t|
000038a0 bd ba ed 1b e4 bc 19 af d9 22 a4 e9 84 66 39 77 |........."...f9w|
000038b0 a3 76 81 90 fe 52 cc 96 77 ac ee a6 91 b1 5f 1b |.v...R..w....._.|
000038c0 4f b2 45 80 f1 15 b8 6f 52 92 01 02 01 00 04 2e |O.E....oR.......|
000038d0 4f 3d 4d 6f 74 6f 72 6f 6c 61 20 49 6e 63 2c 20 |O=Motorola Inc, |
000038e0 4f 55 3d 4d 6f 74 6f 72 6f 6c 61 20 50 4b 49 2c |OU=Motorola PKI,|
000038f0 20 43 4e 3d 48 41 42 20 43 41 20 34 37 33 4b b3 | CN=HAB CA 473K.|
00003900 8b c1 67 ea d6 41 01 00 04 39 4f 3d 4d 6f 74 6f |..g..A...9O=Moto|
00003910 72 6f 6c 61 20 49 6e 63 2c 20 4f 55 3d 4d 6f 74 |rola Inc, OU=Mot|
00003920 6f 72 6f 6c 61 20 50 4b 49 2c 20 43 4e 3d 43 53 |orola PKI, CN=CS|
00003930 46 20 43 41 20 34 37 33 2d 31 3b 20 53 4e 3d 34 |F CA 473-1; SN=4|
00003940 34 39 36 02 00 00 03 01 00 01 00 80 bb a5 81 22 |496............"|
00003950 50 33 87 0c f6 98 95 25 f2 f9 15 42 d1 55 81 e0 |P3.....%...B.U..|
00003960 30 29 ce da fc 04 97 f4 0a 2b 2d 2e bc 9c b4 26 |0).......+-....&|
00003970 a2 00 da 9a e8 9c 32 34 0d cf b0 e1 aa a8 6e 41 |......24......nA|
00003980 36 17 11 66 bd 71 fe fd 64 fd 44 27 4e 8f a9 bd |6..f.q..d.D'N...|
00003990 a6 1e 95 58 c5 3c 12 35 47 e0 5d 06 21 c8 c9 f6 |...X.<.5G.].!...|
000039a0 84 b2 03 62 f6 25 f6 1c 66 4f 48 e1 32 90 f4 28 |...b.%..fOH.2..(|
000039b0 9b 7c f7 63 8e 1d de 8d 1c 0a 1e e0 1a ae 2d 22 |.|.c..........-"|
000039c0 cd 84 0e 23 7e b6 da 83 89 03 77 3d 00 80 31 35 |...#~.....w=..15|
000039d0 19 89 b2 a9 9f c6 fb 79 c7 7d a7 ce 25 76 9c d9 |.......y.}..%v..|
000039e0 99 77 76 3d 89 28 71 e6 da cc 84 35 cc b6 cf be |.wv=.(q....5....|
000039f0 54 86 1f 9b 76 43 3d ec 9d 63 c0 c9 e1 2c d4 cf |T...vC=..c...,..|
00003a00 46 47 28 fb da db 0c 6c 46 cc 08 6f ea 41 96 6a |FG(....lF..o.A.j|
00003a10 38 6d bd 67 58 24 17 e5 e1 a7 63 7e dc 8a 85 13 |8m.gX$....c~....|
00003a20 f8 1f 43 3a c3 59 0b 3a 6f 7e 81 41 23 21 c4 0e |..C:.Y.:o~.A#!..|
00003a30 62 27 50 b4 ea f6 ef 70 b5 03 d1 6d 4d d7 8a 40 |b'[email protected]|
00003a40 7b 05 09 94 35 00 c0 5f b5 af 5d 4d b4 c0 01 02 |{...5.._..]M....|
00003a50 01 00 04 30 4f 3d 4d 6f 74 6f 72 6f 6c 61 20 49 |...0O=Motorola I|
00003a60 6e 63 2c 20 4f 55 3d 4d 6f 74 6f 72 6f 6c 61 20 |nc, OU=Motorola |
00003a70 50 4b 49 2c 20 43 4e 3d 43 53 46 20 43 41 20 34 |PKI, CN=CSF CA 4|
00003a80 37 33 2d 31 4b b3 8c 73 67 ea d6 f3 01 00 04 38 |73-1K..sg......8|
00003a90 4f 3d 4d 6f 74 6f 72 6f 6c 61 20 49 6e 63 2c 20 |O=Motorola Inc, |
00003aa0 4f 55 3d 4d 6f 74 6f 72 6f 6c 61 20 50 4b 49 2c |OU=Motorola PKI,|
00003ab0 20 43 4e 3d 41 50 50 20 34 37 33 2d 31 2d 32 3b | CN=APP 473-1-2;|
00003ac0 20 53 4e 3d 34 34 39 38 02 00 00 03 01 00 01 00 | SN=4498........|
00003ad0 80 9f 29 51 44 9e 39 88 e3 d4 b3 57 95 22 9f 19 |..)QD.9....W."..|
00003ae0 94 14 94 2d ce 30 b5 57 24 c5 59 0f f5 4a f9 5d |...-.0.W$.Y..J.]|
00003af0 78 d4 95 0f aa 94 fa e3 9d 82 ea 61 28 ff 38 7f |x..........a(.8.|
00003b00 85 86 9c 14 70 36 11 91 44 d7 cc d0 e0 00 fa 2b |....p6..D......+|
00003b10 e6 79 63 b9 a7 e7 b5 95 3b 86 89 d6 e3 80 e6 f5 |.yc.....;.......|
00003b20 2f 0c 12 22 63 3e 4a f4 07 cc 53 f4 f7 12 40 aa |/.."c>[email protected]|
00003b30 39 fe 20 8d ca f0 52 5d 77 85 82 35 4b 5d 9d 2d |9. ...R]w..5K].-|
00003b40 87 24 15 d0 cc fe 66 a8 13 fd e0 c7 13 75 24 4e |.$....f......u$N|
00003b50 43 00 80 46 8c ba 26 19 32 88 53 b6 49 18 98 e5 |C..F..&.2.S.I...|
00003b60 af 90 1e fd f0 46 b5 1c 7f 43 cc 97 ab 47 16 70 |.....F...C...G.p|
00003b70 4a d5 34 5a ca ae 7c 14 25 ab 3d 7a 0e f1 6f 15 |J.4Z..|.%.=z..o.|
00003b80 83 0b b2 9b 45 15 b8 47 87 bc 03 83 3b 59 0f 09 |....E..G....;Y..|
00003b90 d1 ca 72 b0 d6 c0 6e 28 7d 86 68 cc 29 70 77 e5 |..r...n(}.h.)pw.|
00003ba0 72 72 74 ad 6c a1 c4 07 9d ca 9f 5d 8a 64 0f 2d |rrt.l......].d.-|
00003bb0 a7 d7 8f 20 fe 00 06 ae 6d 50 c4 86 87 30 4a d8 |... ....mP...0J.|
00003bc0 96 70 32 85 c3 2c 22 4e 3d 8b 24 01 98 90 18 20 |.p2..,"N=.$.... |
00003bd0 e5 e8 8c 1f ae 5f 1a cb d8 0c 3c 39 99 6e 2c f9 |....._....<9.n,.|
00003be0 32 6c ad 71 77 96 76 7f 3d 58 cb 7e 30 ce 90 b2 |2l.qw.v.=X.~0...|
00003bf0 3b 65 88 52 ce 97 4f b0 08 12 3d 3a 6b 91 fe 84 |;e.R..O...=:k...|
00003c00 1f 77 df b8 1d 18 9d 70 75 f4 3f 0a 2b 50 10 22 |.w.....pu.?.+P."|
00003c10 ea 7d e1 fb 4f d2 fd ec 96 e1 4d 61 1b 9c d1 bc |.}..O.....Ma....|
00003c20 b2 c4 40 42 2e e3 23 f6 cd 7f 18 a3 44 f8 ba 45 |[email protected]#.....D..E|
00003c30 dc c8 5c db 6c 29 13 c8 f1 f6 36 c1 23 97 1a ae |..\.l)....6.#...|
00003c40 9f 82 65 40 8d b5 b7 54 97 c7 3d 71 9c 64 68 d2 |[email protected]=q.dh.|
00003c50 71 8c 2f ff ff ff ff ff ff ff ff ff ff ff ff ff |q./.............|
00003c60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00004800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00010000
Hi,
I have a problem with an Asus TF700T. I had Clockworkmod Recovery installed and tried using it to flash Cyanogenmod. The flash failed and since then, CWM can't mount /data, /system or any other partition from the internal flash memory. I've then used fastboot to flash a new version of CWM, but also the new version (6.0.4.7) can't mount the partitions.
I fear the partition table of /dev/block/mmcblk0 may have been damaged, but recovery works fine. I have access to CWM, adb and fastboot.
Is there a way to fix the partition table or some other way of making the partitions mountable?
I used adb shell for some diagnostics:
cat /proc/partitions
major minor #blocks name
179 0 62087168 mmcblk0
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 48 15558144 mmcblk1
179 49 15554048 mmcblk1p1
After a reboot (with a half installed Cyanogenmod) somehow, the output is:~ # cat /proc/partitions, but CWM still can't mount /data, /system, etc...
major minor #blocks name
179 0 62087168 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 59976192 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 8192 mmcblk0p10
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 48 15558144 mmcblk1
179 49 15554048 mmcblk1p1
Output of dmesg| grep mmc
Code:
dmesg|grep mmc
<5>[ 0.000000] Kernel command line: tegra_wdt.heartbeat=30 tegraid=30.1.3.0.0 [email protected] commchip_id=0 vmalloc=768M androidboot.serialno=015d29955e54260c androidboot.commchip_id=0 video=tegrafb no_console_suspend=1 console=ttyS0,115200n8 debug_uartport=lsport,0 usbcore.old_scheme_first=1 [email protected] [email protected] core_edp_mv=0 audio_codec=wm8903 board_info=245:0:fc:a6:29 tegraboot=sdmmc gpt gpt_sector=124174335 modem_id=0 android.kerneltype=recovery androidboot.productid=0x04 androidboot.carrier=wifi-only
<6>[ 0.805791] print_constraints: fixed_reg_en_3v3_emmc: 3300 mV normal standby
<6>[ 0.805974] set_supply: fixed_reg_en_3v3_emmc: supplied by fixed_reg_en_3v3_sys
<6>[ 3.640685] [mmc]:sdhci_tegra_probe:1152 mmc0: built_in 1
<4>[ 3.642707] mmc0: Invalid maximum block size, assuming 512 bytes
<6>[ 3.642994] mmc0: no vmmc regulator found
<7>[ 3.644267] Registered led device: mmc0::
<6>[ 3.646836] [mmc]:mmc_schedule_delayed_work:84 mmc0: delay 0
<6>[ 3.646987] mmc0: SDHCI controller on sdhci-tegra.3 [sdhci-tegra.3] using ADMA
<4>[ 3.648498] mmc1: Invalid maximum block size, assuming 512 bytes
<6>[ 3.648779] mmc1: no vmmc regulator found
<7>[ 3.650058] Registered led device: mmc1::
<6>[ 3.652575] [mmc]:mmc_schedule_delayed_work:84 mmc1: delay 0
<6>[ 3.652723] mmc1: SDHCI controller on sdhci-tegra.2 [sdhci-tegra.2] using ADMA
<6>[ 3.653397] [mmc]:sdhci_tegra_probe:1099 mmc2: non-built_in 0
<4>[ 3.656192] mmc2: Invalid maximum block size, assuming 512 bytes
<6>[ 3.656475] mmc2: no vmmc regulator found
<7>[ 3.657758] Registered led device: mmc2::
<6>[ 3.660210] [mmc]:mmc_schedule_delayed_work:84 mmc2: delay 0
<6>[ 3.660469] mmc2: SDHCI controller on sdhci-tegra.0 [sdhci-tegra.0] using ADMA
<6>[ 3.761658] [mmc]:mmc_decode_cid:118 prv: 0x6f, manfid: 0x90
<6>[ 3.773320] [mmc]:mmc_read_ext_csd:365 Boot Block Expose, boot size of mmc0 is 8388608
<6>[ 3.775552] mmc0: new high speed DDR MMC card at address 0001
<6>[ 3.776088] mmcblk mmc0:0001: Card claimed for testing.
<6>[ 3.776781] mmcblk0: mmc0:0001 HYNIX 59.2 GiB
<6>[ 3.777369] mmcblk0boot0: mmc0:0001 HYNIX partition 1 4.00 MiB
<6>[ 3.778074] mmcblk0boot1: mmc0:0001 HYNIX partition 2 4.00 MiB
<6>[ 3.794728] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
<6>[ 3.808067] mmcblk0boot1: unknown partition table
<6>[ 3.812871] mmcblk0boot0: unknown partition table
<6>[ 3.815515] [mmc]:mmc_rescan_try_freq:2010 mmc0: eMMC completed
<4>[ 4.042757] mmc2: host does not support reading read-only switch. assuming write-enable.
<6>[ 4.046107] mmc2: new high speed SDHC card at address e624
<6>[ 4.046532] mmcblk mmc2:e624: Card claimed for testing.
<6>[ 4.047366] mmcblk1: mmc2:e624 SU16G 14.8 GiB
<6>[ 4.058056] mmcblk1: p1
<6>[ 4.058913] [mmc]:mmc_rescan_try_freq:2006 mmc2: SD completed
<6>[ 4.996531] [mmc]:mmc_schedule_delayed_work:84 mmc1: delay 0
<4>[ 5.052746] mmc1 clock request: 50000KHz. currently 48000KHz
<6>[ 5.054371] mmc1: new high speed SDIO card at address 0001
<6>[ 5.062845] [mmc]:mmc_rescan_try_freq:2002 mmc1: sdio completed
<6>[ 7.693501] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
<7>[ 7.693580] SELinux: initialized (dev mmcblk0p2, type ext4), uses xattr
Can someone please shed some light on this? Thank you very much!
giza1928 said:
major minor #blocks name
179 0 62087168 mmcblk0
179 1 786432 mmcblk0p1
179 2 438272 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 835584 mmcblk0p4
179 5 5120 mmcblk0p5
179 6 512 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 59976192 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 8192 mmcblk0p10
179 32 4096 mmcblk0boot1
179 16 4096 mmcblk0boot0
179 48 15558144 mmcblk1
179 49 15554048 mmcblk1p1
...
<6>[ 3.794728] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
Click to expand...
Click to collapse
That looks quite correct. What happens when you try to mount /data manually?
mount -t ext4 /dev/block/mmcblk0p8 /data
Click to expand...
Click to collapse
_that said:
That looks quite correct. What happens when you try to mount /data manually?
Click to expand...
Click to collapse
Thanks, good idea. But unfortunately, the error message isn't very detailed:
Code:
mount -t ext4 /dev/block/mmcblk0p8 /data
mount: mounting /dev/block/mmcblk0p8 on /data failed: Invalid argument
I also tried to check the filesystem with e2fsck:
Code:
~ # e2fsck /dev/block/mmcblk0p8
e2fsck 1.41.14 (22-Dec-2010)
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/block/mmcblk0p8
The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
giza1928 said:
Thanks, good idea. But unfortunately, the error message isn't very detailed:
Code:
mount -t ext4 /dev/block/mmcblk0p8 /data
mount: mounting /dev/block/mmcblk0p8 on /data failed: Invalid argument
Click to expand...
Click to collapse
Is there any message in dmesg after trying this?
What do you get from "hexdump -C -n 2048 /dev/block/mmcblk0p8"?
_that said:
Is there any message in dmesg after trying this?
What do you get from "hexdump -C -n 2048 /dev/block/mmcblk0p8"?
Click to expand...
Click to collapse
No, no messages in dmesg after the mount command, only updates like this:
Code:
<4>[ 81.890682] cpu ext_temperature=26
The output from the hexdump command:
Code:
~ # hexdump -C -n 2048 /dev/block/mmcblk0p8
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
giza1928 said:
The output from the hexdump command:
Code:
~ # hexdump -C -n 2048 /dev/block/mmcblk0p8
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
Click to expand...
Click to collapse
Funny. Normally the superblock should start at offset 0x400. Yours appears to have gotten wiped.
Try the same command on mmcblk0p1, mmcblk0p2, mmcblk0p3, mmcblk0p5 and post the results just to find out what's going on.
_that said:
Funny. Normally the superblock should start at offset 0x400. Yours appears to have gotten wiped.
Try the same command on mmcblk0p1, mmcblk0p2, mmcblk0p3, mmcblk0p5 and post the results just to find out what's going on.
Click to expand...
Click to collapse
p1:
Code:
hexdump -C -n 2048 /dev/block/mmcblk0p1
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400 00 c0 00 00 00 00 03 00 00 00 00 00 95 ce 01 00 |................|
00000410 d2 b9 00 00 00 00 00 00 02 00 00 00 02 00 00 00 |................|
00000420 00 80 00 00 00 80 00 00 00 20 00 00 38 e3 78 53 |......... ..8.xS|
00000430 38 e3 78 53 05 00 ff ff 53 ef 01 00 02 00 00 00 |8.xS....S.......|
00000440 d2 aa 78 53 00 00 00 00 00 00 00 00 01 00 00 00 |..xS............|
00000450 00 00 00 00 0b 00 00 00 00 01 00 00 1c 00 00 00 |................|
00000460 42 00 00 00 13 00 00 00 57 f8 f4 bc ab f4 65 5f |B.......W.....e_|
00000470 bf 67 94 6f c0 f9 f2 5b 00 00 00 00 00 00 00 00 |.g.o...[........|
00000480 00 00 00 00 00 00 00 00 2f 73 79 73 74 65 6d 00 |......../system.|
00000490 e8 0a 29 c0 00 9c a6 c7 b0 ca b7 c6 00 00 00 00 |..).............|
000004a0 48 b4 54 c7 e0 a3 58 c6 fc fd e0 c6 c8 fd e0 c6 |H.T...X.........|
000004b0 fc 7e 12 c0 80 f3 1a c0 e4 fd e0 c6 74 f3 1a c0 |.~..........t...|
000004c0 bc c7 7c c0 00 9c a6 c7 00 00 00 00 00 00 2f 00 |..|.........../.|
000004d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000004e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000004f0 00 00 00 00 00 00 00 00 00 00 00 00 02 01 20 00 |.............. .|
00000500 00 00 00 00 00 00 00 00 00 00 00 00 0a f3 01 00 |................|
00000510 03 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 |................|
00000520 33 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |3...............|
00000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000550 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 1c 00 |................|
00000560 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000570 00 00 00 00 00 00 00 00 ec 83 04 00 00 00 00 00 |................|
00000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
p2:
Code:
~ # hexdump -C -n 2048 /dev/block/mmcblk0p2
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400 00 6b 00 00 00 ac 01 00 00 00 00 00 86 86 01 00 |.k..............|
00000410 dc 6a 00 00 00 00 00 00 02 00 00 00 02 00 00 00 |.j..............|
00000420 00 80 00 00 00 80 00 00 c0 1a 00 00 f3 eb 78 53 |..............xS|
00000430 f3 eb 78 53 08 00 ff ff 53 ef 01 00 02 00 00 00 |..xS....S.......|
00000440 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 |................|
00000450 00 00 00 00 0b 00 00 00 00 01 00 00 1c 00 00 00 |................|
00000460 46 00 00 00 13 00 00 00 57 f8 f4 bc ab f4 65 5f |F.......W.....e_|
00000470 bf 67 94 6f c0 f9 f2 5b 00 00 00 00 00 00 00 00 |.g.o...[........|
00000480 00 00 00 00 00 00 00 00 2f 63 61 63 68 65 00 e8 |......../cache..|
00000490 0a 29 c0 c0 dd d6 c6 88 d3 b8 c6 00 00 00 00 b8 |.)..............|
000004a0 eb b8 c6 20 cb 81 c7 fc dd da c6 c8 dd da c6 fc |... ............|
000004b0 7e 12 c0 80 f3 1a c0 e4 dd da c6 74 f3 1a c0 bc |~..........t....|
000004c0 c7 7c c0 c0 dd d6 c6 d8 00 00 00 00 00 00 1f 00 |.|..............|
000004d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000004e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000004f0 00 00 00 00 00 00 00 00 00 00 00 00 02 01 20 00 |.............. .|
00000500 00 00 00 00 00 00 00 00 00 00 00 00 0a f3 01 00 |................|
00000510 03 00 00 00 00 00 00 00 00 00 00 00 b0 06 00 00 |................|
00000520 cf 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000550 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 1c 00 |................|
00000560 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000570 00 00 00 00 00 00 00 00 ec 18 00 00 00 00 00 00 |................|
00000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
p3:
Code:
~ # hexdump -C -n 2048 /dev/block/mmcblk0p3
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
p5:
Code:
~ # hexdump -C -n 2048 /dev/block/mmcblk0p5
00000000 eb 58 90 42 53 44 20 20 34 2e 34 00 02 08 20 00 |.X.BSD 4.4... .|
00000010 02 00 00 00 28 f0 00 00 10 00 04 00 00 00 00 00 |....(...........|
00000020 00 00 00 00 0a 00 00 00 00 00 00 00 02 00 00 00 |................|
00000030 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000040 00 00 29 d2 07 38 a4 4e 4f 20 4e 41 4d 45 20 20 |..)..8.NO NAME |
00000050 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 bc | FAT32 .1....|
00000060 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 fc |.|......^.......|
00000070 ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 cd |...t.......0....|
00000080 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 69 |...Non-system di|
00000090 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b 65 |sk..Press any ke|
000000a0 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 00 |y to reboot.....|
000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000200 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 00 |RRaA............|
00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000003e0 00 00 00 00 72 72 41 61 ff ff ff ff 0d 00 00 00 |....rrAa........|
000003f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000400 eb 58 90 42 53 44 20 20 34 2e 34 00 02 08 20 00 |.X.BSD 4.4... .|
00000410 02 00 00 00 28 f0 00 00 10 00 04 00 00 00 00 00 |....(...........|
00000420 00 00 00 00 0a 00 00 00 00 00 00 00 02 00 00 00 |................|
00000430 01 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000440 00 00 29 d2 07 38 a4 4e 4f 20 4e 41 4d 45 20 20 |..)..8.NO NAME |
00000450 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 bc | FAT32 .1....|
00000460 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 fc |.|......^.......|
00000470 ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 cd |...t.......0....|
00000480 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 69 |...Non-system di|
00000490 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b 65 |sk..Press any ke|
000004a0 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 00 |y to reboot.....|
000004b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000005f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000600 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 00 |RRaA............|
00000610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000007e0 00 00 00 00 72 72 41 61 ff ff ff ff 02 00 00 00 |....rrAa........|
000007f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000800
Thanks already for your help, to be honest I have no clue what I'm looking at. Are those the first 2048 bits of each partition?
giza1928 said:
Thanks already for your help, to be honest I have no clue what I'm looking at. Are those the first 2048 bits of each partition?
Click to expand...
Click to collapse
Yes. All other partitions except /data look normal - p1 is /system, p2 is /cache, p3 is the bootloader command partition which is usually empty, p5 contains device configuration in a FAT32 filesystem.
Try formatting /data from the recovery, then reinstall your ROM (which will format and fill /system).
_that said:
Yes. All other partitions except /data look normal - p1 is /system, p2 is /cache, p3 is the bootloader command partition which is usually empty, p5 contains device configuration in a FAT32 filesystem.
Try formatting /data from the recovery, then reinstall your ROM (which will format and fill /system).
Click to expand...
Click to collapse
Ok, do you mean the format command I can select in recovery? Because it says:
Code:
Formatting /data...
Error mounting /data!
Skipping format...
Done.
But can I maybe use mke2fs or something similar to format /dev/mmcblk0p8? If so, could you tell me what options I should use?
Thanks
giza1928 said:
Ok, do you mean the format command I can select in recovery? Because it says:
Code:
Formatting /data...
Error mounting /data!
Skipping format...
Done.
Click to expand...
Click to collapse
I have no experience with CWM; apparently it sucks.
giza1928 said:
But can I maybe use mke2fs or something similar to format /dev/mmcblk0p8? If so, could you tell me what options I should use?
Click to expand...
Click to collapse
Code:
make_ext4fs /dev/block/mmcblk0p8
should do it. Assuming that CWM ships with a make_ext4fs binary.
_that said:
I have no experience with CWM; apparently it sucks.
Code:
make_ext4fs /dev/block/mmcblk0p8
should do it. Assuming that CWM ships with a make_ext4fs binary.
Click to expand...
Click to collapse
Thanks, that worked! CWM does ship with make_ext4fs, I flashed Cyanogenmod and it booted successfully! :victory:
I figured I would post my experience with a sudden bootloop. My tf700t was unlocked and rooted a very long time ago and I've used a few ROM's since doing that. First was CROMI-x then Cyanogenmod 11 nightlies then CROMBi-kk and then I switched to ZOMBI-x.
I installed Zombi-x using F2FS file system and never had any issues except for the usual mind numbing lag from the horrible IO issues.
So just last night (12/21/2014) my tablet froze with a light grey screen and about 10 seconds later it rebooted, but it kept rebooting over and over. I tried cold booting, but that didn't help, so I booted into CWM (ver. 6.0.4.7) and tried to do a wipe data/system reset, but the tablet would just reboot part way through. I tried formatting the /data partition directly but it caused the tablet to reboot as well. So a few other posts around the interwebs led me to the conclusion that I needed to get rid of clockworkmod and switch to TWRP.
Thankfully I was able to connect to the tablet using fastboot, but only in Linux. (my Win7 PC saw that something was there, but it wouldn't let me install the driver)(http://lifehacker.com/the-easiest-way-to-install-androids-adb-and-fastboot-to-1586992378) So I installed TWRP 2.8.3.0 and used it to do a complete wipe. It started the format but had several errors about not being able to mount /data and then it said it was formatting Data using ext4fs. I've read that it should only take 5 minutes or so, so you can imagine my worry when 5 minutes past and then 10 and so on until it finished up after a little over 30 minutes, so if it's just sitting there, there's a good chance it is actually doing something, so leave it be for awhile and don't forget to check your battery, you don't want your tab to shut off suddenly!
I reinstalled CROMBi-kk and let it boot. Much to my surprise it booted and the resulting performance was nothing short of shocking!
So far this thing is running like it NEVER has before! The lag so far is so much less than ever and things open and close very quickly!
So without any surprise here, I won't be using F2FS anymore for fear I'll have corruption on the internal storage again! Thankfully TWRP came through for me. So if your tf700 is bootlooping and you still have fastboot, try installing the latest TWRP, it may just make the difference between a functioning tablet and a brick!
Viking8 said:
So I installed TWRP 2.8.3.0 and used it to do a complete wipe. It started the format but had several errors about not being able to mount /data and then it said it was formatting Data using ext4fs. I've read that it should only take 5 minutes or so, so you can imagine my worry when 5 minutes past and then 10 and so on until it finished up after a little over 30 minutes, so if it's just sitting there, there's a good chance it is actually doing something, so leave it be for awhile and don't forget to check your battery, you don't want your tab to shut off suddenly!
I reinstalled CROMBi-kk and let it boot. Much to my surprise it booted and the resulting performance was nothing short of shocking!
So far this thing is running like it NEVER has before! The lag so far is so much less than ever and things open and close very quickly!
Click to expand...
Click to collapse
The long time it takes for formatting and the performance gains are actually related. Creating the filesystem takes probably less than 5 minutes, but then the recovery does a "trim" on the free blocks - telling the eMMC that it may discard the data in these blocks and erase them. Erasing flash memory is slow. But following write requests by the booted ROM will be much faster because they can be written directly without prior erasing and shuffling data around.
_that said:
The long time it takes for formatting and the performance gains are actually related. Creating the filesystem takes probably less than 5 minutes, but then the recovery does a "trim" on the free blocks - telling the eMMC that it may discard the data in these blocks and erase them. Erasing flash memory is slow. But following write requests by the booted ROM will be much faster because they can be written directly without prior erasing and shuffling data around.
Click to expand...
Click to collapse
So the performance boost after formatting /data is temporary until the emmc again has to shuffle data around when it gets write requests?
I thought f2fs was supposed to take care of that?
berndblb said:
So the performance boost after formatting /data is temporary until the emmc again has to shuffle data around when it gets write requests?
I thought f2fs was supposed to take care of that?
Click to expand...
Click to collapse
Using f2fs should increase the time until the eMMC has to shuffle data around because it does less random writes. But when all blocks have been written once, something must be erased to rewrite more. The permanent solution is to run fstrim regularly (I've seen some comments in the Android source code that runs it automatically from time to time) or to mount with the discard option, and to leave a reasonable amount of space free (10 to 15%).
_that said:
Using f2fs should increase the time until the eMMC has to shuffle data around because it does less random writes. But when all blocks have been written once, something must be erased to rewrite more. The permanent solution is to run fstrim regularly (I've seen some comments in the Android source code that runs it automatically from time to time) or to mount with the discard option, and to leave a reasonable amount of space free (10 to 15%).
Click to expand...
Click to collapse
Enlightening as always! Happy Holidays to you and your family!
[emoji319] [emoji319] [emoji318] [emoji319] [emoji319]
It doesn't seem that lagfix can trim /data formated to f2fs.
Sent from my TF700T using Tapatalk
Tutorial/Guide for Re-partitioning MTK6589/MTK65xx + Increase your System & Data Partitions + Flash through CWM/TWRP + no need to use SPFlashTool
Part 1 :- To Flash existing modified EBR files through CWM/TWRP
There are plenty of guides for re-partitioning mtk devices, so why this one?
Well almost all of them suggest to use SPFlashTool to flash the "EBR" Files.
But we can do that by using CWM/TWRP (Custom Recoveries) as well!!!!!
no need to use SPFlashTool!
no need to format the Internal SDCard through PC!!
Just take your modified "EBR" files and put them into a Flashable Zip.
Edit the "updater-script" file to include the following lines.
Code:
[FONT="Comic Sans MS"][SIZE="3"][COLOR="Red"]package_extract_file("EBR1", "/dev/ebr1");
#put the name of your EBR1 file in place of "EBR1"
package_extract_file("EBR2", "/dev/ebr2");
#put the name of your EBR2 file in place of "EBR2"[/COLOR][/SIZE][/FONT]
Note :- If your device uses both the files then add both the lines and If your device uses only "EBR1" then add only the line of "EBR1".
Now add the following lines to format your "/system" , "/cache" and "/data" partitions.
Code:
[FONT="Comic Sans MS"][SIZE="3"][COLOR="Red"]
format("ext4", "EMMC", "/[email protected]", "0", "/system");
format("ext4", "EMMC", "/[email protected]", "0", "/cache");
format("ext4", "EMMC", "/[email protected]", "0", "/data");
[/COLOR][/SIZE][/FONT]
Note :- If you are going to increase your "/system" partition then you'll have to format the 3 partitions,
and if you just want to increase the "/data" partition then just include the lines for formatting "/cache" and "/data".
now save the "updater-script" file and replace it in the Flashable zip!!
Or , you can use this sample flashable zip file.
download it and put your EBR files in it!!!!
edit the "updater-script" file according to your need and replace it in the Flashable zip!!
copy the Flashable zip file to your external SDCard
reboot to recovery
select install from zip file and choose the flashable zip file
Flash it.
Remember after flashing the EBR files do not restore your previous CWM/TWRP Backup.
Just Flash any CWM/TWRP Flashable ROM available for your device!!
Wipe Dalvik Cache if you haven't done it already!!
reboot and see for yourself!!!
Disclaimer :-
I will not be in anyway responsible for any damage this might cause to your phone.
if you'll follow the instructions correctly, then everything will be fine.
Part 2 :-
for understanding your MTK device's partitions, first read this excellent guide posted by @tirta.agung --> [Noob Guide] Understanding the Hex value of MTK's MBR/EBR1/EBR2
So How to Increase the system partition? or the data partition?
I'll tell you!!
I use MMX Canvas HD A116 (mt6589)
it has 4GB internal storage distributed as below:
/system = 650mb
/cache = 126mb
/data = 1gb
Internal SDcard = 1.77gb
i wanted to change it to this:- (and i've done it!!!)
/system = 900mb
/cache = 126mb
/data = 2gb
Internal SDCard = remaining space i.e around 536mb
Note :- First please read the above mentioned guide, otherwise you won't understand this!!
let me try to make it simple to you
this is the hex format of "EBR1" & "EBR2"
EBR1 of MMX A116 (mt6589) :-
00 00 00 00 83 00 00 00 00 08 02 00 00 50 14 00 --> Partition 5 /system 650MB
00 00 00 00 83 00 00 00 00 58 16 00 00 f0 03 00 --> Partition 6 /cache 126MB
00 00 00 00 83 00 00 00 00 48 1a 00 00 00 20 00 --> Partition 7 /data 1GB
00 00 00 00 05 00 00 00 00 b4 01 00 ff ff ff ff --> points to ebr2
EBR2 of MMX A116 (mt6589) :-
00 00 00 00 83 00 00 00 00 94 38 00 ff b7 c5 ff --> partition 8 Internal SDCard
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Note :-
numbers in red --> Offset of partition
numbers in DarkOrange --> Size of Partition
Click to expand...
Click to collapse
Now if you notice carefully these partitions are continuous/contiguous.
133120 + 1331200 = 1464320
1464320 + 258048 = 1722368
i.e no.of sectors before partition + the length of the partition = no.of sectors before the next partition
// 133120 = no.of sectors before "/system" partition i.e "/system" starts from sector no. 133121
// 1331200 = the length of "/system" i.e "/system" is of 1331200 sectors.
// 1464320 = no.of sectors before "/cache" partition i.e "/cache" starts from sector no. 1464321
// and so on
The last line in EBR1 points to EBR2.
(This one --> 00 00 00 00 05 00 00 00 00 b4 01 00 ff ff ff ff )
and the First line in EBR2 is the one for the partition of Internal SDCard.
(This one --> 00 00 00 00 83 00 00 00 00 94 38 00 ff b7 c5 ff )
Even after reading many guides, I haven't found a proper explanation of this anywhere.
in one of them it states that,
D = (A + B) - C
where,
A = no.of sectors before "/data"
B = size of "/data"
C = offset of EBR2
D = offset part in EBR2
E = MaxValue - (A + B)
where,
MaxValue = FFFFFFFF (Hex) = 4294967295 (in decimal)
A = no.of sectors before "/data"
B = size of "/data"
E = Size part in EBR2
A = 00 48 1a 00 --> 001a4800 --> 1722368 //offset of "/data"
B = 00 00 20 00 --> 00200000 --> 2097152 //size of "/data"
C = 00 b4 01 00 --> 0001b400 --> 111616 //offset of ebr2
Max Value = FF FF FF FF --> ffffffff --> 4294967295 //?
Note :-
in Red --> Hex values in little endian
in Orange --> Hex values in big endian
in Blue --> Decimal values
Click to expand...
Click to collapse
D = (A+B) - C = (1722368 + 2097152) - 111616 = 3707904
E = MaxValue - (A+B) = 4294967295 - (1722368 + 2097152) = 4291147775
D = 3707904 = 00389400 = 00 94 38 00
E = 4291147775 = ffc5b7ff = ff b7 c5 ff
so now you've got a good idea of what the values in "EBR" files mean, haven't you!!
Now here comes the Important part i.e how to modify the partition sizes.
I wanted "/system" = 900mb , so
So we get "00 20 1C 00" as the value for 900mb
(note-down these new values as we'll need to use them later)
now as we've increased the size of system we need to change the offset of the next partition so that there won't be any overlapping/corruption of partitions.
and how do we do that --> "no.of sectors before partition + the length of the partition = no.of sectors before the next partition"
i.e 133120 + 1843200 = 1976320 //new offset of "/cache"
decimal value --> 1976320
Hex value in big endian --> 001E2800
Hex value in little endian --> 00 28 1E 00
So we get "00 28 1E 00" as the value for sectors before "/cache"
i don't want to change size of "/cache" so it remains same i.e "00 f0 03 00"
now we need to offset the "/data" partition
("no.of sectors before partition + the length of the partition = no.of sectors before the next partition")
1976320 + 258048 = 2234368 // the number of sectors before "/data" partition
decimal value --> 2234368
Hex value in big endian --> 00221800
Hex value in little endian --> 00 18 22 00
So we get "00 18 22 00" as the value for sectors before "/data"
now i want to make my "/data" to 2gb i.e 2048mb
So we get "00 00 40 00" as the value for 2048mb
The last line in EBR1 Points to EBR2 so don't make any changes to it!!!
So now our modified EBR1 Becomes like this:-
00 00 00 00 83 00 00 00 00 08 02 00 00 20 1c 00 --> Partition 5 /system 900MB
00 00 00 00 83 00 00 00 00 28 1E 00 00 f0 03 00 --> Partition 6 /cache 126MB
00 00 00 00 83 00 00 00 00 18 22 00 00 00 40 00 --> Partition 7 /data 2GB
00 00 00 00 05 00 00 00 00 b4 01 00 ff ff ff ff --> Link to ebr2
now we need to offset the Internal SDCard's partition which is in EBR2
calculate new D & E :-
D = (A+B) - C
where,
A = no.of sectors before "/data"
B = size of "/data"
C = offset of EBR2
E = MaxValue - (A+B)
where,
MaxValue = FFFFFFFF (Hex) = 4294967295 (Decimal)
A = no.of sectors before "/data"
B = size of "/data"
A = 00 18 22 00 --> 00221800 --> 2234368 //offset of "/data"
B = 00 00 40 00 --> 00400000 --> 4194304 //size of "/data"
C = 00 b4 01 00 --> 0001b400 --> 111616 //offset of ebr2
Max Value = FF FF FF FF --> ffffffff --> 4294967295 //?
D = (A+B) - C = (2234368 + 4194304) - 111616 = 6317056
E = MaxValue - (A+B) = 4294967295 - (2234368 + 4194304) = 4288538623
D = 6317056 = 00606400 = 00 64 60 00
E = 4288538623 = FF9DE7FF = ff e7 9d ff
That's it, now we've got all the values ,it's time to put them into the EBR Files.
So this is the result of our modification:-
Modified EBR1 :-
00 00 00 00 83 00 00 00 00 08 02 00 00 20 1c 00 --> Partition 5 /system 900MB
00 00 00 00 83 00 00 00 00 28 1E 00 00 f0 03 00 --> Partition 6 /cache 126MB
00 00 00 00 83 00 00 00 00 18 22 00 00 00 40 00 --> Partition 7 /data 2GB
00 00 00 00 05 00 00 00 00 b4 01 00 ff ff ff ff --> Link to ebr2
Modified EBR2 :-
00 00 00 00 83 00 00 00 00 64 60 00 ff e7 9d ff --> internal sdcard
To edit "EBR" files :-
Open your ERB1 & EBR2 files in hex editor and replace the respective values with our modified values.
save the files and put them into a flashable zip and flash through CWM/TWRP or whatever custom recovery that you use!!!!
Remember after flashing the EBR files do not restore your previous CWM/TWRP Backup.
Just Flash any CWM/TWRP Flashable ROM available for your device!!
Wipe Dalvik Cache if you haven't done it already!!
reboot and see for yourself!!!
Screenshots :-
Disclaimer :-
I will not be in anyway responsible for any damage this might cause to your phone.
if you'll follow the instructions correctly, then everything will be fine.
reserved for mods :-
If you want them resized according to your need then you can request it here or use this tutorial to do it yourself!!!
Hello,
i just remove my sdcard from my android phone (lollipop), iput another sd card inside to format, i make the format,
then i put back the original sd card ( samsung 16G ), but the phone refuse to mount it, and use it as internal memory, except if i format it .
the point is that i canot mount my sdcard not my pc (linux debian 8), so to get my data. the reason is an I/O error, and fdisk, dd, refuse to work with the sdcard. My OS cant report any partitions in card, and any try to read is an IO Error.
here is a snaphost of hdparm :
Code:
⟰ ohost3 ⚇ root
pts/0:0 ~ ➫ hdparm /dev/sdb
/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
multcount = 0 (off)
readonly = 0 (off)
readahead = 256 (on)
geometry = 15193/64/32, sectors = 31116288, start = 0
Code:
⟰ ohost3 ⚇ root
pts/0:0 ~ ➫ hdparm -I /dev/sdb
/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ATA device, with non-removable media
Standards:
Likely used: 1
Configuration:
soft sectored
head switch time > 15us
fixed drive
disk xfer rate <= 5Mbs
disk xfer rate > 5Mbs, <= 10Mbs
data strobe offset option
format speed tolerance gap reqd
Logical max current
cylinders 21314 0
heads 0 0
sectors/track 1 0
--
bytes/track: 512 bytes/sector: 0
Logical/Physical Sector size: 512 bytes
device size with M = 1024*1024: 0 MBytes
device size with M = 1000*1000: 0 MBytes
cache/buffer size = unknown
Capabilities:
IORDY not likely
Cannot perform double-word IO
R/W multiple sector transfer: not supported
DMA: not supported
PIO: pio0
any sugestion ?