Database Info

The Infuse 4G Development Platform AKA UnBrickable Mod

Introduction
This is the 10th device to receive UnBrickable Mod! Lets go back to where it all started. It was proposed by XDA Member js22 that a device could be recovered without JTAG, using only it's native hardware. After months upon months of research, reading debug logs, reverse engineering of hardware and software, we came up with a solution.. Since I was the first to do it, I called it UnBrickable Mod. XDA Member Rebellos then reverse engineered a portion of the IBL into what is known as the HIBL(Hummingbird Interceptor BootLoader). We decided to call it this because the process goes like this: With UBM applied, the processor requests a code download from USB. We feed it the HIBL which reuses IBL code to authenticate with the Hummingbird's secure booting chain, then the Interceptor bootloader calls back and reuses the same IROM Download code used to download it, but we bypass security checks. This "Interception" of the boot sequence is why UnBrickable Mod works. The HIBL has proven to be so powerful and multipurpose that we've been able to package it into a one-click which works with ALL S5PC110 based devices with USB download capabilities.
I'd like to thank pdx 528e for donating the Infuse4G for this modification. This modification would not have been possible on this particular device without total removal of the processor.
After we verify this modification works This will be a replacement for JTAG. How could it possibly be better then JTAG? Let's count the ways....
1. The only part required is a wire.
2. No shipping time.
3. No cost for a box to interface the computer.
4. Permanent.
5. Can be done as a preventive measure.
6. Gives the ability to test new Bootloaders temporarily.
7. Allows development of the entire system.
8. Removes worry about flashing and acts as a backup.
After performing this mod:
Remove the battery, replace the battery, your phone will connect to the computer via USB and await commands. Otherwise it will pretty much act like an Infuse 4G. See the Special Instructions section.
Modification
You will need:
1. Get someone who knows what they're doing with a soldering iron. If they don't know what flux is, then they don't know what they're doing. You can send me a PM(my username @gmail.com) or Connexion2005(aka MobileTechVideos.com).
2. soldering iron - make sure it's sharp, if it's not sharp, then sharpen it, flux it and retin it.
3. flux
4. solder
5. tweezers
6. A relay (for the wire contained within)
getting started:
You will need a very small peice of wire. Tear apart the relay unravel the coil within and grab about 12cm~ of wire. The fact that it comes from a relay is important because relays generally have very small wire which are individually treated with a non-conductive coating.
Take the 12cm~ wire from the relay and tin the very edge of it. No more then 1/32". If you tin more then 1mm, cut off the excess. It is desirable to have a slight bit of excess solder on the tip of this wire.
performing the modification:
1. tear apart your phone... remove six(6) #1 phillips screws from the back. Then you can separate the back from the front. Make sure to take out your SIM and external SDCard before you do this.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2. Remove the two(2) screws and four(4) electric connections securing the mainboard into the unit and remove the board.
3. remove the EM shield from the processor side.
4. remove xOM5 resistor.
5. Bridge the active side of xOM5 to the active side of xOM3. Most of the resistors in the top row will also work.
6. *OPTIONAL* for Bootloader development you will want UART output. You can use these points to a connection outside the device for UART. These points are exposed when the mainboard is secured to the unit. They are located on the JTAG port.
7. Reassemble the device.
Special Instructions
This replaces the battery charging sequence. The normal battery charging sequence can be activated by holding power for 4 seconds.
To turn on the device, and operate in normal mode, you must hold the power button for 5 seconds.
3 button Download mode works as usual, however you must not have the S5PC110 drivers installed on the computer. You can use your custom rom menu option, adb reboot download, or use a terminal to "reboot download". 301Kohm Factory Mode JIGs work as well, but you must press power to bypass the S5PC110 mode.
Conclusion
Congratulations. You now have a device which works like a KIT-S5PC110 with an OM Value of 29. Now get to developing some serious custom software.
reading material
Creating your own Samsung Bootloaders: http://forum.xda-developers.com/showthread.php?t=1233273
KIT-S5PC110 manual: http://www.mediafire.com/?94krzvvxksvmuxh
how to use DNW: http://tinyurl.com/dnw-how-to
Flash using openOCD and DNW: http://www.arm9board.net/wiki/index.php?title=Flash_using_OpenOCD_and_DNW
another DNW example: http://www.boardset.com/products/mv6410.php
ODroid dev center: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
drivers and utilities
This will be an ever expanding list
Windows Drivers http://forum.xda-developers.com/attachment.php?attachmentid=678937&d=1312590673
Windows Download Tool DNW: http://forum.xda-developers.com/attachment.php?attachmentid=678938&d=1312590673
Windows Command Line tool: http://forum.xda-developers.com/showpost.php?p=17202523&postcount=27
Linux DNW Utility: http://dev.odroid.com/projects/uboot/wiki/#s-7.2
Linux ModeDetect tool: http://code.google.com/p/hummingbird-hibl/downloads/list
Linux Automated UnBricker:http://code.google.com/p/hummingbird-hibl/downloads/list
firmware
Bootloader Hello World by Rebellos http://forum.xda-developers.com/attachment.php?attachmentid=698077&d=1314105521
UnBrick tool http://forum.xda-developers.com/showthread.php?t=1242466

At this time I have not performed this modification. If you are in a pinch, please use this method. I will be performing this mod on my own device shortly.

We confirmed this device has got another iROM build, this means different HW revision of CPU.
HIBL for that will be released soon.

U are a genius Adam
Sent from my SAMSUNG-SGH-I997 using xda premium

JordanElliott said:
U are a genius Adam
Sent from my SAMSUNG-SGH-I997 using xda premium
Click to expand...
Click to collapse
I second that. I'm ready to send my phone in.
I'm not a developer but I try to play one on XDA. Seriously I'm not a developer. DlevROM Yo!

Thanks. But my wife wont let me touch hers...
Edit. Her phone...LOL..
Sent from my SAMSUNG-SGH-I897 using XDA App

To much trouble .....but thanks anyway
Sent from my SAMSUNG-SGH-I997 using xda premium

To bad i'm a perfectionist that doesn't know how to solder; my baby is to new to put her through this lol.
Sent from my SGH-I997 using xda premium

oh man glad to see this here thanks

It would be good to mention a recommendation on soldering iron power. I mean I have 75 watt irons, and 150/400 watt guns, I like to use a bigger than needed iron because it reduces the heat up time and if you get it the first time reduces damage but only if you get it exactly at the right time.
But I wouldn't put any of those big tools near a computer or phone. I'd say 15 Watts is plenty, 25 is manageable if you are good and the to is sharp and clean, these small electronics are soldered with infrared and aren't even designed to have an iron used on them. Keep that in mind if you consider this mod! This can be tricky stuff that can damage your hardware.
Adam, has any progress been made on the galaxy s to boot Meego or Linux? I know you can install Linux to the sd card and run it along side Android using terminal emulator to access it like you posted in the captivate section a while back but I never saw it running with a GUI on the phone, if you Jeanne a way to accesses fluxbox with the phones touch screen, that would be cool even if I can't boot stair into Linux yet.

This is really great thx so does it mean the infuse can be like the hd2 run almost all the popular Smartphone operating systems ?

leeroy1034 said:
This is really great thx so does it mean the infuse can be like the hd2 run almost all the popular Smartphone operating systems ?
Click to expand...
Click to collapse
What it means is that if you are a developer that wants to develop a way to do those things you can do it without fear or bricking. I doubt it will lead to the infuse being the next hd2 but its a step in the direction.

I'm just hoping it means more roms to get my flashing addiction fix
Sent from my SAMSUNG-SGH-I997 using XDA App

The_Zodiac said:
I'm just hoping it means more roms to get my flashing addiction fix
Sent from my SAMSUNG-SGH-I997 using XDA App
Click to expand...
Click to collapse
I hope it leads to Meego for the infuse, I kinda dislike Android, its too slow, too fractured, we shouldn't need all this super fast hardware to get a smooth experience. but I have never used Meego. Even with a lack of a huge app market it has to be better than lame ios or win phone7.

Wow, reading these threads and the custom bootloaders threads makes me realize how much smarter some of you are than me. I can only thank you for your work done and time given to the community. Great work to everyone involved!

AJerman said:
Wow, reading these threads and the custom bootloaders threads makes me realize how much smarter some of you are than me.
Click to expand...
Click to collapse
Personally...
Naah, I've just got loads of time to waste for pretty useless things (mainly, once per few months something useful like HIBL comes out) :d

https://m.google.com/app/plus/mp/217/#~loop:aid=z12pxpqbdlikhv0rj04cd5gbiz3wg5eqqjg&view=activity

Ok. I'm having a problem. We have USB debug mode..
Code:
Bus 001 Device 035: ID 04e8:1234 Samsung Electronics Co., Ltd
It is enumerating properly in Linux.
It is uploading the HIBL properly as well.
Code:
[email protected]:~/Desktop$ sudo smdk-usbdl -a d0020000 -f ./HIBL.bin
SMDK42XX,S3C64XX USB Download Tool
Version 0.20 (c) 2004,2005,2006 Ben Dooks <[email protected]>
S3C64XX Detected!
=> found device: bus 001, dev 034
=> loaded 24576 bytes from ./HIBL.bin
=> Downloading 24586 bytes to 0xd0020000
=> Data checksum 5d9c
=> usb_bulk_write() returned 24586
[email protected]:~/Desktop$
However, the device does not un-enumerate and re-enumerate as it usually does after receiving and executing the HIBL.
Here is the UART output from uploading HIBL.
Code:
Insert an OTG cable into the connector!
����
Uart negotiation Error
����
Here is a typical boot.
Code:
Uart negotiation Error
Insert an OTG cable into the connector!
Enumeration TimeOut Error
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val 2
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val e
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x80040)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 3660mV, soc = 13
check_quick_start_condition- Voltage: 3660.0, Linearized[0/15/30], Capacity: 12
init_fuel_gauge: vcell = 3660mV, soc = 13, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0xc0
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x1
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x0
PMIC_STATUS2 = 0x0
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 0, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0x871f8801)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=0x31352402 0x61dc00ec
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
Uncompressing Linux.............................................................
[ 0.000000] copy: bad source 0
[ 0.000000] mout_audss: bad source 0
[ 0.090119] KERNEL:kernel_sec_get_debug_level_from_boot=0x574f4c44
[ 0.094853] KERNEL:magic_number=0x0 DEBUG LEVEL low!!
[ 0.099864] (kernel_sec_set_upload_cause) : upload_cause set 0
[ 0.804603] irq requested hpd irq
[ 0.850107] --------A1026 i2c driver A1026_probe called
[ 0.853875] --------A1026_probe: device not supported
[ 0.859131] --------A1026_driver_init successful
[ 0.863514] --------A1026_dev_powerup called
[ 3.007976] Failed to request gpio touchkey_init:738
[ 3.011482] Failed to request gpio touchkey_init:740
[ 12.856445] init: [disk_config] initialize_mbr_flash for S1_EUR
[ 12.860891] init: [disk_config] [Disk Size (16005464064), (15630336k), secto]
[ 12.870565] init: [disk_config] calc_pte_of_disk -> start 64 num lba 2732844
[ 12.879153] init: [disk_config] calc_pte_of_disk -> start 27328512 num lba 3
[ 12.888197] init: [disk_config] compare_partition -> num_part 0 , offset (44)
[ 12.896007] init: [disk_config] [ target -> Disk0 : 13992165376 (13664224k) ]
[ 12.905162] init: [disk_config] Match partition table entry ... skip(0)
[ 12.911775] init: [disk_config] compare_partition -> num_part 1 , offset (46)
[ 12.919575] init: [disk_config] [ target -> Disk1 : 2013265920 (1966080k) 00]
[ 12.928584] init: [disk_config] Match partition table entry ... skip(1)
[ 12.935185] init: [disk_config] compare_partition -> num_part 2 , offset (47)
[ 12.942987] init: [disk_config] [ target -> Disk2 : 0 (0k) 00:00:00000000:00]
[ 12.950698] init: [disk_config] Match partition table entry ... skip(2)
[ 12.957303] init: [disk_config] compare_partition -> num_part 3 , offset (49)
[ 12.965104] init: [disk_config] [ target -> Disk3 : 0 (0k) 00:00:00000000:00]
[ 12.972811] init: [disk_config] Match partition table entry ... skip(3)
[ 12.979399] init: [disk_config] bNeedRoot : 0x00
[ 12.990828] init: cannot open '/initlogo.rle'
[ 13.075055] Failed to request FM_RESET!
[ 13.172981] init: [disk_config] :::: /dev/block/mmcblk0p1 :::::
[ 13.180732] init: [disk_config] vfat_identify -> ok
[ 13.184160] init: [disk_config] :::: /dev/block/mmcblk0p2 :::::
[ 13.190129] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.196466] init: [disk_config] rfs_identify -> failed
[ 13.202486] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.207833] init: [disk_config] rfs_identify -> failed
[ 13.213839] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 13.219189] init: [disk_config] rfs_identify -> failed
[ 13.225210] init: [disk_config] rfs_format -> /system/bin/fat.format -F 32 -
[ 13.252568] init: [disk_config] rfs_format -> ok[BIF: ] FSR VERSION: FSRM
[ 13.552104] init: cannot find '/system/bin/false', disabling 'noplaylogos'
[ 13.586570] init: cannot find '/system/etc/install-recovery.sh', disabling ''
sh: can't access tty; job control turned off
$ [ 19.506760] init: no such service 'bootanim'
[ 43.514858] init: no such service 'bootanim'
[ 61.035132] init: sys_prop: permission denied uid:1000 name:dpm.allowcamera
[ 71.204861] init: untracked pid 3290 exited
����
Uart negotiation Error
Rebellos, any ideas?

Updated 3rd post in this thread. We found out another S5PC110 iROM revision for the first time.

It's working. Excellent work Rebellos!
This log shows HIBL, then SBL going into download mode. Then a heimdall print-pit was excuted and the device rebooted.
Code:
����
Uart negotiation Error
-------------------------------------------------------------
Hummingbird Interceptor Boot Loader (HIBL) v1.0
Copyright (C) Rebellos 2011
-------------------------------------------------------------
Calling IBL Stage2 ...OK
Testing DRAM1 ...OK
iRAM reinit ...OK
cleaning OTG context ...OK
Chain of Trust has been successfully compromised.
Begin unsecure download now...
0x00000000BL3 EP: 0x40244000
Download complete, hold download mode key combination.
Starting BL3 in...
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Modified by Rebell
Build On: Jun 8 2011 21:44:47
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 4102mV, soc = 80
check_quick_start_condition_with_charger- Voltage: 4102.50000, Linearized[64/79/94], Capacity: 83
init_fuel_gauge: vcell = 4102mV, soc = 80, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x28
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x20
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
reading nps status file is successfully!.
nps status=0x504d4f43
==> Welcome to ARIES!
==> Entering usb download mode..
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
Error : Current Mode is Host
EP2: 0, 2, 0; len=7
EP2: 0, 2, 0; len=7
sug: IN EP asserted
Error:Invalid connection string!
Error:Invalid connection string!
- Odin is connected!
set_nps_update_start: set nps start flag successfully.
process_packet: request id(100), data id(0)
process_rqt_init: platform number(0x0), revision(0x0)
process_packet: request id(100), data id(1)
process_packet: request id(101), data id(1)
.Done.
read 1 units.
check_pit_integrity: valid pit magic code.
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(2)
process_packet: request id(101), data id(3)
process_packet: request id(103), data id(0)
process_rqt_close: xmit completed!
set_nps_update_completed: set nps completed flag successfully.
process_packet: request id(103), data id(1)
process_rqt_close: target reset!
ARIES MAGIC_ADDR=0x0 / INFORM5=0x12345678
1
-----------------------------------------------------------
Samsung Primitive Bootloader (PBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------
+n1stVPN 2688
+nPgsPerBlk 64
PBL found bootable SBL: Partition(3).
MAX8893_REG_ONOFF return val 1
MAX8893_REG_DISCHARGE return val ff
MAX8893_REG_LSTIME return val 8
MAX8893_REG_DVSRAMP return val 9
MAX8893_REG_BUCK return val 2
MAX8893_REG_LDO1 return val 2
MAX8893_REG_LDO1 new val e
MAX8893_REG_LDO2 return val e
MAX8893_REG_LDO2 new val 10
MAX8893_REG_ONOFF return val 1
MAX8893_REG_ONOFF new val 21
MAX8893_REG_ONOFF return val 21
MAX8893_REG_ONOFF new val 31
Set cpu clk. from 400MHz to 800MHz.
OM=0x29, device=OnenandMux(Audi)
IROM e-fused - Non Secure Boot Version.
-----------------------------------------------------------
Samsung Secondary Bootloader (SBL) v3.0
Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
Board Name: ARIES REV 03
Build On: May 19 2011 22:17:14
-----------------------------------------------------------
Re_partition: magic code(0x0)
[PAM: ] ++FSR_PAM_Init
[PAM: ] OneNAND physical base address : 0xb0000000
[PAM: ] OneNAND virtual base address : 0xb0000000
[PAM: ] OneNAND nMID=0xec : nDID=0x50
[PAM: ] --FSR_PAM_Init
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
partitions loading success
board partition information update.. source: 0x0
Now Read Images - ID : 1
.Done.
read 1 units.
==== PARTITION INFORMATION ====
ID : IBL+PBL (0x0)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 0
NO_UNITS : 1
===============================
ID : PIT (0x1)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1
NO_UNITS : 1
===============================
ID : EFS (0x14)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 2
NO_UNITS : 40
===============================
ID : SBL (0x3)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 42
NO_UNITS : 5
===============================
ID : SBL2 (0x4)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 47
NO_UNITS : 5
===============================
ID : PARAM (0x15)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 52
NO_UNITS : 20
===============================
ID : KERNEL (0x6)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 72
NO_UNITS : 30
===============================
ID : RECOVERY (0x7)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 102
NO_UNITS : 30
===============================
ID : FACTORYFS (0x16)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 132
NO_UNITS : 1146
===============================
ID : DBDATAFS (0x17)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1278
NO_UNITS : 536
===============================
ID : CACHE (0x18)
ATTR : RW STL SLC (0x1101)
FIRST_UNIT : 1814
NO_UNITS : 130
===============================
ID : MODEM (0xb)
ATTR : RO SLC (0x1002)
FIRST_UNIT : 1944
NO_UNITS : 60
===============================
loke_init: j4fs_open success..
load_lfs_parameters valid magic code and version.
reading nps status file is successfully!.
nps status=0x504d4f43
load_debug_level reading debug level from file successfully(0x574f4c44).
init_fuel_gauge: vcell = 4101mV, soc = 80
check_quick_start_condition_with_charger- Voltage: 4101.25000, Linearized[67/82/97], Capacity: 83
init_fuel_gauge: vcell = 4101mV, soc = 80, rcomp = d01f
reading nps status file is successfully!.
nps status=0x504d4f43
PMIC_IRQ1 = 0x0
PMIC_IRQ2 = 0x0
PMIC_IRQ3 = 0x0
PMIC_IRQ4 = 0x0
PMIC_STATUS1 = 0x40
PMIC_STATUS2 = 0x2c
get_debug_level current debug level is 0x574f4c44.
aries_process_platform: Debug Level Low
keypad_scan: key value ----------------->= 0x0
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
check_download: micorusb_status1 = 4, key_value = 0
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
lcd_power_on_ld9040
s6e63m0_c110_spi_read_byte-------------------------: 86
DA lcd ID1 = 86
s6e63m0_c110_spi_read_byte-------------------------: 48
DB lcd ID2 = 48
s6e63m0_c110_spi_read_byte-------------------------: 44
DC lcd ID3 = 44
LCD_ID == 3
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0x871f8801)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=0x31352402 0x61dc00ec
setting param.board_rev=0x30
setting param.cmdline=console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...
Uncompressing Linux..............................................................................................................
[ 0.000000] copy: bad source 0
[ 0.000000] mout_audss: bad source 0
[ 0.090122] KERNEL:kernel_sec_get_debug_level_from_boot=0x574f4c44
[ 0.094863] KERNEL:magic_number=0x0 DEBUG LEVEL low!!
[ 0.099874] (kernel_sec_set_upload_cause) : upload_cause set 0
[ 0.802403] irq requested hpd irq
[ 0.846178] --------A1026 i2c driver A1026_probe called
[ 0.849942] --------A1026_probe: device not supported
[ 0.855208] --------A1026_driver_init successful
[ 0.859587] --------A1026_dev_powerup called
[ 3.004125] Failed to request gpio touchkey_init:738
[ 3.007639] Failed to request gpio touchkey_init:740
[ 12.613596] init: [disk_config] initialize_mbr_flash for S1_EUR
[ 12.617987] init: [disk_config] [Disk Size (16005464064), (15630336k), sector_size 512 :: num_lba 31260672 ]
[ 12.627716] init: [disk_config] calc_pte_of_disk -> start 64 num lba 27328448 next : 27328512
[ 12.636293] init: [disk_config] calc_pte_of_disk -> start 27328512 num lba 3932160 next : 31260672
[ 12.645348] init: [disk_config] compare_partition -> num_part 0 , offset (446)(0x1be)
[ 12.653148] init: [disk_config] [ target -> Disk0 : 13992165376 (13664224k) 00:0c:00000040:01a0ffc0 ]
[ 12.662313] init: [disk_config] Match partition table entry ... skip(0)
[ 12.668924] init: [disk_config] compare_partition -> num_part 1 , offset (462)(0x1ce)
[ 12.676721] init: [disk_config] [ target -> Disk1 : 2013265920 (1966080k) 00:0c:01a10000:003c0000 ]
[ 12.685729] init: [disk_config] Match partition table entry ... skip(1)
[ 12.692391] init: [disk_config] compare_partition -> num_part 2 , offset (478)(0x1de)
[ 12.700135] init: [disk_config] [ target -> Disk2 : 0 (0k) 00:00:00000000:00000000 ]
[ 12.707841] init: [disk_config] Match partition table entry ... skip(2)
[ 12.714454] init: [disk_config] compare_partition -> num_part 3 , offset (494)(0x1ee)
[ 12.722244] init: [disk_config] [ target -> Disk3 : 0 (0k) 00:00:00000000:00000000 ]
[ 12.729962] init: [disk_config] Match partition table entry ... skip(3)
[ 12.736538] init: [disk_config] bNeedRoot : 0x00
[ 12.748654] init: cannot open '/initlogo.rle'
[ 12.832898] Failed to request FM_RESET!
[ 12.931189] init: [disk_config] :::: /dev/block/mmcblk0p1 :::::
[ 12.938955] init: [disk_config] vfat_identify -> ok
[ 12.942398] init: [disk_config] :::: /dev/block/mmcblk0p2 :::::
[ 12.948354] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.954696] init: [disk_config] rfs_identify -> failed
[ 12.960739] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.966056] init: [disk_config] rfs_identify -> failed
[ 12.972089] init: [disk_config] Error ::rfs_identify -> oem_name ()
[ 12.977424] init: [disk_config] rfs_identify -> failed
[ 12.983432] init: [disk_config] rfs_format -> /system/bin/fat.format -F 32 -S 4096 -s 4 /dev/block/mmcblk0p2
[ 13.009915] init: [disk_config] rfs_format -> ok[BIF: ] FSR VERSION: FSR_1.2.1p1_b139_RTM
[ 13.310236] init: cannot find '/system/bin/false', disabling 'noplaylogos'
[ 13.337944] init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
sh: can't access tty; job control turned off
$ [ 19.257644] init: no such service 'bootanim'
[ 39.060649] init: sys_prop: permission denied uid:1000 name:wifi.interface
[ 44.151646] init: no such service 'bootanim'
the commands run were:
Code:
sudo smdk-usbdl -a d0020000 -f ./Infuse_HIBL_3.bin
sudo smdk-usbdl -a d40244000 -f ./Sbl.bin
You can get these pre-release binaries here: http://www.mediafire.com/file/yewg81mwdklb357/HIBLandSblBinaries.zip
Everything is working but I have not yet tested flashing. Flashing should go off without a hitch. You will use Odin 1.7 or 1.8.

NEC Renesas EMMA EV2 boot loader explained

If you want to known more about the boot sequence for this platform), you can refer the following document:
R19UH0036EJ0600.pdf (1 chip, which can be downloaded from http://www.renesas.eu/products/soc/assp/mobile/emma_mobile/emma_mobile_ev/index.jsp)
Appendix C: Boot loader in ROM
I assume you have U-boot source code. If you don’t, you can download here:
http://dl.dropbox.com/u/60117641/u-boot-bspgb-110801.tar.gz
this is the one Renesas officially released. Livall and Smallart (two of the manufacturers of tablets based on Renesas SoC) both modified it.
I'll explain a "Smallart" firmware update package first:
sdboot.bin: is a pre-loader that used only in sd card boot mode, the source code in board/emxx/emev/mini-boot/, and the lowlevel-init.S is also compiled
uboot-sd.bin is u-boot
uImage: this is the common Linux kernel image, it include a initial RAM disk image, so it can boot without root file system, it is only used in recovery mode.
update.zip: It include uboot-emmc, uImage and root fs, which will be extracted into eMMC flash during installation.
Please understand that your package is not the “Run time “ image, it is used to install Android on eMMC flash, all the “Run time” files are in “update.zip”
A "Livall" update package is composed of:
sdboot.bin: this is same as Smallart, it is pre-loader
uboot-sd.bin: this is also same, uboot
uImage4: this is the image both for sd card boot and copied to eMMC flash
cramfs4: this is a cramfs type root fs image, it will be loaded as a ramdisk in Android installation.
uboot4.bin: this is the boot loader for eMMC boot, it will be copied to eMMC flash
android-fs4.tar.gz: this is android filesystem
ff4: this is the eMMC partition table.

Trying a build, in my env where I have the Android NDK (release 6) toolchain installed.
> export CROSS_COMPILE=arm-linux-androideabi-
> tar xzf u-boot-bspgb-110801.tar.gz
> cd u-boot
1) For an eMMC boot
> make distclean
> make emev_emmc_config
> make
This was succesfull. Got these files:
-rwxr-xr-x 1 root root 390296 Feb 2 05:47 u-boot.srec
-rw-r--r-- 1 root root 114797 Feb 2 05:47 u-boot.map
-rwxr-xr-x 1 root root 130068 Feb 2 05:47 u-boot.bin
-rwxr-xr-x 1 root root 453562 Feb 2 05:47 u-boot
-rw-r--r-- 1 root root 19488 Feb 2 05:47 System.map
-rw-r--r-- 1 root root 138260 Feb 2 05:47 u-boot-emmc.bin
2) For an SD boot:
> make distclean
> make emev_sd_line_config
> make
-rwxr-xr-x 1 root root 389442 Feb 2 06:08 u-boot.srec
-rw-r--r-- 1 root root 129784 Feb 2 06:08 uboot-sd.bin
-rw-r--r-- 1 root root 114675 Feb 2 06:08 u-boot.map
-rwxr-xr-x 1 root root 129784 Feb 2 06:08 u-boot.bin
-rwxr-xr-x 1 root root 447246 Feb 2 06:08 u-boot
-rw-r--r-- 1 root root 19523 Feb 2 06:08 System.map
-rwxr-xr-x 1 root root 8312 Feb 2 06:08 sdboot.bin
Note here the "sdboot.bin", which is the "mini-boot" as referred in the datasheet.
--- EDIT ---
Apply the next patch, if your board have 512MB DDR memory.
Code:
index 707d2d4..2e4a767 100644
--- a/board/emxx/emev/lowlevel_init_val.h
+++ b/board/emxx/emev/lowlevel_init_val.h
@@ -22,7 +22,7 @@
#define EMXX_PWC_CHANGE_CORE
#ifndef CONFIG_EMXX_UNUSE_AB
-#define EMXX_READ_VERSION
+/*#define EMXX_READ_VERSION*/
#endif
/*****************************************************
@@ -228,13 +228,13 @@
#define MEMC_REQSCH_VAL 0x0000001f
-#define MEMC_DDR_CONFIGF_VAL 0x8e000004
+#define MEMC_DDR_CONFIGF_VAL 0x8e000008
#define MEMC_DDR_CONFIGA1_VAL 0x5c4a4517
#define MEMC_DDR_CONFIGA2_ES1 0x8800a840
#define MEMC_DDR_CONFIGA2_ES2 0x8800aa60
#define MEMC_DDR_CONFIGA2_ES3 0x8800a840
-#define MEMC_DDR_CONFIGR3_VAL1 0xc11a0000
+#define MEMC_DDR_CONFIGR3_VAL1 0xc12c0000
#define MEMC_DDR_CONFIGC1_VAL1 0x40400043
#define MEMC_DDR_CONFIGC2_VAL1 0x0000001d

Let me explain the boot sequence in slight higher detail, u-boot can be compiled with different configuration:
emev_emmc_config
emev_sd_config
emev_sd_line_config
EM/EV ROM boot code exist in 0xFFFF_0000, and it use internal SRAM 0xF000_0000
This ROM boot code will load mini-boot to SRAM and jump to 0xF000_0000
For SD boot mode, miniboot is sdboot.bin in SD card root directory
For eMMC boot: miniboot is the first 8K bytes in mmcblk0p1
Miniboot load the remained part
SD boot:
Load rest of u-boot (uboot-sd.bin to DDR#0x4100_8000)
Load kernel image (uImage to DDR#0x4000_7fc0)
Load ram disk (cramfs to DDR#0x4600_0000), this is optional due to compile option
eMMC boot:
Load rest of u-boot (mmcblk0p1#0x0000_2000-0x0004_0000 to DDR#0x4100_8000)
Load kernel image (mmcblk0p2 to DDR#0x4000_7fc0)
Then jump to u-boot
There will be different boot arguments from u-boot, the definition of which can be found in the u-boot code, in include/configs/emev.h:
Code:
...
#define CONFIG_CRAMFSCMD "setenv bootargs root=/dev/null noinitrd init=/linuxrc console=ttyS0,115200n8n SELINUX_INIT=no \$(cfg_ddr) ro video=qfb: ip=none rootflags=physaddr=0x00500000\;bootm 00080000"
#ifdef CONFIG_EMXX_SDBOOT_LINE /* SD boot linesystem */
#define CONFIG_EXT3CMD "setenv bootargs root=/dev/null noinitrd init=/linuxrc console=ttyS0,115200n8n SELINUX_INIT=no [email protected] rw video=qfb: ip=none rootflags=physaddr=0x46000000\;bootm 40007fc0"
#else
#define CONFIG_EXT3CMD "setenv bootargs root=\$(ext3_root) noinitrd init=/linuxrc console=ttyS0,115200n8n SELINUX_INIT=no \$(cfg_ddr) rw video=qfb: ip=none rootfstype=ext3 rootwait\;bootm 40007fc0"
#endif
...
If you mount mount cramfs to your file system, out of a "Livall" typical update package (which includes botha a "cramfs4" file and an "install.sh" script), you can see how the install script is invoked:
Code:
sudo mkdir /mnt/cramfs
sudo mount -o loop cramfs4 /mnt/cramfs
ls -l /mnt/cramfs/linuxrc
lrwxrwxrwx 1 root root 11 1970-01-01 01:00 /mnt/cramfs/linuxrc -> bin/busybox
cd /mnt/cramfs/etc/init.d/
cat rcS
...
INSTALL_SH=`ls /tmp/sd/install.sh`
if [ "$INSTALL_SH" = "/tmp/sd/install.sh" ]; then
/tmp/sd/install.sh
fi
...
Note how the boot command inlcudes "init=/linuxrc", which points to a standard busybox executable. This will by default invoke the "::sysinit:/etc/init.d/rcS" action.
I hope this information can help the Renesas community ...

The bootloader source code, including a README for the Renesas EM EV2 platform, is shared onto a public GitHub repository too:
https://github.com/ffxx68/RenesasEV2-bootloader

HTC bricked?

Hey Folks,
My apologies if this should be in a different forum.
Read the "efffen-manual" when using the AAHK software. The unit went through about 7 minutes of scripts on option 1 (Hack Ace), then stopped in <waiting for device>. Been like this for now 20 minutes. Screen is black, unit appears to be off, Power button does nothing. Only orange charging light is blinking. Oh, and one other thing, When it got to this point, the windows system had a balloon popup about the Motorola (or did it say qualcom) device not recognized. Suggestions?
Here is the code thus far.
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
*********************************************************************
q - Quit
[Select and press Enter]1
/sdcard/PD98IMG.zip: No such file or directory
rm failed for /sdcard/PD98IMG.zip, No such file or directory
1867 KB/s (4359771 bytes in 2.279s)
pkg: /data/local/tmp/stericson.busybox-1.apk
Success
1878 KB/s (19240 bytes in 0.010s)
2596 KB/s (4564992 bytes in 1.717s)
2790 KB/s (3737600 bytes in 1.308s)
2644 KB/s (557962 bytes in 0.206s)
683 KB/s (9796 bytes in 0.014s)
2442 KB/s (572752 bytes in 0.229s)
2678 KB/s (134401 bytes in 0.049s)
909 KB/s (13968 bytes in 0.015s)
ro.build.version.release=2.3.3
Setting up for Gingerbread restore...
2554 KB/s (2801664 bytes in 1.071s)
2717 KB/s (2830336 bytes in 1.017s)
2407 KB/s (285981 bytes in 0.116s)
2685 KB/s (285981 bytes in 0.104s)
1 file(s) copied.
Linux version 2.6.35.10-gd2564fb ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Jun 9 14:33:05 CST 2011
Kernel version is Gingerbread... Using fre3vo to temproot...
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Scanning region fbb70000...
Potential exploit area found at address fbb80e00:200.
Exploiting device...
/dev/block/vold/179:65 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.004 secs (96000 bytes/sec)
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
Starting update process....
< waiting for device >
erasing 'cache'... OKAY [ 0.163s]
finished. total time: 0.164s
Be patient - sending update ...
sending 'zip' (18223 KB)... OKAY [ 3.071s]
writing 'zip'... INFOadopting the signature contained in this i
mage...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOchecking main version...
INFOstart image[boot] unzipping & flushing...
INFO[RUU]UZ,boot,0
INFO[RUU]UZ,boot,31
INFO[RUU]UZ,boot,68
INFO[RUU]UZ,boot,99
INFO[RUU]UZ,boot,100
INFO[RUU]WP,boot,0
INFO[RUU]WP,boot,100
INFOstart image[recovery] unzipping & flushing...
INFO[RUU]UZ,recovery,0
INFO[RUU]UZ,recovery,20
INFO[RUU]UZ,recovery,44
INFO[RUU]UZ,recovery,66
INFO[RUU]UZ,recovery,89
INFO[RUU]UZ,recovery,100
INFO[RUU]WP,recovery,0
INFO[RUU]WP,recovery,100
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,62
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,99
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,51
INFO[RUU]WP,radio,59
INFO[RUU]WP,radio,68
INFO[RUU]WP,radio,76
INFO[RUU]WP,radio,85
INFO[RUU]WP,radio,95
INFO[RUU]WP,radio,100
OKAY [108.400s]
finished. total time: 111.472s
rebooting...
finished. total time: 0.172s
Radio downgrade complete - starting next process - please be patient...
Linux version 2.6.32.21-gf3f553d ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Oct 28 13:24:11 CST 2010
major abra-cadabra going on, please be patient.....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
- Address: 0xc02a9e00 + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
patience - rebooting
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02db000
Kernel memory mapped to 0x40009000
Searching for brq filter...
- Address: 0xc02db21c + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
patching secu_flag: 0
Done.
board_spade.disable_uart2=0 board_spade.usb_h2w_sw=0 board_spade.disable_sdcard=
0 diag.enabled=0 board_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
mmc=true androidboot.baseband=26.03.02.26_M androidboot.cid=CWS__001 androidboo
t.batt_poweron=good_battery androidboot.carrier=ATT androidboot.mid=PD9812000 en
able_zcharge=1 androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.
serialno=HT14JT200132 androidboot.bootloader=0.85.0024 zygote_oneshot=off kmemle
ak=off no_console_suspend=1
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
push: tools/afr/system/bin/su -> /system/bin/su
2 files pushed. 0 files skipped.
2045 KB/s (609587 bytes in 0.291s)
dmagent mmcamera_test su
dmesg monkey surfaceflinger
ifconfig printenv wpa_supplicant
S-OFF, ROOT and Clockworkmod recovery complete
Be patient - installing updated radio and AAHK ENG Hboot...
Starting update process....
< waiting for device >

Greech said:
Hey Folks,
My apologies if this should be in a different forum.
Read the "efffen-manual" when using the AAHK software. The unit went through about 7 minutes of scripts on option 1 (Hack Ace), then stopped in <waiting for device>. Been like this for now 20 minutes. Screen is black, unit appears to be off, Power button does nothing. Only orange charging light is blinking. Oh, and one other thing, When it got to this point, the windows system had a balloon popup about the Motorola (or did it say qualcom) device not recognized. Suggestions?
Here is the code thus far.
Ace Advanced Hack Kit [Linux/OSX/Windows] attn1 2011/2012
___________________________
MAIN MENU | |
| Only ONE Menu Step to: |
1 - Hack Ace <----------------------------+ * S-OFF |
| * SIM Unlock |
2 - DONATE (Encouraged, but optional) | * SuperCID |
http://psas.revskills.de/?q=goldcard | * Root |
http://www.eff.org/ | * Busybox |
| |
**********************************************************************
o - Options Menu (Return to Stock, Flash radios, etc)
**********************************************************************
t - Toggle Flash Method - current method is fastbootRUU
*********************************************************************
q - Quit
[Select and press Enter]1
/sdcard/PD98IMG.zip: No such file or directory
rm failed for /sdcard/PD98IMG.zip, No such file or directory
1867 KB/s (4359771 bytes in 2.279s)
pkg: /data/local/tmp/stericson.busybox-1.apk
Success
1878 KB/s (19240 bytes in 0.010s)
2596 KB/s (4564992 bytes in 1.717s)
2790 KB/s (3737600 bytes in 1.308s)
2644 KB/s (557962 bytes in 0.206s)
683 KB/s (9796 bytes in 0.014s)
2442 KB/s (572752 bytes in 0.229s)
2678 KB/s (134401 bytes in 0.049s)
909 KB/s (13968 bytes in 0.015s)
ro.build.version.release=2.3.3
Setting up for Gingerbread restore...
2554 KB/s (2801664 bytes in 1.071s)
2717 KB/s (2830336 bytes in 1.017s)
2407 KB/s (285981 bytes in 0.116s)
2685 KB/s (285981 bytes in 0.104s)
1 file(s) copied.
Linux version 2.6.35.10-gd2564fb ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Jun 9 14:33:05 CST 2011
Kernel version is Gingerbread... Using fre3vo to temproot...
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Scanning region fbb70000...
Potential exploit area found at address fbb80e00:200.
Exploiting device...
/dev/block/vold/179:65 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
HTC android goldcard tool Copyright (C) 2011, Wayne D. Hoxsie Jr.
Original code by B. Kerler. Special thanks to ATTN1 and the XDA team.
Donations can be made to the Electronic Frontier Foundation:
http://www.eff.org/
or to B. Kerler:
http://psas.revskills.de/
0+1 records in
0+1 records out
384 bytes transferred in 0.004 secs (96000 bytes/sec)
--set_version set. VERSION will be changed to: 1.31.405.6
Misc partition is "/dev/block/mmcblk0p17"
Patching and backing up misc partition...
Starting update process....
< waiting for device >
erasing 'cache'... OKAY [ 0.163s]
finished. total time: 0.164s
Be patient - sending update ...
sending 'zip' (18223 KB)... OKAY [ 3.071s]
writing 'zip'... INFOadopting the signature contained in this i
mage...
INFOsignature checking...
INFOzip header checking...
INFOzip info parsing...
INFOchecking model ID...
INFOchecking custom ID...
INFOchecking main version...
INFOstart image[boot] unzipping & flushing...
INFO[RUU]UZ,boot,0
INFO[RUU]UZ,boot,31
INFO[RUU]UZ,boot,68
INFO[RUU]UZ,boot,99
INFO[RUU]UZ,boot,100
INFO[RUU]WP,boot,0
INFO[RUU]WP,boot,100
INFOstart image[recovery] unzipping & flushing...
INFO[RUU]UZ,recovery,0
INFO[RUU]UZ,recovery,20
INFO[RUU]UZ,recovery,44
INFO[RUU]UZ,recovery,66
INFO[RUU]UZ,recovery,89
INFO[RUU]UZ,recovery,100
INFO[RUU]WP,recovery,0
INFO[RUU]WP,recovery,100
INFOstart image[radio] unzipping & flushing...
INFO[RUU]UZ,radio,0
INFO[RUU]UZ,radio,8
INFO[RUU]UZ,radio,13
INFO[RUU]UZ,radio,20
INFO[RUU]UZ,radio,25
INFO[RUU]UZ,radio,33
INFO[RUU]UZ,radio,41
INFO[RUU]UZ,radio,49
INFO[RUU]UZ,radio,57
INFO[RUU]UZ,radio,62
INFO[RUU]UZ,radio,70
INFO[RUU]UZ,radio,79
INFO[RUU]UZ,radio,86
INFO[RUU]UZ,radio,94
INFO[RUU]UZ,radio,99
INFO[RUU]UZ,radio,100
INFO[RUU]WP,radio,0
INFO[RUU]WP,radio,6
INFO[RUU]WP,radio,14
INFO[RUU]WP,radio,19
INFO[RUU]WP,radio,27
INFO[RUU]WP,radio,36
INFO[RUU]WP,radio,44
INFO[RUU]WP,radio,51
INFO[RUU]WP,radio,59
INFO[RUU]WP,radio,68
INFO[RUU]WP,radio,76
INFO[RUU]WP,radio,85
INFO[RUU]WP,radio,95
INFO[RUU]WP,radio,100
OKAY [108.400s]
finished. total time: 111.472s
rebooting...
finished. total time: 0.172s
Radio downgrade complete - starting next process - please be patient...
Linux version 2.6.32.21-gf3f553d ([email protected]) (gcc version 4.4.0 (GCC) )
#1 PREEMPT Thu Oct 28 13:24:11 CST 2010
major abra-cadabra going on, please be patient.....
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21-gf3f553d
New .modinfo section size: 204
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02a9e00, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02a9000
Kernel memory mapped to 0x40000000
Searching for brq filter...
- Address: 0xc02a9e00 + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
Error opening copy file.
Error opening copy file.
^^^^^^^^^^^^
I- NORMAL ERROR HERE -I
patience - rebooting
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
--secu_flag off set
--cid set. CID will be changed to: 11111111
--sim_unlock. SIMLOCK will be removed
Section header entry size: 40
Number of section headers: 44
Total section header table size: 1760
Section header file offset: 0x000138b4 (80052)
Section index for section name string table: 41
String table offset: 0x000136fb (79611)
Searching for .modinfo section...
- Section[16]: .modinfo
-- offset: 0x00000a14 (2580)
-- size: 0x000000cc (204)
Kernel release: 2.6.32.21
New .modinfo section size: 196
Attempting to power cycle eMMC... OK.
Searching for mmc_blk_issue_rq symbol...
- Address: c02db21c, type: t, name: mmc_blk_issue_rq, module: N/A
Kernel map base: 0xc02db000
Kernel memory mapped to 0x40009000
Searching for brq filter...
- Address: 0xc02db21c + 0x34c
- 0x2a000012 -> 0xea000012
Patching and backing up partition 7...
patching secu_flag: 0
Done.
board_spade.disable_uart2=0 board_spade.usb_h2w_sw=0 board_spade.disable_sdcard=
0 diag.enabled=0 board_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
mmc=true androidboot.baseband=26.03.02.26_M androidboot.cid=CWS__001 androidboo
t.batt_poweron=good_battery androidboot.carrier=ATT androidboot.mid=PD9812000 en
able_zcharge=1 androidboot.keycaps=qwerty androidboot.mode=recovery androidboot.
serialno=HT14JT200132 androidboot.bootloader=0.85.0024 zygote_oneshot=off kmemle
ak=off no_console_suspend=1
push: tools/afr/system/app/Superuser.apk -> /system/app/Superuser.apk
push: tools/afr/system/bin/su -> /system/bin/su
2 files pushed. 0 files skipped.
2045 KB/s (609587 bytes in 0.291s)
dmagent mmcamera_test su
dmesg monkey surfaceflinger
ifconfig printenv wpa_supplicant
S-OFF, ROOT and Clockworkmod recovery complete
Be patient - installing updated radio and AAHK ENG Hboot...
Starting update process....
< waiting for device >
Click to expand...
Click to collapse
Please come to the IRC channel in my signature. That is Hack Kit support channel

Bricked n suckss
i need help my htc inspire was in process of rooting w/t ace hackn power went out on installing radio100 and its stayed on black backround w/t rooted HTC logo and dats all it does witch 4 logos in evry corner
please help

[Q] Overlay Error

Hello,
I'm trying to port Ubuntu Touch for Photon Q. I'm posting in this section, because the error I get is generic. My phone fails to boot. The display flickers several times and last_kmsg contains the following message multiple times (the number is consistent with the number of flickers):
Code:
[ 13.802716,0] mdp4_calc_req_mdp_clk: src_h is zero!
[ 13.807477,0] mdp4_overlay_borderfill_stage_down: no base layer at mixer=1
Can someone please tell me what might be causing this error?
Thank you!

Some more information from the log:
Code:
E/Adreno200-GSL( 1138): <ioctl_kgsl_driver_entry:402>: open(/dev/kgsl-3d0) failed: errno 2. No such file or directory
But the device is there:
Code:
ls -l /dev/kgsl*
crw-rw-rw- 1 root root 241, 1 Nov 26 01:08 /dev/kgsl-2d0
crw-rw-rw- 1 root root 241, 2 Nov 26 01:08 /dev/kgsl-2d1
crw-rw-rw- 1 root root 241, 0 Nov 26 01:08 /dev/kgsl-3d0

Cannot Solve Bootloop TF700 with TWRP and KatKiss

Hi all,
I have tried to follow the instructions for fixing a bootloop here.
I am using Linux Mint 18.3 as my laptop OS.
I can push the bootit..ko file on to the device but when I run insmod I get this error message:
Code:
error: protocol fault (no status)
I think it is because TWRP crashes before the command can complete and the device starts rebooting.
I can see the device is connected on doing
Code:
adb devices
List of devices attached
015d29955b3ffe11 recovery
and I can even see the contents of the / directory:
Code:
blimey~/work/android_roms/recovery_images $ adb shell ls -ltr /
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
-rw-r--r-- 1 root root 4603 Jan 1 1970 ueventd.rc
-rw-r--r-- 1 root root 2520 Jan 1 1970 ueventd.cardhu.rc
drwxr-xr-x 5 root root 0 Jan 1 1970 twres
drwxr-xr-x 3 root root 0 Jan 1 1970 system
-rw-r--r-- 1 root root 9438 Jan 1 1970 service_contexts
-rw-r--r-- 1 root root 120253 Jan 1 1970 sepolicy
-rw-r--r-- 1 root root 52 Jan 1 1970 selinux_version
-rw-r--r-- 1 root root 578 Jan 1 1970 seapp_contexts
drwxr-x--- 2 root root 0 Jan 1 1970 sbin
drwxr-xr-x 3 root root 0 Jan 1 1970 res
-rw-r--r-- 1 root root 2920 Jan 1 1970 property_contexts
drwxr-xr-x 3 root root 0 Jan 1 1970 license
-rwxr-x--- 1 root root 1327 Jan 1 1970 init.recovery.usb.rc
-rwxr-x--- 1 root root 2814 Jan 1 1970 init.rc
-rwxr-x--- 1 root root 305668 Jan 1 1970 init
-rw-r----- 1 root root 1839 Jan 1 1970 fstab.cardhu
-rw-r--r-- 1 root root 11473 Jan 1 1970 file_contexts
-rw-r--r-- 1 root root 3044 Jan 1 1970 default.prop
drwxr-xr-x 2 root root 0 Jan 1 1970 data
lrwxrwxrwx 1 root root 13 Jan 1 1970 charger -> /sbin/healthd
dr-xr-xr-x 103 root root 0 Jan 1 1970 proc
drwxrwxr-x 2 root shell 60 Jan 8 01:17 tmp
drwxr-xr-x 13 root root 0 Jan 8 01:17 sys
drwxr-xr-x 2 root root 0 Jan 8 01:17 sideload
drwxr-xr-x 2 root root 0 Jan 8 01:17 recovery
drwxr-xr-x 11 root root 3500 Jan 8 01:17 dev
drwxr-xr-x 2 root root 0 Jan 8 01:17 boot
drwxrwxrwx 2 root root 0 Jan 8 01:17 sdcard
drwxr-xr-x 2 root root 0 Jan 8 01:17 etc
drwx------ 2 root root 0 Jan 1 2016 root
drwxrwx--- 6 system cache 4096 May 21 2017 cache
If I try to ls the file contents after pushing the bootit.ko file to check it has definitely been copied the TWRP always crashes before the command can complete (I'm guessing) and it reboots again ad infinitum.
I really don't know what else to try so any suggestions are real welcome. Thanks in advance.

Try adb shell insmod sdcard/bootit.ko

Wouldn't that entail pushing the bootit.ko to /sdcard?
I tried this:
Code:
[email protected] ~/work/android_roms/recovery_images $ adb push bootit.ko /sdcard/
672 KB/s (27690 bytes in 0.040s)
[email protected] ~/work/android_roms/recovery_images $ adb shell insmod /sdcard/bootit.ko
error: protocol fault (no status)
...but no joy, it seems like it exits TWRP before it can finish doing insmod. Also I'm not convinced the bootit.ko file is being saved to disk after each push. Am I right?

..

So I made a shell script to execute the two commands one after the other and I now got the screen with the 3 icons in the middle of the screen: RCK,Android,WipeData.
I did the following comands from that screen:
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[sudo] password for blimey:
015d29955b3ffe11 fastboot
[email protected]~/work/android_roms/recovery_images $ sudo fastboot erase misc
erasing 'misc'...
OKAY [ 1.044s]
finished. total time: 1.044s
[email protected]~/work/android_roms/recovery_images $ sudo fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 2.276s]
finished. total time: 2.276s
But after this when running fastboot devices I get no output:
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
[email protected]~/work/android_roms/recovery_images $ sudo fastboot devices
I think the battery has died so I'll recharge and give it another go tomorrow.

Care to share the script?

berndblb said:
Care to share the script?
Click to expand...
Click to collapse
Sure - see attached file, just need .txt removed from the filename.

So I picked up where I left off and this what I got:
Code:
blimey~/work/android_roms/recovery_images $ sudo fastboot devices
015d29955b3ffe11 fastboot
blimey~/work/android_roms/recovery_images $ sudo fastboot erase system
******** Did you mean to fastboot format this partition?
erasing 'system'...
OKAY [ 2.813s]
finished. total time: 2.813s
blimey~/work/android_roms/recovery_images $ sudo fastboot erase recovery
erasing 'recovery'...
OKAY [ 1.970s]
finished. total time: 1.970s
blimey~/work/android_roms/recovery_images $ sudo fastboot -w
Creating filesystem with parameters:
Size: 61415620608
Block size: 4096
Blocks per group: 32768
Inodes per group: 8192
Inode size: 256
Journal blocks: 32768
Label:
Blocks: 14994048
Block groups: 458
Reserved block group size: 1024
Created filesystem with 11/3751936 inodes and 281560/14994048 blocks
Creating filesystem with parameters:
Size: 448790528
Block size: 4096
Blocks per group: 32768
Inodes per group: 6848
Inode size: 256
Journal blocks: 1712
Label:
Blocks: 109568
Block groups: 4
Reserved block group size: 31
Created filesystem with 11/27392 inodes and 3534/109568 blocks
erasing 'userdata'...
OKAY [ 88.674s]
sending 'userdata' (141163 KB)...
OKAY [ 24.116s]
writing 'userdata'...
OKAY [ 1.483s]
erasing 'cache'...
REBOOTED THE TABLET manually HERE as per the instructions
Code:
FAILED (command write failed (Protocol error))
finished. total time: 476.548s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase boot
erasing 'boot'...
OKAY [ 2.020s]
finished. total time: 2.020s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase misc
erasing 'misc'...
OKAY [ 1.007s]
finished. total time: 1.007s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot erase cache
******** Did you mean to fastboot format this partition?
erasing 'cache'...
OKAY [ 1.740s]
finished. total time: 1.740s
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 flash system ./AsusFirmware/TF700K_all_WW_USER_V5.0.4.17.raw
erasing 'system'...
OKAY [ 2.411s]
sending 'system' (755707 KB)...
OKAY [125.324s]
writing 'system'...
OKAY [ 2.987s]
finished. total time: 130.722s
NO BLUE BAR OBSERVED ON TABLET
TABLET CONTINUES SHOWING THE 3 ICONS: RCK, ANDROID and WIPE DATA
Code:
[email protected]~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 reboot
rebooting...
Nothing happening, the tablet screen remains the same with the 3 icons.
Is the boot.blob file contained within TF700K_all_WW_USER_V5.0.4.17.raw?

I think this .raw file is the wrong file, I found a different file for my SKU on the Asus website which contains the contents in the attached screenshot. Is it blob or boot.img I should use?

Yes, flash the blob and only the blob, no extension on the file name. That should do it

So I tried that but I got this result:
Code:
[email protected] ~/work/android_roms/recovery_images $ sudo fastboot -i 0x0B05 flash system blob
erasing 'system'...
OKAY [ 2.313s]
sending 'system' (1781 KB)...
OKAY [ 1.121s]
writing 'system'...
FAILED (remote: (InvalidState))
finished. total time: 7.059s
The blue bar did appear this time but in addition to the error there is some red text in the top left corner saying "Signature mismatch"
I've googled for a solution, some people suggested here https://forum.xda-developers.com/showthread.php?t=2417097 that the system image might be the wrong version for this bootloader version (I think ).
So I downloaded the original version of the system image from http://drivers.softpedia.com/get/JOYSTICK-GAMEPAD-WHEELS-and-TABLETS/ASUS/ASUS-Transformer-Pad-Infinity-TF700T-Firmware-10611410-WW.shtml which matched the version number displayed in the bootloader and after flashing that blob hey presto its working again!!!:laugh::laugh::laugh:
Thanks a bloody million for your guidance and patience!!